16 matches found
EUVD-2021-30575
Malicious code in bioql PyPI...
EUVD-2021-30573
Malicious code in bioql PyPI...
EUVD-2021-30576
Malicious code in bioql PyPI...
Command injection
TOTOLINK EX300V2 V4.0.3c.7484 was discovered to contain a command injection vulnerability via the langType parameter in the setLanguageCfg function. This vulnerability is exploitable via a crafted MQTT data packet...
CVE-2022-32449
CVE-2022-32449 affects TOTOLINK EX300_V2 (V4.0.3c.7484). The vulnerability is a command-injection in the setLanguageCfg function via the langType parameter, exploitable via a crafted MQTT data packet. Impact is high (C, I, A) with network access and no authentication required per listed CVSS 3.1 ...
CVE-2022-32449
TOTOLINK EX300V2 V4.0.3c.7484 was discovered to contain a command injection vulnerability via the langType parameter in the setLanguageCfg function. This vulnerability is exploitable via a crafted MQTT data packet...
CVE-2021-43663
totolink EX300v2 V4.0.3c.140B20210429 was discovered to contain a command injection vulnerability via the component cloudupdatecheck...
CVE-2021-43661
totolink EX300v2 V4.0.3c.140B20210429 was discovered to contain a reflected cross-site scripting XSS vulnerability via the component /home.asp...
CVE-2021-43662
totolink EX300v2, ver V4.0.3c.140B20210429 and A720R ,ver V4.1.5cu.470B20200911 have an issue which causes uncontrolled resource consumption...
Input validation
totolink EX300v2, ver V4.0.3c.140B20210429 and A720R ,ver V4.1.5cu.470B20200911 have an issue which causes uncontrolled resource consumption...
Command injection
totolink EX300v2 V4.0.3c.140B20210429 was discovered to contain a command injection vulnerability via the component cloudupdatecheck...
Cross site scripting
totolink EX300v2 V4.0.3c.140B20210429 was discovered to contain a reflected cross-site scripting XSS vulnerability via the component /home.asp...
CVE-2021-43663
The CVE-2021-43663 entry concerns TotoLink EX300_v2, version 4.0.3c.140_B20210429, with a command-injection flaw in the cloudupdate_check component. Public CNVD/CNNVD entries describe an unauthenticated remote code-execution risk that can be exploited via a MITM attack, potentially allowing the a...
CVE-2021-43663
totolink EX300v2 V4.0.3c.140B20210429 was discovered to contain a command injection vulnerability via the component cloudupdatecheck...