5592 matches found
CVE-2024-43804 OS Command Injection via Port Scan Functionality in Roxy-WI
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. An OS Command Injection vulnerability allows any authenticated user on the application to execute arbitrary code on the web application server via port scanning functionality. User-supplied input is used withou...
CVE-2024-43804 OS Command Injection via Port Scan Functionality in Roxy-WI
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. An OS Command Injection vulnerability allows any authenticated user on the application to execute arbitrary code on the web application server via port scanning functionality. User-supplied input is used withou...
CVE-2024-43804
Roxy-WI suffers an OS Command Injection via its port-scanning feature. Authenticated users can influence the ip value, which is used to build cmd/cmd1, then passed to server_mod.subprocess_execute with shell=True, enabling arbitrary code execution on the web application server. Multiple sources d...
CVE-2024-43804 OS Command Injection via Port Scan Functionality in Roxy-WI
Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. An OS Command Injection vulnerability allows any authenticated user on the application to execute arbitrary code on the web application server via port scanning functionality. User-supplied input is used withou...
PT-2024-5939 · Roxy-Wi · Roxy-Wi
Name of the Vulnerable Software and Affected Versions: Roxy-WI affected versions not specified Description: The issue is related to an OS Command Injection vulnerability in the Roxy-WI web interface for managing servers. This vulnerability allows any authenticated user to execute arbitrary code o...
Roxy-WI 安全漏洞
Roxy-WI is a Roxy-WI open source web interface for managing Haproxy, Nginx and Keepalived servers. A security vulnerability exists in Roxy-WI version v8.0 that stems from the presence of an operating system command injection vulnerability that allows any authenticated user on the application to...
Qualcomm Wi-Fi SON LDB Service Improper Input Validation Remote Code Execution Vulnerability
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of multiple Qualcomm chipsets. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Qualcomm LDB service. The issue results from the lack of proper...
CVE-2024-7408
This vulnerability exists in Airveda Air Quality Monitor PM2.5 PM10 due to transmission of sensitive information in plain text during AP pairing mode. An attacker in close proximity could exploit this vulnerability by capturing Wi-Fi traffic of Airveda-AP. Successful exploitation of this...
Researchers Uncover 10 Flaws in Google's File Transfer Tool Quick Share
As many as 10 security flaws have been uncovered in Google's Quick Share data transfer utility for Android and Windows that could be assembled to trigger remote code execution RCE chain on systems that have the software installed. "The Quick Share application implements its own specific...
Sonos Speaker Flaws Could Have Let Remote Hackers Eavesdrop on Users
Cybersecurity researchers have uncovered weaknesses in Sonos smart speakers that could be exploited by malicious actors to clandestinely eavesdrop on users. The vulnerabilities "led to an entire break in the security of Sonos's secure boot process across a wide range of devices and remotely being...
CVE-2024-7408 Information Disclosure Vulnerability in Airveda Air Quality Monitor
This vulnerability exists in Airveda Air Quality Monitor PM2.5 PM10 due to transmission of sensitive information in plain text during AP pairing mode. An attacker in close proximity could exploit this vulnerability by capturing Wi-Fi traffic of Airveda-AP. Successful exploitation of this...
CVE-2024-7408
CVE-2024-7408 affects Airveda Air Quality Monitor PM2.5/PM10. The issue is information disclosure through plaintext transmission in the AP pairing mode, enabling an attacker in proximity to capture Wi‑Fi traffic. This can facilitate an Evil Twin attack on the targeted system. The CVSS metrics ind...
CVE-2024-7408 Information Disclosure Vulnerability in Airveda Air Quality Monitor
This vulnerability exists in Airveda Air Quality Monitor PM2.5 PM10 due to transmission of sensitive information in plain text during AP pairing mode. An attacker in close proximity could exploit this vulnerability by capturing Wi-Fi traffic of Airveda-AP. Successful exploitation of this...
New Android Spyware LianSpy Evades Detection Using Yandex Cloud
Users in Russia have been the target of a previously undocumented Android post-compromise spyware called LianSpy since at least 2021. Cybersecurity vendor Kaspersky, which discovered the malware in March 2024, noted its use of Yandex Cloud, a Russian cloud service, for command-and-control C2...
TOTOLINK EX1200L Buffer Overflow Vulnerability (CNVD-2025-15238)
TOTOLINK EX1200L is a dual-band wireless signal amplifier launched by China Gion Electronics, which is mainly used to extend Wi-Fi coverage. TOTOLINK EX1200L suffers from a buffer overflow vulnerability, which originates from the parameter httphost of the function loginauth /cgi-bin/cstecgi.cgi...
(0Day) ChargePoint Home Flex Bluetooth Low Energy Information Disclosure Vulnerability
This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of ChargePoint Home Flex charging devices. User interaction is required to exploit this vulnerability. The specific flaw exists within the Wi-Fi setup logic. By connecting to the devic...
TOTOLINK EX1200L Buffer Overflow Vulnerability (CNVD-2025-15239)
TOTOLINK EX1200L is a dual-band wireless signal amplifier launched by China Gion Electronics, which is mainly used to extend Wi-Fi coverage. TOTOLINK EX1200L suffers from a buffer overflow vulnerability, which originates from the parameter week/sTime/eTime in the file /cgi-bin/cstecgi.cgi that ca...
TOTOLINK EX200 Buffer Overflow Vulnerability
The TOTOLINK EX200 is a 2.4G wireless N range extender designed to extend the coverage of existing Wi-Fi networks. A buffer overflow vulnerability exists in the TOTOLINK EX200. The vulnerability originates from the function loginauth in the /cgi-bin/cstecgi.cgi file, which operates on the paramet...
TOTOLINK EX1200L Buffer Overflow Vulnerability
TOTOLINK EX1200L is a dual-band wireless signal amplifier launched by China Gion Electronics, which is mainly used to extend Wi-Fi coverage. The TOTOLINK EX1200L suffers from a buffer overflow vulnerability that originates from the UploadCustomModule function in the /cgi-bin/cstecgi.cgi file. No...