PT-2024-24529 · Totolink · Totolink X5000R

Name of the Vulnerable Software and Affected Versions: TOTOLINK X5000R version 9.1.0cu.2350 B20230313 Description: The issue is related to an authenticated remote command execution via the ipsecL2tpEnable parameter in the "cstecgi.cgi" binary. Recommendations: For TOTOLINK X5000R version...

CVE-2024-32352: Improper Control of Generation of Code

TOTOLINK X5000R V9.1.0cu.2350B20230313 was discovered to contain an authenticated remote command execution RCE vulnerability via the "ipsecL2tpEnable" parameter in the "cstecgi.cgi" binary...

CVE-2024-32350: Improper Control of Generation of Code

TOTOLINK X5000R V9.1.0cu.2350B20230313 was discovered to contain an authenticated remote command execution RCE vulnerability via the "ipsecPsk" parameter in the "cstecgi.cgi" binary...

CVE-2024-32349: Improper Neutralization of Special Elements used in a Command

TOTOLINK X5000R V9.1.0cu.2350B20230313 was discovered to contain an authenticated remote command execution RCE vulnerability via the "mtu" parameters in the "cstecgi.cgi" binary...

Tenda O3 安全漏洞

Tenda O3 is an outdoor wireless bridge from Tenda China. A security vulnerability exists in Tenda O3 V1.0.0.12 and earlier versions, which stems from a command injection vulnerability that allows remote attackers to execute operating system commands via the dest parameter in /goform/getTraceroute...

PT-2024-24525 · Totolink · Totolink X5000R

Name of the Vulnerable Software and Affected Versions: TOTOLINK X5000R version 9.1.0cu.2350 B20230313 Description: The issue is related to an authenticated remote command execution via the mtu parameters in the "cstecgi.cgi" binary. Recommendations: For version 9.1.0cu.2350 B20230313, consider...

Werkzeug's improper usage of a pathname and improper CSRF protection results in the remote command execution

...

PT-2024-32996 · Ruijie · Ruijie Rg-Uac

Name of the Vulnerable Software and Affected Versions: Ruijie RG-UAC versions prior to 20240507 Description: A critical vulnerability exists in Ruijie RG-UAC. The manipulation of the name argument in an unknown function of the file /view/networkConfig/physicalInterface/interface commit.php leads ...

PT-2024-4649 · Moodle +2 · Moodle +2

Name of the Vulnerable Software and Affected Versions: Moodle affected versions not specified Description: The issue is related to insufficient input validation, which could allow a remote attacker to execute arbitrary commands. It also involves incorrect validation of allowed event types in a...

pcp security, bug fix, and enhancement update

An update is available for pcp. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Performance Co-Pilot PCP is a suite of tools, services, and libraries for...

RLSA-2024:2566 Important: pcp security, bug fix, and enhancement update

Performance Co-Pilot PCP is a suite of tools, services, and libraries for acquisition, archiving, and analysis of system-level performance measurements. Its light-weight distributed architecture makes it particularly well-suited to centralized analysis of complex systems. Security Fixes: pcp:...

PT-2024-3691 · Totolink · Totolink Cp450

Name of the Vulnerable Software and Affected Versions: TOTOLINK CP450 versions 4.1.0cu.747 B20191224 Description: The issue is related to the NTPSyncWithHost function of the Request Handler component in the TOTOLINK CP450 router's firmware, which fails to properly sanitize data at the management...

Oracle Linux 9 : pcp (ELSA-2024-2566)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-2566 advisory. 6.2.0-2.0.1 - Fixed libpcp derived metric issue for ol9 Orabug: 36538820 6.2.0-2 - Disable RESP proxying by default in pmproxy RHEL-30719 Tenable has extracted...

Sonic Technology Shopfloor.guide 安全漏洞

Sonic Technology Shopfloor.guide is an application from Sonic Technology, Inc. A security vulnerability exists in Sonic Technology Shopfloor.guide versions prior to 3.1.3. A remote attacker can exploit this vulnerability to execute arbitrary SQL commands via the level2 parameter...

TOTOLINK EX1800T 安全漏洞

TOTOLINK EX1800T is a Wi-Fi range extender from China Gion Electronics TOTOLINK. A security vulnerability exists in TOTOLINK EX1800T version V9.1.0cu.2112B20220316, which stems from a security issue in the apcliEncrypType parameter that allows unauthorized execution of arbitrary commands, which...

SUSE: Security Advisory (SUSE-SU-2024:1417-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

The vulnerability of the user interface of the LoadMaster platform for deploying and managing applications allows a perpetrator to execute arbitrary commands.

The vulnerability of the user interface of the LoadMaster platform for application deployment and management exists due to the lack of measures taken to neutralize special elements used in the operating system command line. Exploiting this vulnerability allows a remote attacker to execute arbitra...

CVE-2024-34069 Werkzeug's improper usage of a pathname and improper CSRF protection results in the remote command execution

Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, an...

The vulnerability of the QTS, QuTS Hero, QuTScloud, and myQNAPcloud operating systems exists due to the lack of measures taken to neutralize the special elements used in the operating system’s command set. This allows attackers to execute arbitrary commands.

The vulnerability of the QTS, QuTS Hero, QuTScloud, and myQNAPcloud operating systems exists due to the lack of measures taken to neutralize the special elements used in the operating system commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

CVE-2024-4505

CVE-2024-4505 concerns Ruijie RG-UAC (up to 20240428). The issue is an OS command injection in the PHP file /view/IPV6/ipv6Addr/ip_addr_add_commit.php, triggered by manipulating the arguments prelen/ethname. It is exploitable remotely and has been publicly disclosed. Multiple sources (NVD, Red Ha...