CVE-2022-26318

This CVE (CVE-2022-26318) affects WatchGuard XTM/Firebox appliances running Fireware OS before 12.7.2_U2, 12.x before 12.1.3_U8, and 12.2.x through 12.5.x before 12.5.9_U2, enabling unauthenticated remote code execution via the admin interface. Technical details in connected docs show in-the-wild...

CVE-2021-46381

CVE-2021-46381 affects the D-Link DAP-1620 (A1) device, where a path traversal leads to Local File Inclusion. The vulnerability allows reading sensitive internal files such as /etc/passwd and /etc/shadow via crafted input to the device’s web interface (notably through apply.cgi). Public exploit/m...

CVE-2021-46379

CVE-2021-46379 affects the D-Link DIR850/ET850-1.08TRb03 routers. The vulnerability is an insufficient/incorrect access control in URL redirection to an untrusted site (open redirect), enabling redirection of users to attacker-controlled domains. The issue is tied to the firmware version ET850-1....

CVE-2022-23397

The CVE-2022-23397 entry affects Cedar Gate EZ-NET Portal versions 6.5.5 through 6.8.0. A vulnerability exists in the portal’s handling of URL parameters during the display of messages to users, where data sent via the URL is not properly sanitized, enabling Reflected Cross-Site Scripting. The is...

CVE-2022-22706

CVE-2022-22706 affects Arm Mali GPU Kernel Driver with an in-scope memory access flaw: a non-privileged user can gain write access to read-only pages. Affected series include Midgard r26p0–r31p0, Bifrost r0p0–r35p0, and Valhall r19p0–r35p0. Connected analyses note upstream ARM fixes (e.g., patchi...

CVE-2022-22947

CVE-2022-22947 affects Spring Cloud Gateway when the Gateway Actuator endpoint is enabled, exposed, and unsecured. A remote attacker can craft a request to the Actuator interface and cause arbitrary remote code execution on the host due to a code-injection vulnerability in the gateway routing/Act...

CVE-2022-0492

CVE-2022-0492 is a Linux kernel local-privilege-escalation flaw in the cgroups v1 release_agent handling (function cgroup_release_agent_write in kernel/cgroup/cgroup-v1.c). The issue arises because releasing the release_agent does not enforce proper capabilities, enabling a local attacker to esca...

CVE-2021-4039

CVE-2021-4039 affects Zyxel NWA-1100-NH. The web interface contains a command injection flaw that could allow an attacker to execute arbitrary OS commands on the device via network access without user interaction. This is a high-severity issue (CVSS v3.1: 9.8, Network, Low exploitability, no user...

CVE-2022-0412

CVE-2022-0412 affects the TI WooCommerce Wishlist WordPress plugin (and TI WooCommerce Wishlist Pro) prior to version 1.40.1. The vulnerability arises because the plugin fails to sanitize and escape the item_id parameter before using it in a SQL statement within the wishlist/remove_product REST e...

CVE-2022-25060

The connected advisories confirm a command injection vulnerability in TP-LINK TL-WR840N(ES) V6.20 180709, caused by improper handling in the oal_startPing component. The flaw in the firmware allows an attacker to execute arbitrary commands via the oal_startPing pathway, leveraging the libcmm.so u...

CVE-2022-24288

CVE-2022-24288 affects Apache Airflow prior to 2.2.4, where some example DAGs did not properly sanitize user-provided parameters in the web UI, enabling OS command injection. Connected documents confirm an OS command injection vulnerability in affected DAGs (e.g., example_passing_params_via_test_...

CVE-2022-23176

CVE-2022-23176 affects WatchGuard Firebox and XTM appliances running Fireware OS. The vulnerability allows a remote attacker with unprivileged credentials to access the system with a privileged management session through exposed management access. Affected versions include Fireware OS before 12.7...

CVE-2022-25083

TOTOLink A860R firmware v4.1.2cu.5182_B20201027 contains a command-injection vulnerability in the Main function. An unauthenticated attacker can pass crafted QUERY_STRING parameters to execute arbitrary commands remotely. CVSS v3.1 base score 9.8 (CRITICAL); attack vector NETWORK, no privileges r...

CVE-2022-25084

CVE-2022-25084 affects TOTOLink T6 with firmware v5.9c.4085_B20190428. The vulnerability is a command injection in the Main function that allows arbitrary commands via the QUERY_STRING parameter, enabling potential remote code execution over the network. Several connected sources (including Red H...

CVE-2022-25082

Totolink A950RG firmware versions V5.9c.4050_B20190424 and V4.1.2cu.5204_B20210112 contain a command-injection vulnerability in the Main function, allowing arbitrary commands via the QUERY_STRING parameter. Impact can be high: network-based, unauthenticated, with high confidentiality, integrity, ...

CVE-2022-25080

CVE-2022-25080 affects TOTOLink A830R firmware, specifically version V5.9c.4729_B20191112, where the vulnerability is a command injection in the Main function. The issue allows remote attackers to execute arbitrary commands via the QUERY_STRING parameter, with impact described as potential remote...

CVE-2022-25081

Totolink T10 firmware V5.9c.5061_B20200511 is affected by CVE-2022-25081, a command-injection in the Main function that allows arbitrary commands via the QUERY_STRING parameter. CVSS v3.1 base score 9.8 (CRITICAL) with network access, low attack complexity, and no authentication required. Several...

CVE-2022-25079

CVE-2022-25079 affects TOTOLink A810R firmware version 4.1.2cu.5182_B20201026. The issue is described as a command injection in the router’s Main function, allowing an attacker to execute arbitrary commands through the QUERY_STRING parameter. Multiple sources corroborate a remote, unauthenticated...

CVE-2022-25078

CVE-2022-25078 affects TOTOLink A3600R firmware version 4.1.2cu.5182_B20201102. The root cause is a lack of input sanitization in the router’s Main function, enabling command injection via the QUERY_STRING parameter. Public documentation consistently describes arbitrary command execution as the...

CVE-2022-25077

Affected device and version: TOTOLink A3100R, version 4.1.2cu.5050_B20200504. Vulnerability type: command injection in the Main function, exploitable via the QUERY_STRING parameter. Root cause described as lack of input validation/filtering in Main. Impact (as stated): attacker could execute arbi...