EUVD-2025-12178

Malicious code in bioql PyPI...

CVE-2022-38451

A directory traversal vulnerability exists in the httpd update.cgi functionality of FreshTomato 2022.5. A specially crafted HTTP request can lead to arbitrary file read. An attacker can send an HTTP request to trigger this vulnerability...

CVE-2022-38451

A directory traversal vulnerability exists in the httpd update.cgi functionality of FreshTomato 2022.5. A specially crafted HTTP request can lead to arbitrary file read. An attacker can send an HTTP request to trigger this vulnerability...

Directory traversal

A directory traversal vulnerability exists in the httpd update.cgi functionality of FreshTomato 2022.5. A specially crafted HTTP request can lead to arbitrary file read. An attacker can send an HTTP request to trigger this vulnerability...

CVE-2022-38451

CVE-2022-38451 is a directory traversal vulnerability in FreshTomato 2022.5 (and related firmware derived from it, e.g., Siretta QUARTZ-GOLD). TALOS-2022-1642 documents a flaw in FreshTomato’s httpd update.cgi: the wo_update path builds /var/notice/ from an unsanitized exec/arg parameter, leading...

FreshTomato 路径遍历漏洞

FreshTomato is a Linux-based open source firmware from FreshTomato Open Source. The firmware provides a variety of features for Broadcom-based routers. A security vulnerability exists in FreshTomato version 2022.5, which stems from its httpd update.cgi function that allows an attacker to cause...

FreshTomato httpd update.cgi directory traversal vulnerability

Talos Vulnerability Report TALOS-2022-1642 FreshTomato httpd update.cgi directory traversal vulnerability January 26, 2023 CVE Number CVE-2022-38451 SUMMARY A directory traversal vulnerability exists in the httpd update.cgi functionality of FreshTomato 2022.5. A specially crafted HTTP request can...

Webmin Arbitrary Command Execution Vulnerability

Webmin is a set of Web-based system management tools for Unix-like operating systems. A security vulnerability exists in Webmin versions 1.910 and earlier. The vulnerability can be exploited to execute arbitrary commands with root privileges by sending the 'data' parameter to the update.cgi file...

CVE-2019-12840

In Webmin through 1.910, any user authorized to the "Package Updates" module can execute arbitrary commands with root privileges via the data parameter to update.cgi...

CVE-2018-20193

Certain Secure Access SA Series SSL VPN products originally developed by Juniper Networks but now sold and supported by Pulse Secure, LLC allow privilege escalation, as demonstrated by Secure Access SSL VPN SA-4000 5.1R5 build 9627 4.2 Release build 7631. This occurs because appropriate controls...