CVE Vulnerability Catalog

The Totolink A3100R router with firmware version V5.9c.4577 is vulnerable to OS command injection. The ping function in the admin panel does not properly filter special characters, allowing an attacker to execute arbitrary commands.

An access control issue was discovered in NUUO software version v03.11.00. This vulnerability may allow an unauthorized user to bypass security mechanisms.

Certain HP Print devices may be vulnerable to potential information disclosure, denial of service, or remote code execution.

Certain HP Print devices may be vulnerable to information disclosure, denial of service, or remote code execution.

Wtyczka Ninja Forms - File Uploads dla WordPressa jest podatna na nieautoryzowane przesyłanie plików z powodu niewystarczającej walidacji typu pliku wejściowego w pliku ~/includes/ajax/controllers/uploads.php. Atakujący mogą obejść tę walidację, co umożliwia przesyłanie złośliwych plików, które mogą prowadzić do zdalnego wykonania kodu.

Asus RT-AC68U before version 3.0.0.4.385.20633 and RT-AC5300 before version 3.0.0.4.384.82072 are affected by a buffer overflow in blocking_request.cgi. This vulnerability could allow a remote attacker to execute arbitrary code or cause a denial of service.

A vulnerability in taocms v3.0.2 allows attackers to inject code by arbitrarily editing the .htaccess file. Attackers can modify this file to execute malicious commands on the server.

A vulnerability in OpenDocMan 1.4.4 allows an attacker to bypass MIME type checks when uploading files via add.php. This can lead to automatic processing of malicious files within the product's environment or remote code execution.

An SQL Injection vulnerability in Attendance and Payroll System v1.0 allows a remote attacker to bypass authentication via unsanitized login parameters.

A Remote Code Execution (RCE) vulnerability in Sourcecodester Attendance and Payroll System v1.0 allows an unauthenticated remote attacker to upload a malicious PHP file via the photo upload functionality.

A command injection vulnerability exists in TOTOLINK A3100R up to version V4.1.2cu.5050_B20200504 in the adm/ntm.asp script via the hosTime parameter. It allows a remote attacker to execute arbitrary system commands on the device.

YzmCMS v6.3 is affected by a broken access control vulnerability that allows unauthorized access to users' personal home pages without login. The issue arises from missing authentication checks before accessing the home page, enabling attackers to view other users' pages while not logged in.

Występuje podatność CWE-287: Niewłaściwa autoryzacja, która może umożliwić atakującemu dowolną zmianę zachowania UPS, gdy klucz zostanie ujawniony i użyty do przesłania złośliwego oprogramowania. Dotyczy to rodziny APC Smart-UPS, w tym serii SMT, SMC, SCL, SMX oraz SRT.

The vulnerability in Printix Secure Cloud Print Management up to version 1.3.1106.0 incorrectly uses privileged APIs to modify values in HKEY_LOCAL_MACHINE via UITasks.PersistentRegistryData. This allows privilege escalation or unauthorized system changes.

A remote code execution (RCE) vulnerability was discovered in TP-LINK TL-WR840N(ES) firmware version V6.20_180709 via the oal_wan6_setIpAddr function. An unauthenticated attacker can execute arbitrary code on the device.

A command injection vulnerability was discovered in TP-LINK TL-WR840N(ES) firmware version V6.20_180709 via the component oal_setIp6DefaultRoute. An attacker can remotely execute arbitrary system commands without authentication.

A command injection vulnerability was discovered in TP-LINK TL-WR840N(ES) firmware version V6.20_180709. The flaw resides in the oal_startPing component.

A sandbox escape vulnerability in Zepl Notebooks before 2021-10-25 allows users to escape the running context sandbox after launching Remote Code Execution from the Notebook, gaining access to internal Zepl assets including cloud metadata services.

In versions prior to 0.8.5, 0.9.4, 0.10.0, and 0.10.1 of the Go library github.com/gravitl/netmaker, a hard-coded cryptographic key was used.