Headlesszeke

This issue allows physically present attackers to execute arbitrary code on affected installations of the Visteon Infotainment system. Authentication is not required to exploit this issue. The specific flaw exists within the DeviceManager, where the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this issue to execute code in the context of root.

This issue allows remote attackers to execute arbitrary code on affected installations. Authentication is required to exploit this issue. The flaw exists within the handling of the `ping` parameter provided to `tools.sh`, resulting from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this issue to execute code in the context of root.

This issue allows remote attackers to execute arbitrary code on affected installations. Authentication is not required to exploit this issue. The flaw exists within the handling of authentication headers, specifically due to the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this issue to execute code in the context of root.

This issue allows remote attackers to execute arbitrary code on vulnerable installations. Authentication is not required to exploit this issue. The flaw exists within the web management portal due to the lack of proper validation of user data before executing a system call. An attacker could leverage this issue to execute code with root privileges.

The issue allows remote attackers to obtain credentials by reading the configuration files. This is related to the management portal in the affected device.

The issue concerns an unspecified vulnerability in the management portal of the ARRIS VAP2500. This vulnerability allows remote attackers to execute arbitrary commands. The exact vectors used for the attack are not specified.

The issue allows remote attackers to bypass authentication due to improper password validation.

The issue is related to a cross-site scripting (XSS) vulnerability, specifically a persistent cross-site scripting vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML via unspecified parameters in the s network.asp file, which is related to the 'Friendlyname' feature.

The issue is related to the miniigd SOAP service in Realtek SDK, which allows remote attackers to execute arbitrary code via a crafted NewInternalClient request. This has been exploited in the wild through 2023. The vulnerability is associated with insufficient input validation, allowing an attacker to execute arbitrary code using specially formed requests.