PT-2024-30218 · Tenda · Tenda Fh1201

Name of the Vulnerable Software and Affected Versions: Tenda FH1201 version 1.2.0.14 Description: An issue in the handler function in "/goform/telnet" allows attackers to execute arbitrary commands via a crafted HTTP request. Recommendations: For Tenda FH1201 version 1.2.0.14, as a temporary...

The export function of the graphical user interface of the artificial intelligence-based security threat detection software FortiAIOps is vulnerable, allowing a perpetrator to execute arbitrary commands.

The vulnerability of the export function of the graphical user interface of the artificial intelligence-based security threat detection software FortiAIOps relates to the absence of a mechanism to neutralize elements in the CSV file. Exploiting this vulnerability allows an attacker operating...

Backdoor.Win32.Nightmare.25 MVID-2024-0687 Code Execution

Discovery / credits: Malvuln John Page aka hyp3rlinx c 2024 Original source: https://malvuln.com/advisory/0fe8f37543e8face08941899add38e35.txt Contact: [email protected] Media: x.com/malvuln Threat: Backdoor.Win32.Nightmare.25 Vulnerability: Unauthenticated Remote Command Execution Family:...

PT-2024-38516

Name of the Vulnerable Software and Affected Versions TeamT5 ThreatSonar Anti-Ransomware versions through 3.4.5 Description ThreatSonar Anti-Ransomware from TeamT5 does not properly validate the content of uploaded files. This allows remote attackers with administrator privileges on the product...

Malicious code in artifact-lab-3-package-34b21b63 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a814378a8188b464c5289007203c2b20c3ec2a0383ee18bd96e0f41ad44d7982 Packages showing simple variants of revshell with targets to ngrok. Most probably experiments. Later versions moved to use Burp Collaborator to exfiltrate simp...

PT-2024-41041 · Qtech · Qtech Gigabit Spf Wifi Gateway

Name of the Vulnerable Software and Affected Versions: Qtech Gigabit SPF WiFi Gateway affected versions not specified Description: The issue is related to inadequate access control in the Qtech Gigabit SPF WiFi Gateway's firmware, allowing a remote attacker to execute arbitrary commands on the...

CVE-2024-42366

VRCX is an assistant/companion application for VRChat. In versions prior to 2024.03.23, a CefSharp browser with over-permission and cross-site scripting via overlay notification can be combined to result in remote command execution. These vulnerabilities are patched in VRCX 2023.12.24. In additio...

CVE-2024-42366

Summary of CVE-2024-42366 (VR Overlay RCE) VRCX, a VRChat assistant/companion app, contained a vulnerability in versions prior to 2024.03.23 where a CefSharp browser with elevated privileges could be combined with an overlay notification to perform remote command execution (RCE). The issue is doc...

CVE-2024-42366 VR Overlay RCE

VRCX is an assistant/companion application for VRChat. In versions prior to 2024.03.23, a CefSharp browser with over-permission and cross-site scripting via overlay notification can be combined to result in remote command execution. These vulnerabilities are patched in VRCX 2023.12.24. In additio...

CVE-2024-42366 VR Overlay RCE

VRCX is an assistant/companion application for VRChat. In versions prior to 2024.03.23, a CefSharp browser with over-permission and cross-site scripting via overlay notification can be combined to result in remote command execution. These vulnerabilities are patched in VRCX 2023.12.24. In additio...

CVE-2024-42366 VR Overlay RCE

VRCX is an assistant/companion application for VRChat. In versions prior to 2024.03.23, a CefSharp browser with over-permission and cross-site scripting via overlay notification can be combined to result in remote command execution. These vulnerabilities are patched in VRCX 2023.12.24. In additio...

VRCX 安全漏洞

VRCX is a helper/companion application for VRChat from the VRCX team. A security vulnerability exists in versions of VRCX prior to 2024.03.23, which stems from the fact that the CefSharp browser with over-privileges and cross-site scripting via override notifications can be used in combination to...

The vulnerability in the web interface for controlling the Cisco AsyncOS operating system of the Cisco Secure Email Gateway allows a attacker to execute arbitrary system commands.

The vulnerability in the web interface of the Cisco AsyncOS operating system of the Cisco Secure Email Gateway lies in the improper elimination of special elements in the output data used by the incoming component. Exploiting this vulnerability allows a malicious actor to execute arbitrary system...

VulnCheck KEV: CVE-2023-52028

TOTOlink A3700R v9.1.2u.5822B20200513 was discovered to contain a remote command execution RCE vulnerability via the setTracerouteCfg function...

The vulnerability of the ssvpn_config_mod function in the /vpn/list_ip_network.php web interface of the Raisecom MSG1200, MSG2100E, MSG2200, and MSG2300 router integrated software allows a malicious actor to execute arbitrary commands.

The vulnerability of the ssvpnconfigmod function in the /vpn/listipnetwork.php web interface of the Raisecom MSG1200, MSG2100E, MSG2200, and MSG2300 router integrated software is related to the failure to eliminate special elements used in commands when processing parameters like template and...

The vulnerability of the ssvpn_config_mod function in the /vpn/list_service_manage.php web interface of the Raisecom MSG1200, MSG2100E, MSG2200, and MSG2300 integrated routing software allows a malicious actor to execute arbitrary commands.

The vulnerability of the ssvpnconfigmod function in the /vpn/listipnetwork.php web interface of the Raisecom MSG1200, MSG2100E, MSG2200, and MSG2300 router integrated software is related to the failure to eliminate special elements used in commands when processing parameters like template and...

The vulnerability of the `sslvpn_config_mod` function in the `/vpn/vpn_template_style.php` file of the web interface of the Raisecom MSG1200, MSG2100E, MSG2200, and MSG2300 software is exploited by attackers to execute arbitrary commands.

The vulnerability of the sslvpnconfigmod function in the /vpn/vpntemplatestyle.php web interface of the Raisecom MSG1200, MSG2100E, MSG2200, and MSG2300 routers is related to the failure to eliminate special elements used in commands when processing template and stylenum parameters. Exploiting th...

The vulnerability of the msp_info_htm() function in the msp_info.htm file of the D-Link DI-8100 router’s microprogramming software allows a hacker to execute arbitrary commands.

The vulnerability of the mspinfohtm function in the mspinfo.htm file of the D-Link DI-8100 router’s microprogramming system is related to the lack of data cleaning at the control level when processing the cmd parameter. Exploiting this vulnerability allows a remote attacker to execute arbitrary...

The vulnerability of the ssvpn_config_mod function in the /vpn/list_vpn_web_custom.php web interface of the Raisecom MSG1200, MSG2100E, MSG2200, and MSG2300 router integrated software allows a malicious actor to execute arbitrary commands.

The vulnerability of the ssvpnconfigmod function in the /vpn/listvpnwebcustom.php web interface of the Raisecom MSG1200, MSG2100E, MSG2200, and MSG2300 router integrated software is related to the failure to eliminate special elements used in the command when processing parameters template and...

The vulnerability of the setTelnetCfg function in the Telnet service of TOTOLINK CP900 microprogramming software allows a intruder to execute arbitrary commands.

The vulnerability of the setTelnetCfg function in the Telnet service of TOTOLINK CP900 router software lies in the lack of measures to sanitize input data during the processing of the telnetenabled parameter. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands by...