CVE-2023-39367

An OS command injection vulnerability exists in the web interface mac2name functionality of Peplink Smart Reader v1.2.0 in QEMU. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability...

Palo Alto OS Command Injection Vulnerability

Palo Alto OS was recently hit by a command injection zero day attack. These are exploitation details related to the zero day. CVE-2024-3400 CVE-2024-3400 Palo Alto OS Command Injection send this HTTP request: http POST /ssl-vpn/hipreport.esp HTTP/1.1 Host: 127.0.0.1 Cookie:...

CVE-2024-3880

A vulnerability has been found in Tenda W30E 1.0.1.25633 and classified as critical. This vulnerability affects the function formWriteFacMac of the file /goform/WriteFacMac. The manipulation of the argument mac leads to os command injection. The attack can be initiated remotely. The exploit has...

CVE-2024-3880

A vulnerability has been found in Tenda W30E 1.0.1.25633 and classified as critical. This vulnerability affects the function formWriteFacMac of the file /goform/WriteFacMac. The manipulation of the argument mac leads to os command injection. The attack can be initiated remotely. The exploit has...

CVE-2024-3880 Tenda W30E WriteFacMac formWriteFacMac os command injection

A vulnerability has been found in Tenda W30E 1.0.1.25633 and classified as critical. This vulnerability affects the function formWriteFacMac of the file /goform/WriteFacMac. The manipulation of the argument mac leads to os command injection. The attack can be initiated remotely. The exploit has...

CVE-2024-3880

The CVE-2024-3880 issue affects Tenda W30E devices, specifically the formWriteFacMac function in /goform/WriteFacMac. The vulnerability arises from improper handling of the mac parameter, enabling os command injection. It is a network(remote) vector with low privileges required and no user intera...

Exploit for OS Command Injection in Issabel Pbx

Issabel PBX 4.0.0 Remote Code Execution Authenticated - CVE-...

nginxWebUI OS Command Injection Vulnerability

nginxWebUI is an nginx web configuration tool. An operating system command injection vulnerability exists in nginxWebUI, which stems from the file parameter of the /adminPage/main/upload file failing to properly filter constructed command special characters, commands, and so on. An attacker can...

JVN#23835228: Proscend Communications M330-W and M330-W5 vulnerable to OS command injection

M330-W and M330-W5 provided by Proscend Communications Inc. are LTE Industrial Cellular Routers. M330-W and M330-W5 contain an OS command injection vulnerability CWE-78. Impact An arbitrary OS command may be executed by an attacker who has access to the product. Solution Update the firmware The...

CVE-2024-26023

CVE-2024-26023 affects BUFFALO wireless LAN routers. Affected component: BUFFALO WLR/WSR/WCR series firmware; vulnerability allows a logged-in user to execute arbitrary OS commands (OS command injection). Root cause and impact are described as command execution with local access; CVSS v3.1 base s...

CVE-2024-1655 ASUS WiFi Router - OS Command Injection

Certain ASUS WiFi routers models has an OS Command Injection vulnerability, allowing an authenticated remote attacker to execute arbitrary system commands by sending a specially crafted request...

JVN#58236836: Multiple vulnerabilities in BUFFALO wireless LAN routers

Multiple wireless LAN routers provided by BUFFALO INC. contain multiple vulnerabilities listed below. Plaintext storage of a password CWE-256 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Base Score 6.5 CVE-2024-23486 OS Command Injection CWE-78 CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Base...

PT-2024-21282 · Buffalo · Buffalo Wireless Lan Routers

Name of the Vulnerable Software and Affected Versions: BUFFALO wireless LAN routers affected versions not specified Description: The issue allows a logged-in user to execute arbitrary OS commands, which is an OS command injection vulnerability in BUFFALO wireless LAN routers. Recommendations: At...

CVE-2024-3739

A vulnerability classified as critical was found in cym1102 nginxWebUI up to 3.9.9. This vulnerability affects unknown code of the file /adminPage/main/upload. The manipulation of the argument file leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed...

CVE-2024-3739 cym1102 nginxWebUI upload os command injection

A vulnerability classified as critical was found in cym1102 nginxWebUI up to 3.9.9. This vulnerability affects unknown code of the file /adminPage/main/upload. The manipulation of the argument file leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed...

CVE-2024-3739 cym1102 nginxWebUI upload os command injection

A vulnerability classified as critical was found in cym1102 nginxWebUI up to 3.9.9. This vulnerability affects unknown code of the file /adminPage/main/upload. The manipulation of the argument file leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed...

CVE-2024-3721 TBK DVR-4104/DVR-4216 os command injection

A vulnerability was found in TBK DVR-4104 and DVR-4216 up to 20240412 and classified as critical. This issue affects some unknown processing of the file /device.rsp?opt=sys&cmd=SOSTREAMAX. The manipulation of the argument mdb/mdc leads to os command injection. The attack may be initiated remotely...

CVE-2024-3721 TBK DVR-4104/DVR-4216 os command injection

A vulnerability was found in TBK DVR-4104 and DVR-4216 up to 20240412 and classified as critical. This issue affects some unknown processing of the file /device.rsp?opt=sys&cmd=SOSTREAMAX. The manipulation of the argument mdb/mdc leads to os command injection. The attack may be initiated remotely...

CVE-2024-3721

CVE-2024-3721 is an OS command injection affecting TBK DVR-4104 and DVR-4216 (firmware up to 20240412). The flaw stems from unsanitized parameters mdb/mdc in HTTP requests to /device.rsp?opt=sys&cmd=S_O_S_T_R_E_A_MAX . Successful exploitation allows unauthenticated remote command execution and ha...

OS Command Injection

yt-dlp is vulnerable to OS Command Injection. This vulnerability is due to insufficient escaping of special characters, specifically in the expansion of output templates within the --exec option...