2083 matches found
CVE-2021-4045
CVE-2021-4045 CVE-2021-4045 — это уязвимость внедрения команд, позволяющая удаленно выполнять код в IP-камере TP-Link Tapo c200. Она затрагивает все версии прошивки до 1.1.16 Build 211209 Rel. 37726N из-за недостаточной проверки пользовательского ввода в uhttpd, одном из основных бинарных файлов...
CVE-2026-88062
OmniRoute (open-source AI gateway) versions 3.8.49 and earlier are affected by a remote code execution flaw in the POST /api/acp/agents custom ACP agent endpoint. Attacker-controlled binary and versionCommand values pass a self-consistency check and a limited metacharacter filter (tokenizeVersion...
CVE-2021-36260-hikvision
CVE-2021-36260 CVE-2021-36260는 일부 Hikvision 제품의 웹 서버에서 발생하는 POC 명령 주입 취약점입니다. 불충분한 입력 검증으로 인해, 공격자는 악성 명령이 포함된 일부 메시지를 전송하여 명령 주입 공격을 실행할 수 있습니다. Exploit 제목: Hikvision 웹 서버 빌드 210702 - 명령 주입 Exploit 작성자: bashis -- shubtheone이 오류 업데이트 공급업체 홈페이지: https://www.hikvision.com/ 버전: 1.0 CVE: CVE-2021-362...
CVE-2019-19781
본 글은 CVE-2019-19781에 등재된 Citrix ADC and Gateway Directory Traversal 원격코드 실행 RCE에 대한 글 입니다. 해당 원격코드 실행 취약점은 /vpn 경로 밑의 ../vpns에서 smb.conf 파일에 대한 검증이 적절하게 이루어지지 않아 발생한다. 시스템 구성정보나 서버 정보를 탈취 1. Citrix 1989년 설립된 미국의 다국적 소프트웨어 기업 서버, 애플리케이션 및 데스크톱 가상화, 네트워킹, SaaS, 클라우드 컴퓨팅 기술을 제공 취약한 Citrix 제품군에서 입력값...
CVE-2024-21534-poc
Vulnerability: CVE-2024-21534 Severity: Critical CVSS Score: 9.8 Description: The jsonpath-plus package versions = 10.0.7 is vulnerable to a Remote Code Execution RCE vulnerability that allows attackers to execute arbitrary code via Node.js's VM module. This vulnerability is caused by insufficien...
CVE-2026-18794 OpenRGB: insufficient input data checks lead to Denial-of-Service, memory overread and overwrite
The OpenRGB network protocol allows attackers to cause memory exhaustion and out-of-bounds memory reads and writes by passing inconsistent data...
CVE-2026-78237 Insufficient input validation in Admin By Request (ABR)
Insufficient input validation in ABR allows a low-privileged user to inject malicious entries into the sudoers file, resulting in persistent root access that remained effective after the ABR session ended...
CVE-2026-76314 Remote Code Execution (RCE) through Splunk Web Manager Configuration in Splunk Enterprise
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power" Splunk roles could perform Remote Code Execution RCE by submitting crafted Splunk Web Manager Configuration content. The user could then access all relevant data and affect syst...
CVE-2026-75616 Command Injection in Router Web Management Interface
An OS command injection vulnerability exists in the web management interface of Archer C20 v6 firmware when processing certain WAN-related configuration operations. An authenticated administrator may exploit insufficient input validation to execute arbitrary system commands, potentially resulting...
CVE-2026-20232
The web-based management interface of Cisco IE 1000 Series Switches fails to validate user-supplied input, enabling an authenticated attacker to inject malicious script into specific pages that executes in another user's session (stored XSS). CVSS 5.4 (MEDIUM) requires valid credentials and user ...
PT-2026-78741
Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Description A user without admin or power roles can achieve Remote Code...
PT-2026-78493
A vulnerability in the web-based management interface of Cisco Industrial Ethernet IE 1000 Series Switches could allow an authenticated, remote attacker to conduct a stored cross-site scripting XSS attack against a user of the interface. This vulnerability is due to insufficient validation of...
PT-2026-78522
A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an authenticated, local attacker to perform a blind SQL injection attack against an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker coul...
UBUNTU-CVE-2026-75006
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, insufficient Cascading Style Sheets CSS sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if stylesheet links point to local network hosts. This issue exists because of insufficient fixes for...
The vulnerability of the Jolokia component in Apache ActiveMQ allows a hacker to execute arbitrary code.
The vulnerability of the Jolokia component in Apache ActiveMQ is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...
The vulnerability in the driver/net/usb/catc.c component of the Linux operating system allows a hacker to cause a service failure.
The vulnerability of the drivers/net/usb/catc.c component in the Linux operating system is related to insufficient checking of the type of input data provided. Exploiting this vulnerability can allow an attacker to cause a service failure...
The vulnerability of the fs/minix/inode.c component in the Linux operating system allows a hacker to cause a service failure.
The vulnerability of the fs/minix/inode.c component in the Linux operating system is related to insufficient checking of the type of input data. Exploiting this vulnerability can allow an attacker to cause a service failure...
CVE-2026-70452
rsync 3.1.0 before 3.5.0 contains an access control bypass vulnerability that allows remote attackers to circumvent hosts deny rules by inducing DNS resolution failures during hostname-based access control evaluation. When a DNS lookup for a hostname-based deny rule fails, the daemon skips the ru...
openSUSE 16 Security Update : chromium (openSUSE-SU-2026:21561-1)
The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21561-1 advisory. Changes in chromium: - Chromium 151.0.7922.108 boo1274549: CVE-2026-19137: Use after free in WebGL CVE-2026-19149: Use after free in Aura...
