jhttpd Subroutine Arbitrary Command Execution

The vulnerability of the sub433F7C function versionupgrade.asp in the jhttpd component of D-Link router modules DI-8100G, DI-8200G, and DI-8003G lies in the lack of measures to neutralize special elements used in operating systems when processing the path parameter. Exploiting this vulnerability...

D-Link DSL-7740C Router Command Execution

The vulnerability of the ping function in D-Link DSL-7740C router microprogramming software is related to the lack of measures taken to clean data at the control level. Exploiting this vulnerability can allow a remote attacker to execute arbitrary commands...

D-Link DSL7740C Backup Command Execution

The vulnerability of the backup function of the D-Link DSL7740C router’s microprogramming system is related to the lack of measures for cleaning incoming data. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

D-Link DSL7740C traceroute6 Command Execution

The vulnerability of the traceroute6 function in the microprogramming-based router D-Link DSL7740C is related to the lack of measures for cleaning incoming data. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

CVE-2023-49565

The cbismanager Podman container is vulnerable to remote command execution via the /api/plugins endpoint. Improper sanitization of the HTTP Headers X-FILENAME, X-PAGE, and X-FIELD allows for command injection. These headers are directly utilized within the subprocess.Popen Python function without...

📄 aaPanel 7.x.x Remote Command Execution

aaPanel version 7.x.x suffers from an authenticated remote command execution vulnerability. This was discovered prior and noted in CVE-2020-14421 where it states that it affects versions 6.6.6 and below. The developers claim it is patched but it still affects the 7.x.x version. This is...

Linksys E5600 runtime.ddnsStatus() Command Execution

The vulnerability of the runtime.ddnsStatus function in Linksys E5600 router microprogramming software is related to the lack of measures taken to neutralize special elements used in the operating system’s command for processing the password parameter. Exploiting this vulnerability allows a remot...

Linksys E5600 runtime.ddnsStatus() Command Execution

The vulnerability of the runtime.ddnsStatus function in Linksys E5600 router microprogramming software is related to the lack of measures taken to neutralize special elements used in the operating system’s command for processing the username parameter. Exploiting this vulnerability allows a remot...

Linksys E3000 Router Arbitrary Command Execution

The vulnerability of the diagpingstart function in Linksys E3000 router microprogramming software is related to the lack of measures taken to clean data at the control level. Exploiting this vulnerability can allow a remote attacker to execute arbitrary commands...

Linksys E5600 runtime.ddnsStatus() Command Execution

The vulnerability of the runtime.ddnsStatus function in Linksys E5600 router microprogramming software is related to the lack of measures taken to neutralize special elements used in the operating system’s processing of the hostname parameter. Exploiting this vulnerability allows a remote attacke...

Linksys WRT160Nv2 apply.cgi Command Execution

The vulnerability in the apply.cgi script of the Linksys WRT160Nv2 router microprogramming system is related to the improper elimination of certain elements used in the operating system’s command for processing the pingsize parameter. Exploiting this vulnerability allows an attacker to execute...

Linksys E5600 runtime.ddnsStatus() Command Execution

The vulnerability of the runtime.ddnsStatus function in Linksys E5600 router microprogramming software is related to the failure to eliminate special elements used in the operating system’s command for processing the mailex parameter. Exploiting this vulnerability allows a remote attacker to...

SilentSync RAT Delivered via Two Malicious PyPI Packages Targeting Python Developers

Cybersecurity researchers have discovered two new malicious packages in the Python Package Index PyPI repository that are designed to deliver a remote access trojan called SilentSync on Windows systems. "SilentSync is capable of remote command execution, file exfiltration, and screen capturing,"...

CVE-2023-49565

The cbismanager Podman container is vulnerable to remote command execution via the /api/plugins endpoint. Improper sanitization of the HTTP Headers X-FILENAME, X-PAGE, and X-FIELD allows for command injection. These headers are directly utilized within the subprocess.Popen Python function without...

CVE-2023-49565

The cbis_manager Podman container is vulnerable to remote command execution via the /api/plugins endpoint. The root cause is the improper sanitization of the X-FILENAME , X-PAGE , and X-FIELD HTTP headers, which are directly utilized within the subprocess.Popen Python function without adequate va...

CVE-2023-49565: Improper Neutralization of Special Elements used in a Command

The cbismanager Podman container is vulnerable to remote command execution via the /api/plugins endpoint. Improper sanitization of the HTTP Headers X-FILENAME, X-PAGE, and X-FIELD allows for command injection. These headers are directly utilized within the subprocess.Popen Python function without...

WAVLINK WL-WN578W2 Sub Function Arbitrary Command Execution

The vulnerability of the sub401340 function /cgi-bin/login.cgi of the WAVLINK WL-WN578W2 signal booster software is related to the failure to take measures to neutralize special elements during the processing of the ipaddr parameter. Exploiting this vulnerability allows a remote attacker to execu...

TOTOLINK A3300R Router Command Execution

The vulnerability of the setDmzCfg function in TOTOLINK A3300R router microprogramming software is related to the lack of measures taken to neutralize special elements used in the operating system’s commands when processing the ip parameter. Exploiting this vulnerability allows a remote attacker ...

TOTOLINK X6000R Sub Function Arbitrary Command Execution

The vulnerability of the sub417D74 function in the microprogrammed software of TOTOLINK X6000R routers is related to the lack of measures taken to clean data at the control level when processing the parameter filename. Exploiting this vulnerability allows a remote attacker to execute arbitrary...

TOTOLINK X6000R Sub 410118 Arbitrary Command Execution

The vulnerability of the sub410118 function in the microprogrammed operating system of TOTOLINK X6000R relates to the lack of measures taken to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...