The vulnerability of the scanning function for web interface ports in the Roxy-WI server management solutions Haproxy, Nginx, Apache, and Keepalived allows a attacker to execute arbitrary commands with root privileges.

The vulnerability of the scanning function of the Roxy-WI web interface for Haproxy, Nginx, Apache, and Keepalived exists due to the lack of measures to neutralize specific elements. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands with root privileges by sendi...

The vulnerability of D-Link DIR-846W router’s microprogramming software lies in the lack of measures taken to neutralize special elements used in the operating system commands. This allows a hacker to execute arbitrary code.

The vulnerability of the D-Link DIR-846W router’s microprogramming software is related to the lack of measures taken to neutralize the special elements used in the operating system commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary code through a specially craft...

C-MOR Video Surveillance 5.2401 / 6.00PL01 Cross Site Scripting

Advisory ID: SYSS-2024-021 Product: C-MOR Video Surveillance Manufacturer: za-internet GmbH Affected Versions: 5.2401, 6.00PL01 Tested Versions: 5.2401, 6.00PL01 Vulnerability Type: Persistent Cross-Site Scripting CWE-79 Risk Level: High Solution Status: Open Manufacturer Notification: 2024-04-05...

The vulnerability of the D-Link DIR-846W router’s microprogramming software lies in the lack of measures taken to neutralize special elements used in the operating system commands. This allows a hacker to execute arbitrary code.

The vulnerability of the D-Link DIR-846W router’s microprogramming software is related to the lack of measures taken to neutralize the special elements used in the operating system commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary code through a specially craft...

The vulnerability of the fromAddressNat function in the Tenda FH1201 router microprogramming system allows a hacker to induce a service failure.

The vulnerability of the fromAddressNat function in the Tenda FH1201 router microprogramming system is related to the possibility of buffer overflow based on a stack. Exploiting this vulnerability can allow an attacker, operating remotely, to trigger a Denial-of-Service attack by sending a...

Oracle ISQLPlus SID Check

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Oracle iSQLPlus SID Check', 'Description' = %q This module attempts to bruteforce the SID on the Oracle application server iSQLPlus login pages. ...

SAP Internet Graphics Server (IGS) XMLCHART XXE

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'SAP Internet Graphics Server IGS XMLCHART XXE', 'Description' = %q This module exploits CVE-2018-2392 and CVE-2018-2393, two XXE vulnerabilities...

PT-2024-31409 · I-Educar · I-Educar

Name of the Vulnerable Software and Affected Versions: i-Educar versions prior to 2.9 Description: The issue allows an attacker with minimal viewing privileges in the settings section to change their user type to Administrator or another type with super-permissions. This can be achieved through a...

CVE-2024-44342

D-Link DIR-846W A1 FW100A43 was discovered to contain a remote command execution RCE vulnerability via the wl0.0ssid parameter. This vulnerability is exploited via a crafted POST request...

CVE-2024-44342

D-Link DIR-846W A1 FW100A43 was discovered to contain a remote command execution RCE vulnerability via the wl0.0ssid parameter. This vulnerability is exploited via a crafted POST request...

CVE-2024-44341

D-Link DIR-846W A1 FW100A43 was discovered to contain a remote command execution RCE vulnerability via the lan0dhcpsstaticlist parameter. This vulnerability is exploited via a crafted POST request...

PT-2024-5933 · D Link · D-Link Dir-846

Name of the Vulnerable Software and Affected Versions: D-Link DIR-846W A1 FW100A43 Description: The issue is a remote command execution vulnerability that can be exploited via a crafted POST request. It is related to the wl0.0 ssid parameter. This vulnerability allows a remote attacker to execute...

CVE-2024-44341

D-Link DIR-846W A1 FW100A43 was discovered to contain a remote command execution RCE vulnerability via the lan0dhcpsstaticlist parameter. This vulnerability is exploited via a crafted POST request...

CVE-2024-44342

D-Link DIR-846W A1 FW100A43 was discovered to contain a remote command execution RCE vulnerability via the wl0.0ssid parameter. This vulnerability is exploited via a crafted POST request...

CVE-2024-44342

CVE-2024-44342 affects D-Link DIR-846W A1 FW100A43 and is a remote command execution vulnerability exploitable via the wl(0).(0)_ssid parameter using a crafted POST request. The issue is documented across multiple feeds; several sources identify this as a high/critical risk with CVSS-derived impa...

CVE-2024-44341

D-Link DIR-846W A1 FW100A43 was discovered to contain a remote command execution RCE vulnerability via the lan0dhcpsstaticlist parameter. This vulnerability is exploited via a crafted POST request...

CVE-2024-34087

An SEH-based buffer overflow in the BPQ32 HTTP Server in BPQ32 6.0.24.1 allows remote attackers with access to the Web Terminal to achieve remote code execution via an HTTP POST /TermInput request...

CVE-2024-34087

This CVE affects BPQ32 6.0.24.1, identifying an SEH-based buffer overflow in the BPQ32 HTTP Server that enables remote code execution via an HTTP POST /TermInput request when an attacker has Web Terminal access. The Red Hat advisory confirms the vulnerability path and impact. Public sources (PT-S...

CVE-2024-34087

An SEH-based buffer overflow in the BPQ32 HTTP Server in BPQ32 6.0.24.1 allows remote attackers with access to the Web Terminal to achieve remote code execution via an HTTP POST /TermInput request...

CVE-2024-8134 D-Link DNS-1550-04 HTTP POST Request hd_config.cgi cgi_FMT_Std2R5_1st_DiskMGR command injection

A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814. It has been rated as critical. This issue...