CVE-2022-36485

TOTOLINK N350RT V9.3.5u.6139B20201216 was discovered to contain a command injection vulnerability via the hostName parameter in the function setOpModeCfg...

CVE-2022-36461

TOTOLINK A3700R V9.1.2u.6134B20201202 was discovered to contain a command injection vulnerability via the hostName parameter in the function setOpModeCfg...

PT-2022-23384 · Totolink · Totolink A3700R

Name of the Vulnerable Software and Affected Versions: TOTOLINK A3700R version 9.1.2u.6134 B20201202 Description: A command injection issue was found via the hostName parameter in the setOpModeCfg function. Recommendations: For TOTOLINK A3700R version 9.1.2u.6134 B20201202, avoid using the hostNa...

CVE-2022-37079: Improper Neutralization of Special Elements used in an OS Command

TOTOLINK A7000R V9.1.0u.6115B20201022 was discovered to contain a command injection vulnerability via the hostName parameter in the function setOpModeCfg...

TOTOLINK N350RT 操作系统命令注入漏洞

The TOTOLINK N350RT is a small home router from China's Gion Electronics TOTOLINK. An operating system command injection vulnerability exists in the TOTOLINK N350RT version V9.3.5u.6139B20201216, which stems from a hostName parameter command injection issue in the setOpModeCfg method...

PT-2022-23407 · Totolink · Totolink N350Rt

Name of the Vulnerable Software and Affected Versions: TOTOLINK N350RT version 9.3.5u.6139 B20201216 Description: A command injection issue was discovered via the hostName parameter in the setOpModeCfg function. This allows for potential exploitation. Recommendations: For TOTOLINK N350RT version...

PT-2022-23793 · Totolink · Totolink A7000R

Name of the Vulnerable Software and Affected Versions: TOTOLINK A7000R version 9.1.0u.6115 B20201022 Description: A command injection issue was found via the hostName parameter in the setOpModeCfg function, allowing for potential exploitation. Recommendations: For version 9.1.0u.6115 B20201022,...

CVE-2022-36485: Improper Neutralization of Special Elements used in an OS Command

TOTOLINK N350RT V9.3.5u.6139B20201216 was discovered to contain a command injection vulnerability via the hostName parameter in the function setOpModeCfg...

TOTOLINK A3700R 操作系统命令注入漏洞

The TOTOLINK A3700R is a wireless router from China's Gion Electronics TOTOLINK. An operating system command injection vulnerability exists in the TOTOLINK A3700R version V9.1.2u.6134B20201202, which stems from a command injection issue in the hostName parameter of the setOpModeCfg method...

CVE-2022-36461: Improper Neutralization of Special Elements used in an OS Command

TOTOLINK A3700R V9.1.2u.6134B20201202 was discovered to contain a command injection vulnerability via the hostName parameter in the function setOpModeCfg...

CVE-2022-32743

A flaw was found in samba that validates the domain name system's host name. This issue links a trailing $ to objectclass=computer, which helps avoid the creation of SPN values that collide with other, possibly privileged hosts...

DEBIAN-CVE-2022-35949

undici is an HTTP/1.1 client, written from scratch for Node.js.undici is vulnerable to SSRF Server-side Request Forgery when an application takes in user input into the path/pathname option of undici.request. If a user specifies a URL such as http://127.0.0.1 or //127.0.0.1 js const undici =...

CVE-2022-2047

A flaw was found in Eclipse Jetty. When parsing the authority segment of an HTTP scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This issue can lead to failures in a Proxy scenario...

Hostname Spoofing

Description parse-url parses following https url incorrectly, identifies its protocol as ssh, and its host name is parsed incorrectly either. https://www.google.com:[email protected]:x node -e 'const parseUrl=require"parse-url";console.logparseUrl"https://www.google.com:[email protected]:x"' protocols:...

PT-2023-5883

Name of the Vulnerable Software and Affected Versions curl versions 7.82.0 through 8.4.0 libcurl versions 7.82.0 through 8.4.0 MySQL versions 5.7.43 and earlier, 8.0.34 and earlier, 8.1.0 and earlier Description curl and libcurl are vulnerable to a heap buffer overflow in the SOCKS5 proxy...

Improper Input Validation Leads to Privilege Escalation and Denial of Service

Description Improper input validation allows an attacker to privilege escalation and can make crash nginx server. There is no input validation in the v-add-web-domain-redirectL82, and "v-redirect-custom" input on the "Edit Web Domain" page, inputs are written directly to the...

Zenbuster - Multi-threaded URL Enumeration/Brute-Forcing Tool

ZenBuster is a multi-threaded, multi-platform URL enumeration tool written in Python by Zach Griffin @0xTas. I wrote this tool as a way to deepen my familiarity with Python, and to help increase my understanding of Cybersecurity tooling in general. ZenBuster may not be the fastest or most...

CVE-2022-2047

In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This can lead to failures in a Proxy scenario...

GHSA-4P35-CFCX-8653 Hostname confusion in parse-url

Exposure of Sensitive Information to an Unauthorized Actor via hostname confusion in GitHub repository ionicabizau/parse-url prior to 6.0.1...

SSRF via Improper Input Validation

Description Hostname is not detected because of improper handling of username and password. Based on real cases Proof of Concept shell ❯ node -e 'const parseUrl = require"parse-url"; console.logparseUrl"http://google:com:@@localhost"' protocols: 'http' , protocol: 'http', port: null, resource:...