Tenda i22 安全漏洞

The Tenda i22 is a dual-band ceiling-mounted wireless access point from Tenda. Tenda i22 /goform/apPortalPhoneAuth Handling formApPortalPhoneAuth A stack overflow vulnerability exists that can be exploited by a remote attacker to submit a special request that can crash the application or can be...

PT-2024-26035 · Librtp.So · Librtp.So

Name of the Vulnerable Software and Affected Versions: librtp.so versions prior to SMR Aug-2024 Release 1 Description: The issue is related to improper input validation, allowing remote attackers to execute arbitrary code with system privilege. User interaction is required to trigger this issue...

The vulnerability of the OLE DB driver for SQL Server, related to insufficient validation of input data, allows a hacker to execute arbitrary code.

The vulnerability of the OLE DB driver for SQL Server is related to buffer overflow in the “heap”. Exploiting this vulnerability can allow a malicious actor to execute arbitrary code remotely...

SUSE CVE-1999-0067

phf CGI program allows remote command execution through shell metacharacters...

SUSE CVE-1999-0439

Buffer overflow in procmail before version 3.12 allows remote or local attackers to execute commands via expansions in the procmailrc configuration file...

CVE-2024-6782 Calibre Remote Code Execution

Improper access control in Calibre 6.9.0 7.14.0 allow unauthenticated attackers to achieve remote code execution...

ROS-20240806-06

Vulnerability of ruby-find-library-file function of EMACS text editor is related to incorrect neutralization of special elements. neutralization of special elements. Exploitation of the vulnerability could allow an attacker to execute arbitrary code Vulnerability in the lib-src/etags.c file of th...

ROS-20240806-21

Vulnerability of JDBC driver pgjdbc for connecting Java programs to PostgreSQL database is related to Lack of verification of the class implementation of the expected interface. Exploitation of the vulnerability could allow an attacker acting remotely to execute arbitrary code through the...

PT-2024-6460 · D Link · D-Link Di 8004W

Name of the Vulnerable Software and Affected Versions: D-Link DI 8004W version 16.07.26A1 Description: The issue is related to a command execution vulnerability in the msp info htm function of the jhttpd module. This vulnerability may allow a remote attacker to execute arbitrary commands. The...

CVE-2024-34344

Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. Due to the insufficient validation of the path parameter in the NuxtTestComponentWrapper, an attacker can execute arbitrary JavaScript on the server side, which allows them to execute arbitrar...

Pimax Play and PiTool accept WebSocket connections from unintended endpoints

Overview Pimax Play and PiTool provided by Pimax accept WebSocket connections from unintended endpoints CWE-923. Rei Yano reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact Arbitrary code may be executed by a...

Ivanti Virtual Traffic Manager Authentication Bypass (CVE-2024-7593)

This module exploits an access control issue in Ivanti Virtual Traffic Manager vTM, by adding a new administrative user to the web interface of the application. Affected versions include 22.7R1, 22.6R1, 22.5R1, 22.3R2, 22.3, 22.2. Module Options msf use auxiliary/admin/http/ivanti/vtmadmin msf...

PT-2024-5396 · Raisecom · Raisecom Msg2200 +3

Name of the Vulnerable Software and Affected Versions: Raisecom MSG1200, MSG2100E, MSG2200 and MSG2300 version 3.90 Description: The issue is related to the function sslvpn config mod of the file /vpn/list vpn web custom.php in the web interface of the affected devices. It is caused by the failur...

CVE-2024-36268

Improper Control of Generation of Code 'Code Injection' vulnerability in Apache InLong. This issue affects Apache InLong: from 1.10.0 through 1.12.0, which could lead to Remote Code Execution. Users are advised to upgrade to Apache InLong's 1.13.0 or cherry-pick 1 to solve it. 1 ...

PT-2024-6567 · Aruba · Arubaos

Name of the Vulnerable Software and Affected Versions: ArubaOS affected versions not specified Description: An authenticated command injection issue exists in the ArubaOS command line interface, allowing successful exploitation to result in the ability to inject shell commands on the underlying...

CVE-2024-38882

CVE-2024-38882 affects Horizon Business Services Inc. Caterease versions 16.0.1.1663–24.0.1.2405 (and possibly later). The issue is a remote command execution via SQL Injection caused by improper neutralization of special elements used in an OS command. Impact is high (remote, with high confident...

PT-2024-28258 · Horizon Business Services Inc. · Caterease

Name of the Vulnerable Software and Affected Versions: Horizon Business Services Inc. Caterease versions 16.0.1.1663 through 24.0.1.2405 Description: The issue allows a remote attacker to expand control over the operating system from the database due to the execution of commands with unnecessary...

CVE-2024-41630

This CVE affects Tenda AC18 devices (V15.03.3.10_EN). The vulnerability is a stack-based buffer overflow in the ssid parameter handled by the ip/goform/fast_setting_wifi_set endpoint, enabling a remote attacker to execute arbitrary code. The issue is network‑level with low user interaction requir...

ROS-20240731-05

A vulnerability in the SHA-3 cryptographic hash function of the eXtended Keccak Code Package XKCP software package is related to errors in block processing of input data and type conversion. Exploitation of the vulnerability could allow an attacker acting remotely to execute arbitrary code during...

ROS-20240730-04

A vulnerability in the document processing, conversion and generation software suite Ghostscript is related to the introduction of a specially crafted pipe command. Exploitation of the vulnerability could Allow an attacker acting remotely to execute arbitrary code...