CVE-2023-26315

The Xiaomi router AX9000 has a post-authentication command injection vulnerability. This vulnerability is caused by the lack of input filtering, allowing an attacker to exploit it to obtain root access to the device...

CVE-2023-26315

The Xiaomi AX9000 router is affected by CVE-2023-26315. A post-authentication command injection vulnerability arises from insufficient input filtering, enabling an attacker with authenticated access to execute commands and potentially obtain root on the device. Reported impact includes high Confi...

CVE-2023-26315 Xiaomi router has a command injection vulnerability after authorization

The Xiaomi router AX9000 has a post-authentication command injection vulnerability. This vulnerability is caused by the lack of input filtering, allowing an attacker to exploit it to obtain root access to the device...

CVE-2023-26315 Xiaomi router has a command injection vulnerability after authorization

The Xiaomi router AX9000 has a post-authentication command injection vulnerability. This vulnerability is caused by the lack of input filtering, allowing an attacker to exploit it to obtain root access to the device...

PT-2024-12093 · Xiaomi · Xiaomi Router Ax9000

Name of the Vulnerable Software and Affected Versions: Xiaomi router AX9000 versions all Description: The issue is a post-authentication command injection vulnerability caused by the lack of input filtering, allowing an attacker to obtain root access to the device. Recommendations: Update to the...

Exploit for CVE-2024-48336

Introduction This is an exploit for a vulnerability CVE-2024-...

CVE-2024-7601 Logsign Unified SecOps Platform Directory data_export_delete_all Traversal Arbitrary File Deletion Vulnerability

Logsign Unified SecOps Platform Directory dataexportdeleteall Traversal Arbitrary File Deletion Vulnerability. This vulnerability allows remote attackers to delete arbitrary files on affected installations of Logsign Unified SecOps Platform. Authentication is required to exploit this vulnerabilit...

Improper Privilege Management

github.com/kanisterio/kanister is vulnerable to Improper Privilege Management. The vulnerability is due to the edit ClusterRole having overly permissive permissions, including create, patch, and update verbs for daemonset resources, create verb for serviceaccount/token resources. An attacker can...

PT-2024-29679 · Wi Fi Alliance +1 · Wfa Dut +2

Name of the Vulnerable Software and Affected Versions: Wi-Fi Alliance wfa dut in Wi-Fi Test Suite versions 9.0.0 and earlier Description: The issue allows OS command injection via 802.11x frames because the system library function is used. For example, on Arcadyan FMIMG51AX000J devices, this lead...

cups: Cupsd Listen arbitrary chmod 0140777

A flaw was found in the cupsd server. When starting the cupsd server with a Listen configuration item pointing to a symbolic link, the cupsd process can perform an arbitrary chmod of the provided argument, providing world-writable access to the target. Since cupsd is often running as root, this...

Exploit for Path Traversal in Synacor Zimbra_Collaboration_Suite

CVE-2022-27925 Description On May 10, 2022, Zimbra released...

PT-2024-30084 · Linksys · Linksys E1500

Name of the Vulnerable Software and Affected Versions: Linksys E1500 version 1.0.06.001 Description: A Command Injection vulnerability exists in the do upgrade post function of the httpd binary. As a result, an authenticated attacker can execute OS commands with root privileges. This could...

CVE-2024-42639

H3C GR1100-P v100R009 was discovered to use a hardcoded password in /etc/shadow, which allows attackers to log in as root...

CVE-2024-42638

H3C Magic B1ST v100R012 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root...

CVE-2024-42637

H3C R3010 v100R002L02 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root...

CVE-2024-42634

A Command Injection vulnerability exists in formWriteFacMac of the httpd binary in Tenda AC9 v15.03.06.42. As a result, attacker can execute OS commands with root privileges...

SUSE CVE-2024-7589

A signal handler in sshd8 may call a logging function that is not async-signal-safe. The signal handler is invoked when a client does not authenticate within the LoginGraceTime seconds 120 by default. This signal handler executes in the context of the sshd8's privileged code, which is not sandbox...

H3C Magic B1ST 安全漏洞

The H3C Magic B1ST is a series of wireless routers from China's Xinhua San H3C. A security vulnerability exists in the H3C Magic B1ST v100R012 version, which stems from a hard-coded password vulnerability in /etc/shadow that allows an attacker to log in as root...

CVE-2024-42639

H3C GR1100-P v100R009 was discovered to use a hardcoded password in /etc/shadow, which allows attackers to log in as root...

PT-2024-30087 · H3C · H3C R3010

Name of the Vulnerable Software and Affected Versions: H3C R3010 version v100R002L02 Description: A hardcoded password vulnerability was discovered in /etc/shadow, allowing attackers to log in as root. This issue affects the H3C R3010 device, potentially allowing unauthorized access...