Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
2,616 results · page 12 of 53
Nov 5, 2024Netgear XR300 v1.0.3.78 was discovered to contain a stack overflow via the passphrase parameter at bridge_wireless_main.cgi.CVE-2024-52017 · Network & remote access · netgear · reported by MITREMedium 5.7
Netgear XR300 v1.0.3.78 was discovered to contain a stack overflow via the passphrase parameter at bridge_wireless_main.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
- Product
- xr300_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2024Netgear XR300 v1.0.3.78 was discovered to contain a stack overflow via the ssid parameter in bridge_wireless_main.cgi.CVE-2024-51022 · Network & remote access · netgear · reported by MITREMedium 5.7
Netgear XR300 v1.0.3.78 was discovered to contain a stack overflow via the ssid parameter in bridge_wireless_main.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
- Product
- xr300_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2024Netgear R7000P v1.3.3.154 was discovered to contain a stack overflow via the apn parameter at usbISP_detail_edit.cgi.CVE-2024-51020 · Network & remote access · netgear · reported by MITREMedium 5.7
Netgear R7000P v1.3.3.154 was discovered to contain a stack overflow via the apn parameter at usbISP_detail_edit.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
- Product
- r7000p_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2024Netgear R7000P v1.3.3.154 was discovered to contain a stack overflow via the pppoe_localnetmask parameter at pppoe.cgi.CVE-2024-51019 · Network & remote access · netgear · reported by MITREMedium 5.7
Netgear R7000P v1.3.3.154 was discovered to contain a stack overflow via the pppoe_localnetmask parameter at pppoe.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
- Product
- r7000p_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2024Netgear R7000P v1.3.3.154 was discovered to contain a stack overflow via the pptp_user_netmask parameter at pptp.cgi.CVE-2024-51018 · Network & remote access · netgear · reported by MITREMedium 5.7
Netgear R7000P v1.3.3.154 was discovered to contain a stack overflow via the pptp_user_netmask parameter at pptp.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
- Product
- r7000p_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2024Netgear R7000P v1.3.3.154 was discovered to contain a stack overflow via the l2tp_user_netmask parameter at l2tp.cgi.CVE-2024-51017 · Network & remote access · netgear · reported by MITREMedium 5.7
Netgear R7000P v1.3.3.154 was discovered to contain a stack overflow via the l2tp_user_netmask parameter at l2tp.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
- Product
- r7000p_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2024Netgear XR300 v1.0.3.78 was discovered to contain a stack overflow via the addName%d parameter in usb_approve.cgi.CVE-2024-51016 · Network & remote access · netgear · reported by MITREMedium 5.7
Netgear XR300 v1.0.3.78 was discovered to contain a stack overflow via the addName%d parameter in usb_approve.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
- Product
- xr300_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2024Netgear R7000P v1.3.3.154 was discovered to contain a command injection vulnerability via the device_name2 parameter at operation_mode.cgi.CVE-2024-51015 · Network & remote access · netgear · reported by MITREMedium 5.7
Netgear R7000P v1.3.3.154 was discovered to contain a command injection vulnerability via the device_name2 parameter at operation_mode.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request.
- Product
- r7000p_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2024Netgear XR300 v1.0.3.78 was discovered to contain a stack overflow via the ssid_an parameter in bridge_wireless_main.cgi.CVE-2024-51014 · Network & remote access · netgear · reported by MITREMedium 5.7
Netgear XR300 v1.0.3.78 was discovered to contain a stack overflow via the ssid_an parameter in bridge_wireless_main.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
- Product
- xr300_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2024Netgear R7000P v1.3.3.154 was discovered to contain a stack overflow via the RADIUSAddr%d_wla parameter at wireless.cgi.CVE-2024-51013 · Network & remote access · netgear · reported by MITREMedium 5.7
Netgear R7000P v1.3.3.154 was discovered to contain a stack overflow via the RADIUSAddr%d_wla parameter at wireless.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
- Product
- r7000p_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2024Netgear R8500 v1.0.2.160 was discovered to contain a stack overflow via the ipv6_pri_dns parameter at ipv6_fix.cgi.CVE-2024-51012 · Network & remote access · netgear · reported by MITREMedium 5.7
Netgear R8500 v1.0.2.160 was discovered to contain a stack overflow via the ipv6_pri_dns parameter at ipv6_fix.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
- Product
- r8500_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2024Netgear XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 was discovered to contain a stack overflow via the pppoe_localip parameter at pppoe.cgi.CVE-2024-51011 · Network & remote access · netgear · reported by MITREMedium 5.7
Netgear XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 was discovered to contain a stack overflow via the pppoe_localip parameter at pppoe.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
- Product
- r7000p_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2024Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in the wan_gateway parameter at ether.cgi.CVE-2024-51009 · Network & remote access · netgear · reported by MITREHigh 8
Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in the wan_gateway parameter at ether.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request.
- Product
- r8500_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2024Netgear XR300 v1.0.3.78 was discovered to contain a command injection vulnerability in the system_name parameter at wiz_dyn.cgi.CVE-2024-51008 · Network & remote access · netgear · reported by MITREHigh 8
Netgear XR300 v1.0.3.78 was discovered to contain a command injection vulnerability in the system_name parameter at wiz_dyn.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request.
- Product
- xr300_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2024Netgear XR300 v1.0.3.78 was discovered to contain a stack overflow via the passphrase parameter at wireless.cgi.CVE-2024-51007 · Network & remote access · netgear · reported by MITREMedium 5.7
Netgear XR300 v1.0.3.78 was discovered to contain a stack overflow via the passphrase parameter at wireless.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
- Product
- xr300_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2024Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in the share_name parameter at usb_remote_smb_conf.cgi.CVE-2024-51005 · Network & remote access · netgear · reported by MITREHigh 8
Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in the share_name parameter at usb_remote_smb_conf.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request.
- Product
- r8500_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2024Netgear R8500 v1.0.2.160 and R7000P v1.3.3.154 were discovered to multiple stack overflow vulnerabilities in the component usb_device.cgi via the cifs_user, reaCVE-2024-51004 · Network & remote access · netgear · reported by MITREMedium 5.7
Netgear R8500 v1.0.2.160 and R7000P v1.3.3.154 were discovered to multiple stack overflow vulnerabilities in the component usb_device.cgi via the cifs_user, read_access, and write_access parameters. These vulnerabilities allow attackers to cause a Denial of Service (DoS) via a crafted POST request.
- Product
- r7000p_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2024Netgear R8500 v1.0.2.160 was discovered to contain a stack overflow via the sysDNSHost parameter at ddns.cgi.CVE-2024-51001 · Network & remote access · netgear · reported by MITREMedium 5.7
Netgear R8500 v1.0.2.160 was discovered to contain a stack overflow via the sysDNSHost parameter at ddns.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
- Product
- r8500_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2024Netgear R8500 v1.0.2.160 was discovered to contain multiple stack overflow vulnerabilities in the component wireless.cgi via the opmode, opmode_an, and opmode_aCVE-2024-51000 · Network & remote access · netgear · reported by MITREMedium 5.7
Netgear R8500 v1.0.2.160 was discovered to contain multiple stack overflow vulnerabilities in the component wireless.cgi via the opmode, opmode_an, and opmode_an_2 parameters. These vulnerabilities allow attackers to cause a Denial of Service (DoS) via a crafted POST request.
- Product
- r8500_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2024Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in the sysNewPasswd parameter at password.cgi.CVE-2024-50999 · Network & remote access · netgear · reported by MITREMedium 5.7
Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in the sysNewPasswd parameter at password.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request.
- Product
- r8500_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2024Netgear R8500 v1.0.2.160 was discovered to contain multiple stack overflow vulnerabilities in the component openvpn.cgi via the openvpn_service_port and openvpnCVE-2024-50998 · Network & remote access · netgear · reported by MITREMedium 5.7
Netgear R8500 v1.0.2.160 was discovered to contain multiple stack overflow vulnerabilities in the component openvpn.cgi via the openvpn_service_port and openvpn_service_port_tun parameters. These vulnerabilities allow attackers to cause a Denial of Service (DoS) via a crafted POST request.
- Product
- r8500_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2024Netgear R8500 v1.0.2.160 was discovered to contain a stack overflow via the share_name parameter at usb_remote_smb_conf.cgi.CVE-2024-50995 · Network & remote access · netgear · reported by MITREMedium 5.7
Netgear R8500 v1.0.2.160 was discovered to contain a stack overflow via the share_name parameter at usb_remote_smb_conf.cgi. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
- Product
- r8500_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2024Netgear R8500 v1.0.2.160 was discovered to contain multiple stack overflow vulnerabilities in the component ipv6_fix.cgi via the ipv6_wan_ipaddr, ipv6_lan_ipaddCVE-2024-50994 · Network & remote access · netgear · reported by MITREMedium 5.7
Netgear R8500 v1.0.2.160 was discovered to contain multiple stack overflow vulnerabilities in the component ipv6_fix.cgi via the ipv6_wan_ipaddr, ipv6_lan_ipaddr, ipv6_wan_length, and ipv6_lan_length parameters. These vulnerabilities allow attackers to cause a Denial of Service (DoS) via a crafted POST request.
- Product
- r8500_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 5, 2024Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in the sysNewPasswd parameter at admin_account.cgi.CVE-2024-50993 · Network & remote access · netgear · reported by MITREHigh 8
Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in the sysNewPasswd parameter at admin_account.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request.
- Product
- r8500_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2024DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability This vulnerability occurs when the `action` parameter in `cgi-bin/mainfCVE-2024-45890 · Network & remote access · draytek · reported by MITREHigh 8
DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability This vulnerability occurs when the `action` parameter in `cgi-bin/mainfunction.cgi` is set to `download_ovpn.`
- Product
- vigor3900_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2024In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doL2TP function.CVE-2024-51253 · Network & remote access · draytek · reported by MITREHigh 8
In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doL2TP function.
- Product
- vigor3900_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2024In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the backup function.CVE-2024-51251 · Network & remote access · draytek · reported by MITREHigh 8
In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the backup function.
- Product
- vigor3900_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2024In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the reboot function.CVE-2024-51249 · Network & remote access · draytek · reported by MITREHigh 8
In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the reboot function.
- Product
- vigor3900_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 4, 2024In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doPPTP function.CVE-2024-51246 · Network & remote access · draytek · reported by MITREHigh 8
In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doPPTP function.
- Product
- vigor3900_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 1, 2024In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the restore function.CVE-2024-51252 · Network & remote access · draytek · reported by MITRECritical 9.8
In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the restore function.
- Product
- vigor3900_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 1, 2024In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the modifyrow function.CVE-2024-51248 · Network & remote access · draytek · reported by MITREHigh 8.8
In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the modifyrow function.
- Product
- vigor3900_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 1, 2024In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doPPPo function.CVE-2024-51247 · Network & remote access · draytek · reported by MITREHigh 8.8
In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doPPPo function.
- Product
- vigor3900_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 1, 2024In DrayTek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the rename_table function.CVE-2024-51245 · Network & remote access · draytek · reported by MITREHigh 8.8
In DrayTek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the rename_table function.
- Product
- vigor3900_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 1, 2024In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doIPSec function.CVE-2024-51244 · Network & remote access · draytek · reported by MITREHigh 8.8
In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doIPSec function.
- Product
- vigor3900_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 1, 2024TP Link MR200 V4 Firmware version 210201 was discovered to contain a null-pointer-dereference in the web administration panel on /cgi/login via the sign, ActionCVE-2024-22733 · Network & remote access · tp-link · reported by MITREHigh 7.5
TP Link MR200 V4 Firmware version 210201 was discovered to contain a null-pointer-dereference in the web administration panel on /cgi/login via the sign, Action or LoginStatus query parameters which could lead to a denial of service by a local or remote unauthenticated attacker.
- Product
- tl-mr200_v4_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2024DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the acme_process functioCVE-2024-51260 · Network & remote access · draytek · reported by MITRECritical 9.8
DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the acme_process function.
- Product
- vigor3900_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2024DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the ruequest_certificateCVE-2024-51255 · Network & remote access · draytek · reported by MITRECritical 9.8
DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the ruequest_certificate function.
- Product
- vigor3900_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2024DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the setup_cacertificate CVE-2024-51259 · Network & remote access · draytek · reported by MITRECritical 9.8
DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the setup_cacertificate function.
- Product
- vigor3900_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 31, 2024DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the sign_cacertificate fCVE-2024-51254 · Network & remote access · draytek · reported by MITREHigh 8.8
DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the sign_cacertificate function.
- Product
- vigor3900_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2024DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doSSLTunnel functionCVE-2024-51258 · Network & remote access · draytek · reported by MITREHigh 8.8
DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doSSLTunnel function.
- Product
- vigor3900_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2024In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the packet_monitor functioCVE-2024-51301 · Network & remote access · draytek · reported by MITREHigh 8.8
In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the packet_monitor function.
- Product
- vigor3900_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2024In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the get_rrd function.CVE-2024-51300 · Network & remote access · draytek · reported by MITREHigh 8.8
In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the get_rrd function.
- Product
- vigor3900_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2024In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the dumpSyslog function.CVE-2024-51299 · Network & remote access · draytek · reported by MITREHigh 8.8
In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the dumpSyslog function.
- Product
- vigor3900_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2024In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doGRETunnel function.CVE-2024-51298 · Network & remote access · draytek · reported by MITRECritical 9.8
In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doGRETunnel function.
- Product
- vigor3900
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2024In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the pingtrace function.CVE-2024-51296 · Network & remote access · draytek · reported by MITREHigh 8.8
In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the pingtrace function.
- Product
- vigor3900_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2024DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doCertificate functiCVE-2024-51257 · Network & remote access · draytek · reported by MITREHigh 8.8
DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doCertificate function.
- Product
- vigor3900_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 30, 2024In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the ldap_search_dn functioCVE-2024-51304 · Network & remote access · draytek · reported by MITREHigh 8.8
In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the ldap_search_dn function.
- Product
- vigor3900_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2024An issue in Casa Systems NTC-221 version 2.0.99.0 and before allows a remote attacker to execute arbitrary code via a crafted payload to the /www/cgi-bin/nas.cgCVE-2024-26519 · Other software · casa_systems · reported by MITRECritical 9
An issue in Casa Systems NTC-221 version 2.0.99.0 and before allows a remote attacker to execute arbitrary code via a crafted payload to the /www/cgi-bin/nas.cgi component.
- Product
- ntc-221_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2024Netgear R7000 1.0.11.136 is vulnerable to Command Injection in RMT_invite.cgi via device_name2 parameter.CVE-2024-35520 · Network & remote access · netgear · reported by MITREHigh 8.4
Netgear R7000 1.0.11.136 is vulnerable to Command Injection in RMT_invite.cgi via device_name2 parameter.
- Product
- r7000_firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2024Netgear EX6120 v1.0.0.68, Netgear EX6100 v1.0.2.28, and Netgear EX3700 v1.0.0.96 are vulnerable to command injection in operating_mode.cgi via the ap_mode paramCVE-2024-35519 · Network & remote access · netgear · reported by MITREHigh 8.4
Netgear EX6120 v1.0.0.68, Netgear EX6100 v1.0.2.28, and Netgear EX3700 v1.0.0.96 are vulnerable to command injection in operating_mode.cgi via the ap_mode parameter.
- Product
- ex6120
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.