KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevNet function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute…
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the rebDevice function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute…
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the fdftDevice function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to…
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevProto function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to…
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the auth_set function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute…
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the getVid function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute…
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the getDetail function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute…
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevice function. The vulnerability is caused by insufficient sanitization of the username, password, and location fields before command execution. A remote attacker can trigger this vulnerability via crafted…
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the pingtrace function. The vulnerability is caused by insufficient validation of the host field before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary…
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the webBackupAction function. The vulnerability is caused by insufficient filtering of the option, key, pw_encode, pathN, and valueN fields before command execution. A remote attacker can trigger this vulnerability…
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the sysreboot function. The vulnerability is caused by insufficient filtering of the config, act, pathN, and valueN fields before command execution. A remote attacker can trigger this vulnerability via crafted input…
Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the jsonstatus function. The vulnerability is caused by insufficient filtering of the usescript, usefile, and option fields before command execution. A remote attacker can trigger this vulnerability via crafted input…
Multiple DrayTek VigorAP models contain a command injection vulnerability in the setLan function. The vulnerability is caused by insufficient validation of the lanIp and lanNetmask fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute…
Multiple DrayTek VigorAP models contain a command injection vulnerability in the setcamset function. The vulnerability is caused by insufficient filtering of the selectSlaves field before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary…
Multiple DrayTek VigorAP models contain a command injection vulnerability in the mesh_start_speed_test function. The vulnerability is caused by insufficient sanitization of the meshdevice_index and meshdevice_ip fields before command execution. A remote attacker can trigger this vulnerability via…
Multiple DrayTek VigorAP models contain a command injection vulnerability in the InquierTime function. The vulnerability is caused by insufficient filtering of the time field before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands…
Multiple DrayTek VigorAP models contain a command injection vulnerability in the apautotest function. The vulnerability is caused by insufficient validation of the CMD0, CMD3, and CMD6 fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute…
Luka XSS w pxc_Dot1xCfg.php pozwala atakującemu na zmianę parametrów przez uwierzytelnionego użytkownika.
Luka XSS w pxc_PortCfg.php pozwala na manipulację parametrami przez zdalnego atakującego.
Luka XSS w pxc_portCntr.php pozwala na manipulację parametrami przez zdalnego atakującego.
Luka XSS w pxc_portSfp.php pozwala na manipulację parametrami przez zdalnego atakującego.
Luka XSS w pxc_portSecCfg.php pozwala na manipulację parametrami urządzenia przez zdalnego atakującego.
Luka XSS w pxc_vlanIntfCfg.php pozwala na manipulację parametrami urządzenia przez zdalnego atakującego.
Wstrzyknięcie poleceń w Endian Firewall umożliwia uwierzytelnionym użytkownikom wykonanie dowolnych poleceń OS.
Wstrzyknięcie poleceń w Endian Firewall umożliwia uwierzytelnionym użytkownikom wykonanie dowolnych poleceń OS.
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevNet function. | Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevNet function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute… |
Obserwuj | 8,6 | 2,27 % | ||
| Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the rebDevice function. | Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the rebDevice function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute… |
Obserwuj | 8,6 | 2,27 % | ||
| Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the fdftDevice function. | Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the fdftDevice function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to… |
Obserwuj | 8,6 | 2,27 % | ||
| Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevProto function. | Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevProto function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to… |
Obserwuj | 8,6 | 2,27 % | ||
| Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the auth_set function. | Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the auth_set function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute… |
Obserwuj | 8,6 | 2,27 % | ||
| Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the getVid function. | Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the getVid function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute… |
Obserwuj | 8,6 | 2,27 % | ||
| Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the getDetail function. | Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the getDetail function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute… |
Obserwuj | 8,6 | 2,27 % | ||
| Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevice function. | Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevice function. The vulnerability is caused by insufficient sanitization of the username, password, and location fields before command execution. A remote attacker can trigger this vulnerability via crafted… |
Obserwuj | 8,6 | 2,27 % | ||
| Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the pingtrace function. | Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the pingtrace function. The vulnerability is caused by insufficient validation of the host field before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary… |
Obserwuj | 8,6 | 2,27 % | ||
| Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the webBackupAction function. | Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the webBackupAction function. The vulnerability is caused by insufficient filtering of the option, key, pw_encode, pathN, and valueN fields before command execution. A remote attacker can trigger this vulnerability… |
Obserwuj | 8,6 | 2,27 % | ||
| Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the sysreboot function. | Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the sysreboot function. The vulnerability is caused by insufficient filtering of the config, act, pathN, and valueN fields before command execution. A remote attacker can trigger this vulnerability via crafted input… |
Obserwuj | 8,6 | 2,27 % | ||
| Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the jsonstatus function. | Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the jsonstatus function. The vulnerability is caused by insufficient filtering of the usescript, usefile, and option fields before command execution. A remote attacker can trigger this vulnerability via crafted input… |
Obserwuj | 8,6 | 2,27 % | ||
| Multiple DrayTek VigorAP models contain a command injection vulnerability in the setLan function. | Multiple DrayTek VigorAP models contain a command injection vulnerability in the setLan function. The vulnerability is caused by insufficient validation of the lanIp and lanNetmask fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute… |
Obserwuj | 8,6 | 2,27 % | ||
| Multiple DrayTek VigorAP models contain a command injection vulnerability in the setcamset function. | Multiple DrayTek VigorAP models contain a command injection vulnerability in the setcamset function. The vulnerability is caused by insufficient filtering of the selectSlaves field before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary… |
Obserwuj | 8,6 | 2,27 % | ||
| Multiple DrayTek VigorAP models contain a command injection vulnerability in the mesh_start_speed_test function. | Multiple DrayTek VigorAP models contain a command injection vulnerability in the mesh_start_speed_test function. The vulnerability is caused by insufficient sanitization of the meshdevice_index and meshdevice_ip fields before command execution. A remote attacker can trigger this vulnerability via… |
Obserwuj | 8,6 | 2,27 % | ||
| Multiple DrayTek VigorAP models contain a command injection vulnerability in the InquierTime function. | Multiple DrayTek VigorAP models contain a command injection vulnerability in the InquierTime function. The vulnerability is caused by insufficient filtering of the time field before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands… |
Obserwuj | 8,6 | 2,27 % | ||
| Multiple DrayTek VigorAP models contain a command injection vulnerability in the apautotest function. | Multiple DrayTek VigorAP models contain a command injection vulnerability in the apautotest function. The vulnerability is caused by insufficient validation of the CMD0, CMD3, and CMD6 fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute… |
Obserwuj | 8,6 | 2,27 % | ||
| Luka XSS w pxc_Dot1xCfg.php pozwala atakującemu na zmianę parametrów przez uwierzytelnionego użytkownika. | Luka XSS w pxc_Dot1xCfg.php pozwala atakującemu na zmianę parametrów przez uwierzytelnionego użytkownika. |
Obserwuj | 7,1 | 9,77 % | ||
| Luka XSS w pxc_PortCfg.php pozwala na manipulację parametrami przez zdalnego atakującego. | Luka XSS w pxc_PortCfg.php pozwala na manipulację parametrami przez zdalnego atakującego. |
Obserwuj | 7,1 | 9,77 % | ||
| Luka XSS w pxc_portCntr.php pozwala na manipulację parametrami przez zdalnego atakującego. | Luka XSS w pxc_portCntr.php pozwala na manipulację parametrami przez zdalnego atakującego. |
Obserwuj | 7,1 | 9,77 % | ||
| Luka XSS w pxc_portSfp.php pozwala na manipulację parametrami przez zdalnego atakującego. | Luka XSS w pxc_portSfp.php pozwala na manipulację parametrami przez zdalnego atakującego. |
Obserwuj | 7,1 | 9,77 % | ||
| Luka XSS w pxc_portSecCfg.php pozwala na manipulację parametrami urządzenia przez zdalnego atakującego. | Luka XSS w pxc_portSecCfg.php pozwala na manipulację parametrami urządzenia przez zdalnego atakującego. |
Obserwuj | 7,1 | 9,77 % | ||
| Luka XSS w pxc_vlanIntfCfg.php pozwala na manipulację parametrami urządzenia przez zdalnego atakującego. | Luka XSS w pxc_vlanIntfCfg.php pozwala na manipulację parametrami urządzenia przez zdalnego atakującego. |
Obserwuj | 7,1 | 9,77 % | ||
| Wstrzyknięcie poleceń w Endian Firewall umożliwia uwierzytelnionym użytkownikom wykonanie dowolnych poleceń OS. | Wstrzyknięcie poleceń w Endian Firewall umożliwia uwierzytelnionym użytkownikom wykonanie dowolnych poleceń OS. |
Obserwuj | 8,8 | 1,25 % | ||
| Wstrzyknięcie poleceń w Endian Firewall umożliwia uwierzytelnionym użytkownikom wykonanie dowolnych poleceń OS. | Wstrzyknięcie poleceń w Endian Firewall umożliwia uwierzytelnionym użytkownikom wykonanie dowolnych poleceń OS. |
Obserwuj | 8,8 | 1,25 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.