CVE-2018-13354: Improper Neutralization of Special Elements used in an OS Command

System command injection in logtable.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands via the "Event" parameter...

CVE-2018-13307: Improper Neutralization of Special Elements used in an OS Command

System command injection in fromNtp in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the "ntpServerIp2" POST parameter. Certain payloads cause the device to become permanently inoperable...

CVE-2018-16130: Improper Neutralization of Special Elements used in an OS Command

System command injection in requestmitv in Xiaomi Mi Router 3 version 2.22.15 allows attackers to execute arbitrary system commands via the "payload" URL parameter...

PT-2018-11729

Name of the Vulnerable Software and Affected Versions TOTOLINK A3002RU version 1.0.8 Description The issue concerns system command injection in the formDlna of TOTOLINK A3002RU, allowing attackers to execute system commands. This is achieved via the ftpUser POST parameter. Recommendations For...

CVE-2018-13316: Improper Neutralization of Special Elements used in an OS Command

System command injection in formAliasIp in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the "subnet" POST parameter...

CVE-2018-13336: Improper Neutralization of Special Elements used in an OS Command

System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands via the "pwd" parameter during user creation...

CVE-2018-13353: Improper Neutralization of Special Elements used in an OS Command

System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute commands via the "checkport" parameter...

CVE-2018-13338: Improper Neutralization of Special Elements used in an OS Command

System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands via the "username" parameter during user creation...

CVE-2018-13023: Improper Neutralization of Special Elements used in an OS Command

System command injection vulnerability in wifiaccess in Xiaomi Mi Router 3 version 2.22.15 allows attackers to execute system commands via the "timeout" URL parameter...

CVE-2018-13358: Improper Neutralization of Special Elements used in an OS Command

System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands via the "checkName" parameter...

PT-2018-12783

Name of the Vulnerable Software and Affected Versions ZyXEL NSA325 V2 version 4.81 Description A system command injection issue allows attackers to execute system commands via the web application API. Recommendations For ZyXEL NSA325 V2 version 4.81, at the moment, there is no information about a...

CVE-2018-13306: Improper Neutralization of Special Elements used in an OS Command

System command injection in formDlna in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the "ftpUser" POST parameter...

CVE-2018-13418: Improper Neutralization of Special Elements used in an OS Command

System command injection in ajaxdata.php in TerraMaster TOS 3.1.03 allows attackers to execute system commands via the "newname" parameter...

CVE-2018-13330: Improper Neutralization of Special Elements used in an OS Command

System command injection in ajaxdata.php in TerraMaster TOS version 3.1.03 allows attackers to execute system commands during group creation via the "groupname" parameter...

CVE-2018-13314: Improper Neutralization of Special Elements used in an OS Command

System command injection in formAliasIp in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the "ipAddr" POST parameter...

CVE-2018-13318

System command injection in User.create method in Buffalo TS5600D1206 version 3.61-0.10 allows attackers to execute system commands via the "name" parameter...

CVE-2018-13320

System Command Injection in network.setauthsettings in Buffalo TS5600D1206 version 3.70-0.10 allows attackers to execute system commands via the adminUsername and adminPassword parameters...

CVE-2018-13311

System command injection in formDlna in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the "sambaUser" POST parameter...

CVE-2018-13318

System command injection in User.create method in Buffalo TS5600D1206 version 3.61-0.10 allows attackers to execute system commands via the "name" parameter...

CVE-2018-13311

System command injection in formDlna in TOTOLINK A3002RU version 1.0.8 allows attackers to execute system commands via the "sambaUser" POST parameter...