CVE Vulnerability Catalog

D-Link DI-7001 MINI_5G version 19.10.31A1 contains a code execution vulnerability in the flag parameter of msp_info, which can be exploited to run arbitrary commands.

An unauthenticated OS command injection vulnerability exists in the parental control functionality of Archer BE800 V1, BE3600 V1, and AX75 V1 due to improper filtering and neutralization of special characters in certain parameters. A LAN-based attacker can inject arbitrary commands and execute them with root privileges. Successful exploitation may result in complete device compromise and impact the confidentiality, integrity, and availability of the affected device and network traffic.

Hi.Events validates a webhook destination only when it is registered, never when it is used. NoInternalUrlRule resolves the hostname with gethostbyname() and rejects private and reserved ranges, which any public hostname passes. At dispatch, WebhookDispatchService takes the stored URL and calls it through spatie/laravel-webhook-server without repeating the check, and redirect following remains enabled by default. A destination that answers with a redirect to a loopback, private or cloud metadata address therefore causes the server to issue that request, and changing the hostname's DNS record after registration reaches the same result because no resolution is repeated. The response is not discarded: WebhookResponseHandlerService stores the body on the webhook log and WebhookLogResource returns it from the webhook logs endpoint, so the requester reads what the internal service replied rather than inferring it. Version 1.11.1-beta revalidates at dispatch, pins the validated address, checks every redirect hop, and decodes IPv6 transition addresses that previously bypassed the filter.

AzuraCast exposes the Liquidsoap custom configuration fields through an endpoint that does not require the permission guarding them. The backend_config property in Station.php is annotated with GROUP_GENERAL, and PUT /api/station/{station_id}/profile/edit deserializes with that group while requiring only StationPermissions::Profile. AbstractArrayEntity::fromArray() then assigns every public property with no field-level permission check, so custom_config_top, custom_config, custom_config_pre_playlists, custom_config_pre_live, custom_config_pre_fade and custom_config_bottom are writable through it. ConfigWriter::writeCustomConfigurationSection() emits those values verbatim into the generated Liquidsoap .liq script, where the process.run() and process.exec() built-ins execute operating system commands when the backend restarts, which the built-in sync task triggers automatically once needs_restart is set. The dedicated endpoint for the same data, PUT /api/station/{id}/liquidsoap-config, requires StationPermissions::Broadcasting, so a station manager holding only the profile permission reaches configuration that the intended boundary reserves for broadcasting operators.

Label Studio does not scope the annotation detail endpoint to the requesting user's organization. AnnotationAPI in label_studio/tasks/api.py declares queryset = Annotation.objects.all() and provides no get_queryset override, so the default lookup retrieves any annotation by primary key. The view's permission_required entries name annotations.view, annotations.change and annotations.delete, and label_studio/core/permissions.py registers every permission with rules.is_authenticated, so the check is satisfied by any logged-in account and no object-level organization test runs. The sibling task endpoint does constrain its queryset with project__organization set to the requester's active organization, which is the boundary this path omits. Annotation identifiers are sequential integers, so an authenticated user of one organization can enumerate identifiers to read, modify and delete annotations belonging to other organizations on the same instance. The same unscoped queryset appears on AnnotationConvertAPI in the same file.

The Continue CLI in unattended mode (headless/auto) uses an incomplete denylist as its only barrier to destructive shell commands. It allows the Bash tool and blocks only certain paths, permitting recursive forced removal of directories like /home, /root, /var, /opt, or /srv. Additionally, due to variable parsing, the command rm -rf $HOME is not blocked, and other dangerous tools (find, shred, wipefs, truncate, pkexec) are not properly handled.

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevNet function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface.

Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the mail_mailalert function. The vulnerability is caused by concatenating multiple smtpReceiver email addresses into a fixed-size buffer without checking the remaining buffer size. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbitrary commands. Exploitation requires valid administrative credentials for the device's web management interface.

Multiple DrayTek VigorSwitch models have a buffer overflow vulnerability in the diag_logmail function. The issue is caused by concatenating multiple smtpReceiver email addresses into a fixed-size buffer without checking remaining space. A remote attacker can trigger this via crafted input, causing denial of service or potential arbitrary command execution. Valid administrative credentials for the web management interface are required.

Multiple DrayTek VigorSwitch models have a buffer overflow vulnerability in the acl_general_setup Edit ACE function. The issue is caused by copying the name field into a fixed-size buffer without length validation. A remote attacker can trigger this via crafted input, causing denial of service or potential arbitrary command execution. Valid administrative credentials for the web management interface are required.

Multiple DrayTek VigorSwitch models have a buffer overflow vulnerability in the acl_general_setup Add ACE function. The issue is caused by copying the name field into a fixed-size buffer without length validation. A remote attacker can trigger this via crafted input, causing denial of service or potential arbitrary command execution. Valid administrative credentials for the web management interface are required.

Multiple DrayTek VigorSwitch models have a buffer overflow vulnerability in the switch_lan_gvrp function. The issue is caused by unsafe copying of the portList field into an undersized buffer. A remote attacker can trigger this via crafted input, causing denial of service or potential arbitrary command execution. Valid administrative credentials for the web management interface are required.

Multiple DrayTek VigorSwitch models have a buffer overflow vulnerability in the poe_schedule_profile function. The issue is caused by repeated concatenation of start_date, start_time, duration_time, how_often, weekdays, monthly_date, and cycle_duration fields into small fixed-size buffers without proper length checks. A remote attacker can trigger this via crafted input, causing denial of service or potential arbitrary command execution. Valid administrative credentials for the web management interface are required.

Multiple DrayTek VigorSwitch models have a buffer overflow vulnerability in the sysreboot function. The issue is caused by unsafe concatenation of split valueN data into a fixed-size buffer. A remote attacker can trigger this via crafted input, causing denial of service or potential arbitrary command execution. Valid administrative credentials for the web management interface are required.

Multiple DrayTek VigorSwitch models have a buffer overflow vulnerability in the webBackupAction function. The issue is caused by repeated string concatenation of pathN, valueN, key, and option fields into fixed-size stack buffers without total length checks. A remote attacker can trigger this via crafted input, causing denial of service or potential arbitrary command execution. Valid administrative credentials for the web management interface are required.

Multiple DrayTek VigorSwitch models have a buffer overflow vulnerability in the pingtrace function. The issue is caused by missing length checks when the host, count, and interval fields are concatenated into a fixed-size buffer. A remote attacker can trigger this via crafted input, causing denial of service or potential arbitrary command execution. Valid administrative credentials for the web management interface are required.

Multiple DrayTek VigorSwitch models have a command injection vulnerability in the tftp_upgrade function. The issue is caused by insufficient filtering before the filename field is concatenated into a command. A remote attacker can trigger this via crafted input to execute arbitrary commands with root privileges. Valid administrative credentials for the web management interface are required.

Multiple DrayTek VigorSwitch models have a command injection vulnerability in the setTime function. The issue is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this via crafted input to execute arbitrary commands with root privileges. Valid administrative credentials for the web management interface are required.

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevProto function. The issue is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can exploit this to execute arbitrary commands with root privileges, but requires valid administrative credentials.

Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the fdftDevice function. The issue is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can exploit this to execute arbitrary commands with root privileges, but requires valid administrative credentials.