9810 matches found
Command injection
An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.13620121102. At 4 the dnsdata-dns1 variable, that has the value of the dns1 parameter provided through the SetLocal API, is not validated properly. This would lead to an OS command...
Command injection
An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.13620121102. At 6 the dnsdata-dns2 variable, that has the value of the dns2 parameter provided through the SetLocalLink API, is not validated properly. This would lead to an OS...
CVE-2021-40412
An OScommand injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.13620121102. At 8 the devname variable, that has the value of the name parameter provided through the SetDevName API, is not validated properly. This would lead to an OS command...
CVE-2021-40412
An OScommand injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.13620121102. At 8 the devname variable, that has the value of the name parameter provided through the SetDevName API, is not validated properly. This would lead to an OS command...
CVE-2021-40412
CVE-2021-40412 affects Reolink RLC-410W (firmware around v3.0.0.136_20121102). The root cause is lack of validation in the device network settings APIs (SetDevName, SetDdns, SetLocalLink) which format OS commands using user-controlled inputs (notably devname). This leads to OS command injection v...
CVE-2021-40410
An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.13620121102. At 4 the dnsdata-dns1 variable, that has the value of the dns1 parameter provided through the SetLocal API, is not validated properly. This would lead to an OS command...
CVE-2021-40411
An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.13620121102. At 6 the dnsdata-dns2 variable, that has the value of the dns2 parameter provided through the SetLocalLink API, is not validated properly. This would lead to an OS...
CVE-2021-40410
An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.13620121102. At 4 the dnsdata-dns1 variable, that has the value of the dns1 parameter provided through the SetLocal API, is not validated properly. This would lead to an OS command...
CVE-2021-40410
The connected TALOS report and Red Hat/CNNVD records confirm CVE-2021-40410 affects Reolink RLC-410W (v3.0.0.136_20121102) via multiple OS command injection vectors in device network settings APIs SetDdns, SetLocalLink, and SetDevName. Root cause: unvalidated user-supplied inputs (e.g., dns1, dns...
CVE-2021-40411
The CVE-2021-40411 issue affects Reolink RLC-410W devices (v3.0.0.136_20121102). The user-controlled input dns2 in the SetLocalLink API is not validated, allowing OS command injection when the system builds and executes a command via pip_system. The related SetDdns and SetLocalLink paths (and Set...
CVE-2021-40409
CVE-2021-40409 affects Reolink RLC-410W (v3.0.0.136_20121102). The vulnerability is OS command injection in the device network settings via several APIs (SetDdns, SetLocalLink, SetDevName). The root cause is improper validation of input fields (ddns.password, ddns.domain/username, dns1/dns2, devn...
CVE-2021-40409
An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.13620121102. At 1 or 2, based on DDNS type, the ddns-password variable, that has the value of the password parameter provided through the SetDdns API, is not validated properly. Th...
CVE-2021-40409
An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.13620121102. At 1 or 2, based on DDNS type, the ddns-password variable, that has the value of the password parameter provided through the SetDdns API, is not validated properly. Th...
CVE-2021-40408
CVE-2021-40408 covers multiple OS command injection flaws in Reolink RLC-410W (v3.0.0.136_20121102) via device network settings APIs SetDdns, SetLocalLink, and SetDevName. The root cause is insufficient validation of user-supplied fields (ddns->username, ddns->domain, dns1/dns2, devname) th...
CVE-2021-40408
An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.13620121102. At 1 or 2, based on DDNS type, the ddns-username variable, that has the value of the userName parameter provided through the SetDdns API, is not validated properly. Th...
CVE-2021-40408
An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.13620121102. At 1 or 2, based on DDNS type, the ddns-username variable, that has the value of the userName parameter provided through the SetDdns API, is not validated properly. Th...
CVE-2021-40407
CVE-2021-40407 affects Reolink RLC-410W IP Camera (v3.0.0.136_20121102). The vulnerability is an OS command injection in the device’s network settings via improper validation of the ddns->domain parameter in the SetDdns API, allowing an attacker to trigger commands through an HTTP request. Mul...
CVE-2020-28885
Liferay Portal Server tested on 7.3.5 GA6, 7.2.0 GA1 is affected by OS Command Injection. An administrator user can inject commands through the Gogo Shell module to execute any OS command on the Liferay Portal Sever. NOTE: The developer disputes this as a vulnerability since it is a feature for...
CVE-2020-28885
Liferay Portal Server tested on 7.3.5 GA6, 7.2.0 GA1 is affected by OS Command Injection. An administrator user can inject commands through the Gogo Shell module to execute any OS command on the Liferay Portal Sever. NOTE: The developer disputes this as a vulnerability since it is a feature for...
CVE-2020-28884
Liferay Portal Server tested on 7.3.5 GA6, 7.2.0 GA1 is affected by OS Command Injection. An administrator user can inject Groovy script to execute any OS command on the Liferay Portal Sever. NOTE: The developer disputes this as a vulnerability since it is a feature for administrators to run groo...