Mitel 6869i Arbitrary Command Execution

The vulnerability of the Microprogrammed Software for Mitel 6869i IP phones lies in the lack of measures taken to sanitize data at the administrative level when processing parameters like username and path on the upgrade.html page. Exploiting this vulnerability allows a malicious actor to execute...

CVE-2024-37570: Improper Neutralization of Special Elements used in a Command

On Mitel 6869i 4.5.0.41 devices, the Manual Firmware Update upgrade.html page does not perform sanitization on the username and path parameters sent by an authenticated user before appending flags to the busybox ftpget command. This leads to $ command execution...

CVE-2024-4405 Xiaomi Pro 13 mimarket manual-upgrade Cross-Site Scripting Remote Code Execution Vulnerability

Xiaomi Pro 13 mimarket manual-upgrade Cross-Site Scripting Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Xiaomi Pro 13 smartphones. User interaction is required to exploit this vulnerability in that the targe...

CVE-2024-4405

CVE-2024-4405 affects Xiaomi Pro 13 smartphones. The vulnerability is in the manual-upgrade.html flow, where parsing of the manualUpgradeInfo parameter does not properly sanitize input, allowing a cross-site scripting path to escalate to remote code execution. An attacker can exploit this by conv...

CVE-2024-4405: Improper Neutralization of Input During Web Page Generation

Xiaomi Pro 13 mimarket manual-upgrade Cross-Site Scripting Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Xiaomi Pro 13 smartphones. User interaction is required to exploit this vulnerability in that the targe...

CVE-2018-12635

CirCarLife Scada v4.2.4 allows unauthorized upgrades via requests to the html/upgrade.html and services/system/firmware.upgrade URIs...

PT-2018-11299

Name of the Vulnerable Software and Affected Versions CirCarLife Scada version 4.2.4 Description The issue allows unauthorized upgrades through specific requests. This can be achieved by sending requests to the "html/upgrade.html" and "services/system/firmware.upgrade" API endpoints...

CVE-2018-12635: Improper Input Validation

CirCarLife Scada v4.2.4 allows unauthorized upgrades via requests to the html/upgrade.html and services/system/firmware.upgrade URIs...

CVE-2018-12635

CirCarLife Scada v4.2.4 is affected by an unauthorized upgrade vulnerability, exploitable via requests to html/upgrade.html and services/system/firmware.upgrade URIs. The provided documents describe the issue as an ability to perform upgrades without authorization, but do not specify the underlyi...