C0Ss4Ck

يحتوي NVIDIA DOCA على ثغرة أمنية في حزمة Debian collectx-clxapidev قد تسمح لمستخدم ذي امتيازات منخفضة برفع مستوى امتيازاته. قد يؤدي الاستغلال الناجح لهذه الثغرة إلى رفع مستوى الامتيازات.

A Remote Command Injection issue exists in the mainfunction.cgi script of the DrayTek Vigor web interface due to inadequate data sanitization at the management level. This could allow a remote attacker to execute arbitrary code by sending a crafted HTTP message with a malformed QUERY STRING to the mainfunction.cgi endpoint.

The issue is related to a Format String vulnerability in the mainfunction.cgi file of the DrayTek Vigor web interface. This vulnerability can be exploited by a remote attacker using a crafted HTTP message with a malformed QUERY STRING, potentially allowing the execution of arbitrary code.

Name of the Vulnerable Software and Affected Versions: D-Link DSR-250 version 3.14 D-Link DSR-1000N version 2.11B201 Description: The UPnP service in the affected devices contains a command injection issue, which can lead to remote command execution. Recommendations: For D-Link DSR-250 version 3.14, consider disabling the UPnP service until a patch is available. For D-Link DSR-1000N version 2.11B201, consider disabling the UPnP service until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.