15537 matches found
Exploit for Unrestricted Upload of File with Dangerous Type in Git
CVE-2024-32002 Versions 1.0.0https://github.com/grec...
The vulnerability of the SetVLANSettings() function in the prog.cgi script of D-Link DIR-878 and DIR-882 routers allows a hacker to execute arbitrary commands.
The vulnerability of the SetVLANSettings function in the prog.cgi script of D-Link DIR-878 and DIR-882 routers exists due to the failure to take measures to neutralize special elements used in operating system commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary...
The vulnerability of the SetPortForwardingSettings() function in the prog.cgi script of D-Link DIR-878 and DIR-882 router microprogramming software allows a hacker to execute arbitrary commands.
The vulnerability of the SetPortForwardingSettings function in the prog.cgi script of D-Link DIR-878 and DIR-882 routers exists because measures to neutralize special elements used in operating system commands are not taken. Exploiting this vulnerability allows a malicious actor to execute...
The vulnerability of the SetVLANSettings() function in the prog.cgi script of D-Link DIR-878 and DIR-882 routers allows a hacker to execute arbitrary commands.
The vulnerability of the SetVLANSettings function in the prog.cgi script of D-Link DIR-878 and DIR-882 routers exists due to the failure to take measures to neutralize special elements used in operating system commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary...
PT-2024-8828 · Draytek · Draytek Vigor3900
Name of the Vulnerable Software and Affected Versions: DrayTek Vigor 3900 version 1.5.1.3 Description: The issue exists due to the lack of neutralization of special elements used in the operating system command by the doPPPo function in the mainfunction.cgi script of the DrayTek Vigor 3900 router...
D-Link DIR-878 and D-Link DIR-882 Command Injection Vulnerability (CNVD-2024-41694)
The D-Link DIR-878 is a wireless router.The D-Link DIR-882 is a dual-band wireless router. A command injection vulnerability exists in the D-Link DIR-878 and D-Link DIR-882, which can be exploited by an attacker to execute arbitrary operating system commands via a constructed POST request...
CVE-2024-10119
The wireless router WRTM326 from SECOM does not properly validate a specific parameter. An unauthenticated remote attacker could execute arbitrary system commands by sending crafted requests...
PT-2024-16041 · Secom · Wrtm326
Name of the Vulnerable Software and Affected Versions: SECOM WRTM326 wireless router affected versions not specified Description: The wireless router WRTM326 from SECOM does not properly validate a specific parameter. An unauthenticated remote attacker could execute arbitrary system commands by...
CVE-2023-32193
A vulnerability has been identified in which unauthenticated cross-site scripting XSS in Norman's public API endpoint can be exploited. This can lead to an attacker exploiting the vulnerability to trigger JavaScript code and execute commands remotely...
Security update for etcd
This update for etcd fixes the following issues: Update to version 3.5.12: Security fixes: CVE-2018-16873: Fixed remote command execution in cmd/go bsc1118897 CVE-2018-16874: Fixed directory traversal in cmd/go bsc1118898 CVE-2018-16875: Fixed CPU denial of service in crypto/x509 bsc1118899...
The vulnerability of the Telnet service of D-Link’s wireless routers, such as DIR-X4860, DIR-X5460A1, and COVR-X1870, allows a hacker to execute arbitrary commands in the basic operating system.
The vulnerability of D-Link DIR-X4860, DIR-X5460A1, and COVR-X1870 wireless routers lies in the presence of undocumented configuration commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands on the operating system using hard-coded credentials...
The vulnerability of the virtual keyboard of the VisionOS operating system, which allows a hacker to escalate their privileges and execute arbitrary commands
The vulnerability of the virtual keyboard in the VisionOS operating system is related to the improper assignment of permissions for a critical resource. Exploiting this vulnerability allows an attacker to enhance their privileges and execute arbitrary commands remotely...
changedetection.io has a Server Side Template Injection using Jinja2 which allows Remote Command Execution
Summary A Server Side Template Injection in changedetection.io caused by usage of unsafe functions of Jinja2 allows Remote Command Execution on the server host. Details changedetection.io version: 0.45.20 docker images REPOSITORY TAG IMAGE ID CREATED SIZE dgtlmoon/changedetection.io latest...
GHSA-4R7V-WHPG-8RX3 changedetection.io has a Server Side Template Injection using Jinja2 which allows Remote Command Execution
Summary A Server Side Template Injection in changedetection.io caused by usage of unsafe functions of Jinja2 allows Remote Command Execution on the server host. Details changedetection.io version: 0.45.20 docker images REPOSITORY TAG IMAGE ID CREATED SIZE dgtlmoon/changedetection.io latest...
ABB Cylon Aspect 3.08.00 sslCertAjax.php Remote Command Execution Vulnerability
ABB Cylon Aspect version 3.08.00 suffers from an authenticated OS command injection vulnerability. This can be exploited to inject and execute arbitrary shell commands through the country, state, locality, organization, and hostname HTTP POST parameters called by the sslCertAjax.php script. ABB...
VulnCheck KEV: CVE-2014-4663
TimThumb 2.8.13 and WordThumb 1.07, when Webshot aka Webshots is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in the src parameter...
CVE-2024-45731 Potential Remote Command Execution (RCE) through arbitrary file write to Windows system root directory when Splunk Enterprise for Windows is installed on a separate disk
In Splunk Enterprise for Windows versions below 9.3.1, 9.2.3, and 9.1.6, a low-privileged user that does not hold the "admin" or "power" Splunk roles could write a file to the Windows system root directory, which has a default location in the Windows System32 folder, when Splunk Enterprise for...
CVE-2024-45731 Potential Remote Command Execution (RCE) through arbitrary file write to Windows system root directory when Splunk Enterprise for Windows is installed on a separate disk
In Splunk Enterprise for Windows versions below 9.3.1, 9.2.3, and 9.1.6, a low-privileged user that does not hold the "admin" or "power" Splunk roles could write a file to the Windows system root directory, which has a default location in the Windows System32 folder, when Splunk Enterprise for...
pickle deserialization vulnerability
Description There is a pickle deserialization vulnerability in the Latex English error correction plug-in function of gptacademic, which allows attackers to achieve remote command execution Environment setup 1. wget https://github.com/binary-husky/gptacademic/archive/refs/tags/version3.83.zip 2...