Backdoor.Win32.FTP.Ics Remote Command Execution

Discovery / credits: Malvuln - malvuln.com c 2022 Original source: https://malvuln.com/advisory/584bc06128469423f9e50e8a359d18acB.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.FTP.Ics Vulnerability: Unauthenticated Remote Command Execution Description: The...

Zyxel Nbg6816和Zyxel Nbg6817 操作系统命令注入漏洞

The Zyxel Nbg6816 and Zyxel Nbg6817 are both products of China's Hopkins Technology Zyxel.The Zyxel Nbg6816 is a dual-band wireless gigabit router.The Zyxel Nbg6817 is a wireless router. The Zyxel Nbg6816 and Zyxel Nbg6817 have an operating system command injection vulnerability that stems from...

Zfaka input validation error vulnerability

An input validation error vulnerability exists in Zfaka, a free, secure, stable and efficient card issuance system, which stems from the product's backend file upload function that does not validate files. An attacker could cause remote command execution through this vulnerability...

PT-2022-3855 · Totolink · Totolink A830R

Name of the Vulnerable Software and Affected Versions: TOTOLink A830R version V5.9c.4729 B20191112 Description: The issue is related to the lack of input data sanitization in the "Main" function of the TOTOLink A830R router's firmware. This allows a remote attacker to execute arbitrary commands...

PT-2022-3934 · Totolink · Totolink A950Rg

Name of the Vulnerable Software and Affected Versions: TOTOLink A950RG versions V4.1.2cu.5204 B20210112 through V5.9c.4050 B20190424 Description: The issue is related to the "Main" function of the TOTOLink A950RG router's firmware, which lacks input data sanitization. This allows a remote attacke...

PT-2022-3893 · Totolink · Totolink T6

Name of the Vulnerable Software and Affected Versions: TOTOLink T6 version V5.9c.4085 B20190428 Description: The issue is related to the lack of input data sanitization in the "Main" function of the TOTOLink T6 mesh system's firmware. This allows a remote attacker to execute arbitrary commands...

PT-2022-3858 · Totolink · Totolink T10

Name of the Vulnerable Software and Affected Versions: TOTOLink T10 version V5.9c.5061 B20200511 Description: The issue is related to the lack of input data sanitization in the "Main" function of the TOTOLink T10 mesh system. This allows a remote attacker to execute arbitrary commands through the...

CVE-2022-24553

An issue was found in Zfaka = 1.4.5. The verification of the background file upload function check is not strict, resulting in remote command execution...

CVE-2022-24553

An issue was found in Zfaka = 1.4.5. The verification of the background file upload function check is not strict, resulting in remote command execution...

CVE-2022-24553

An issue was found in Zfaka = 1.4.5. The verification of the background file upload function check is not strict, resulting in remote command execution...

Design/Logic Flaw

An issue was found in Zfaka = 1.4.5. The verification of the background file upload function check is not strict, resulting in remote command execution...

CVE-2022-24553

CVE-2022-24553 affects Zfaka

CVE-2022-24553

An issue was found in Zfaka = 1.4.5. The verification of the background file upload function check is not strict, resulting in remote command execution...

Zfaka 代码问题漏洞

An input validation error vulnerability exists in Zfaka, a free, secure, stable and efficient card issuance system, which stems from the product's backend file upload function that does not validate files. An attacker could cause remote command execution through this vulnerability...

CVE-2022-23650 Use of Hard-coded Cryptographic Key in Netmaker

Netmaker is a platform for creating and managing virtual overlay networks using WireGuard. Prior to versions 0.8.5, 0.9.4, and 010.0, there is a hard-coded cryptographic key in the code base which can be exploited to run admin commands on a remote server if the exploiter know the address and...

CVE-2021-46315

Remote Command Execution RCE vulnerability exists in HNAP1/control/SetWizardConfig.php in D-Link Router DIR-846 DIR846A1FW100A43.bin and DIR846enFW100A53DLA-Retail.bin. Malicoius users can use this vulnerability to use "\ " or backticks in the shell metacharacters in the ssid0 or ssid1 parameters...

CVE-2021-46315

CVE-2021-46315 is a remote code execution vulnerability affecting D-Link DIR-846 series routers (examples: DIR846A1_FW100A43.bin, DIR846enFW100A53DLA-Retail.bin) via HNAP1/control/SetWizardConfig.php. The flaw allows an attacker to inject shell metacharacters (e.g., , backticks) in ssid0/ssid1 pa...

CVE-2021-46315

Remote Command Execution RCE vulnerability exists in HNAP1/control/SetWizardConfig.php in D-Link Router DIR-846 DIR846A1FW100A43.bin and DIR846enFW100A53DLA-Retail.bin. Malicoius users can use this vulnerability to use "\ " or backticks in the shell metacharacters in the ssid0 or ssid1 parameters...

CVE-2021-46314

A Remote Command Execution RCE vulnerability exists in HNAP1/control/SetNetworkTomographySettings.php of D-Link Router DIR-846 DIR846A1FW100A43.bin and DIR846enFW100A53DLA-Retail.bin because backticks can be used for command injection when judging whether it is a reasonable domain name...

CVE-2021-46314

A Remote Command Execution RCE vulnerability exists in HNAP1/control/SetNetworkTomographySettings.php of D-Link Router DIR-846 DIR846A1FW100A43.bin and DIR846enFW100A53DLA-Retail.bin because backticks can be used for command injection when judging whether it is a reasonable domain name...