Filtered by CWE-77
Filtered by vendor Subscriptions
Total 2164 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2024-24377 2024-11-21 8.1 High
An issue in idocv v.14.1.3_20231228 allows a remote attacker to execute arbitrary code and obtain sensitive information via a crafted script.
CVE-2024-24321 1 Dlink 2 Dir-816, Dir-816 Firmware 2024-11-21 9.8 Critical
An issue in Dlink DIR-816A2 v.1.10CNB05 allows a remote attacker to execute arbitrary code via the wizardstep4_ssid_2 parameter in the sub_42DA54 function.
CVE-2024-24301 2024-11-21 8.8 High
Command Injection vulnerability discovered in 4ipnet EAP-767 device v3.42.00 within the web interface of the device allows attackers with valid credentials to inject arbitrary shell commands to be executed by the device with root privileges.
CVE-2024-24216 1 Easycorp 1 Zentao 2024-11-21 9.8 Critical
Zentao v18.0 to v18.10 was discovered to contain a remote code execution (RCE) vulnerability via the checkConnection method of /app/zentao/module/repo/model.php.
CVE-2024-23749 1 9bis 1 Kitty 2024-11-21 7.8 High
KiTTY versions 0.76.1.13 and before is vulnerable to command injection via the filename variable, occurs due to insufficient input sanitization and validation, failure to escape special characters, and insecure system calls (at lines 2369-2390). This allows an attacker to add inputs inside the filename variable, leading to arbitrary code execution.
CVE-2024-23745 1 Notion 1 Web Clipper 2024-11-21 9.8 Critical
In Notion Web Clipper 1.0.3(7), a .nib file is susceptible to the Dirty NIB attack. NIB files can be manipulated to execute arbitrary commands. Additionally, even if a NIB file is modified within an application, Gatekeeper may still permit the execution of the application, enabling the execution of arbitrary commands within the application's context. NOTE: the vendor's perspective is that this is simply an instance of CVE-2022-48505, cannot properly be categorized as a product-level vulnerability, and cannot have a product-level fix because it is about incorrect caching of file signatures on macOS.
CVE-2024-23628 1 Motorola 2 Mr2600, Mr2600 Firmware 2024-11-21 9 Critical
A command injection vulnerability exists in the 'SaveStaticRouteIPv6Params' parameter of the Motorola MR2600. A remote attacker can exploit this vulnerability to achieve command execution. Authentication is required, however can be bypassed.
CVE-2024-23627 1 Motorola 2 Mr2600, Mr2600 Firmware 2024-11-21 9 Critical
A command injection vulnerability exists in the 'SaveStaticRouteIPv4Params' parameter of the Motorola MR2600. A remote attacker can exploit this vulnerability to achieve command execution. Authentication is required, however can be bypassed.
CVE-2024-23626 1 Motorola 2 Mr2600, Mr2600 Firmware 2024-11-21 9 Critical
A command injection vulnerability exists in the ‘SaveSysLogParams’ parameter of the Motorola MR2600. A remote attacker can exploit this vulnerability to achieve command execution. Authentication is required, however can be bypassed.
CVE-2024-23625 1 Dlink 2 Dap-1650, Dap-1650 Firmware 2024-11-21 9.6 Critical
A command injection vulnerability exists in D-Link DAP-1650 devices when handling UPnP SUBSCRIBE messages. An unauthenticated attacker can exploit this vulnerability to gain command execution on the device as root.
CVE-2024-23624 1 Dlink 2 Dap-1650, Dap-1650 Firmware 2024-11-21 9.6 Critical
A command injection vulnerability exists in the gena.cgi module of D-Link DAP-1650 devices. An unauthenticated attacker can exploit this vulnerability to gain command execution on the device as root.
CVE-2024-23346 2024-11-21 9.4 Critical
Pymatgen (Python Materials Genomics) is an open-source Python library for materials analysis. A critical security vulnerability exists in the `JonesFaithfulTransformation.from_transformation_str()` method within the `pymatgen` library prior to version 2024.2.20. This method insecurely utilizes `eval()` for processing input, enabling execution of arbitrary code when parsing untrusted input. Version 2024.2.20 fixes this issue.
CVE-2024-23049 1 B3log 1 Symphony 2024-11-21 9.8 Critical
An issue in symphony v.3.6.3 and before allows a remote attacker to execute arbitrary code via the log4j component.
CVE-2024-22903 1 Vinchin 1 Vinchin Backup And Recovery 2024-11-21 8.8 High
Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the deleteUpdateAPK function.
CVE-2024-22900 1 Vinchin 1 Vinchin Backup And Recovery 2024-11-21 8.8 High
Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the setNetworkCardInfo function.
CVE-2024-22729 1 Netis-systems 2 Mw5360, Mw5360 Firmware 2024-11-21 9.8 Critical
NETIS SYSTEMS MW5360 V1.0.1.3031 was discovered to contain a command injection vulnerability via the password parameter on the login page.
CVE-2024-22663 1 Totolink 2 A3700r, A3700r Firmware 2024-11-21 9.8 Critical
TOTOLINK_A3700R_V9.1.2u.6165_20211012has a command Injection vulnerability via setOpModeCfg
CVE-2024-22651 1 Dlink 2 Dir-815, Dir-815 Firmware 2024-11-21 9.8 Critical
There is a command injection vulnerability in the ssdpcgi_main function of cgibin binary in D-Link DIR-815 router firmware v1.04.
CVE-2024-22546 2024-11-21 6.4 Medium
TRENDnet TEW-815DAP 1.0.2.0 is vulnerable to Command Injection via the do_setNTP function. An authenticated attacker with administrator privileges can leverage this vulnerability over the network via a malicious POST request.
CVE-2024-22545 1 Trendnet 2 Tew-824dru, Tew-824dru Firmware 2024-11-21 7.8 High
An issue was discovered in TRENDnet TEW-824DRU version 1.04b01, allows unauthenticated attackers to execute arbitrary code via the system.ntp.server parameter in the sub_420AE0() function. The attack can be launched remotely.