23324 matches found
CVE-2024-48860: Improper Neutralization of Special Elements used in a Command
An OS command injection vulnerability has been reported to affect several product versions. If exploited, the vulnerability could allow remote attackers to execute commands. We have already fixed the vulnerability in the following version: QuRouter 2.4.3.103 and later...
D-LINK DI-8400 Remote Command Execution Vulnerability
The D-LINK DI-8400 is an American D-Link router device for home and small business network connectivity. Multiple remote command execution vulnerabilities exist in the mspinfohtm function in the D-LINK DI-8400 version v16.07.26A1 via the flag and cmd parameters. A remote attacker can exploit this...
NETGEAR R7000P Operation Mode Command Execution
The vulnerability in the operationmode.cgi script of NETGEAR R7000P router microprogramming software is related to buffer overflow during the processing of the devicename2 parameter. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...
NETGEAR R8500 Ether.cgi Command Execution
The vulnerability of the ether.cgi script in NETGEAR R8500 router microprogramming software relates to the failure to take measures to neutralize special elements used in the operating system’s processing of the wangateway parameter. Exploiting this vulnerability allows a remote attacker to execu...
NETGEAR XR300 wiz_dyn.cgi Command Execution
The vulnerability in the wizdyn.cgi script of NETGEAR XR300 router microprogramming software relates to the failure to take measures to neutralize special elements used in operating system commands when processing the parameter systemname. Exploiting this vulnerability allows a malicious actor to...
D-Link DI-8400 Router Arbitrary Command Execution
The vulnerability of the mspinfohtm function in D-Link DI-8400 router microprogramming software is related to the lack of measures taken to neutralize special elements used in commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands when processing the flag a...
CVE-2024-8525
An unrestricted upload of file with dangerous type in Automated Logic WebCTRL 7.0 could allow an unauthenticated user to perform remote command execution via a crafted HTTP POST request which could lead to uploading a malicious file...
CVE-2024-8525 Automated Logic WebCTRL and Carrier i-Vu Unrestricted File Upload
An unrestricted upload of file with dangerous type in Automated Logic WebCTRL 7.0 could allow an unauthenticated user to perform remote command execution via a crafted HTTP POST request which could lead to uploading a malicious file...
CVE-2024-8525 Automated Logic WebCTRL and Carrier i-Vu Unrestricted File Upload
An unrestricted upload of file with dangerous type in Automated Logic WebCTRL 7.0 could allow an unauthenticated user to perform remote command execution via a crafted HTTP POST request which could lead to uploading a malicious file...
CVE-2024-8525
CVE-2024-8525 affects Automated Logic WebCTRL 7.0 (Premium Server). The issue is an unrestricted upload of a file with a dangerous type that an unauthenticated attacker can exploit via a crafted HTTP POST to achieve remote command execution and upload of a malicious file. Multiple connected sourc...
CVE-2024-51151
D-Link DI-8200 16.07.26A1 is vulnerable to remote command execution in the mspinfohtm function via the flag parameter and cmd parameter...
CVE-2024-51151
D-Link DI-8200 16.07.26A1 is vulnerable to remote command execution in the mspinfohtm function via the flag parameter and cmd parameter...
PT-2024-39075 · Automated Logic · Automated Logic Webctrl
Name of the Vulnerable Software and Affected Versions: Automated Logic WebCTRL version 7.0 Description: The issue allows an unauthenticated user to perform remote command execution via a crafted HTTP POST request, which could lead to uploading a malicious file due to an unrestricted upload of fil...
PT-2024-32621 · Myscada · Myscada Mypro Manager
Name of the Vulnerable Software and Affected Versions: mySCADA myPRO Manager affected versions not specified Description: A parameter within a command does not properly validate input, which could be exploited by an unauthenticated remote attacker to inject arbitrary operating system commands. Th...
CVE-2024-51151: Improper Neutralization of Special Elements used in a Command
D-Link DI-8200 16.07.26A1 is vulnerable to remote command execution in the mspinfohtm function via the flag parameter and cmd parameter...
D-Link DI-8200 安全漏洞
The D-Link DI-8200 is an enterprise router from China-based AUO D-Link. The D-Link DI-8200 suffers from a command injection vulnerability that stems from a remote command execution vulnerability in the flag parameter and cmd parameter of the mspinfohtm function. No details of the vulnerability ar...
TOTOLINK EX200 安全漏洞
TOTOLINK EX200 is a 2.4G wireless N range extender from China's Gion Electronics TOTOLINK. A security vulnerability exists in the TOTOLINK EX200 ssd parameter handling, which can be exploited by remote attackers to submit a special request that can be used to execute arbitrary commands in the...
CVE-2024-8525: Unrestricted Upload of File with Dangerous Type
An unrestricted upload of file with dangerous type in Automated Logic WebCTRL 7.0 could allow an unauthenticated user to perform remote command execution via a crafted HTTP POST request which could lead to uploading a malicious file...
LLaMA-Factory 操作系统命令注入漏洞
LLaMA-Factory is a fine-tuned large-scale language model by a Chinese hoshi-hiyouga individual developer. A cross-site scripting vulnerability exists in LLaMA-Factory version 0.9.0 and earlier, which stems from improper handling of user input and allows malicious actors to execute arbitrary...