PT-2022-9411

Name of the Vulnerable Software and Affected Versions guake versions prior to 3.8.5 Description The issue is related to the exposure of execute command and execute command by uuid methods via the d-bus interface, allowing a malicious user to run an arbitrary command. Exploitation requires the use...

CVE-2022-22566

Select Dell Client Commercial and Consumer platforms contain a pre-boot direct memory access DMA vulnerability. An authenticated attacker with physical access to the system may potentially exploit this vulnerability in order to execute arbitrary code on the device...

CVE-2022-22689

CA Harvest Software Change Manager versions 13.0.3, 13.0.4, 14.0.0, and 14.0.1, contain a vulnerability in the CSV export functionality, due to insufficient input validation, that can allow a privileged user to potentially execute arbitrary code or commands...

CVE-2022-23329

A vulnerability in $"freemarker.template.utility.Execute"?new of UJCMS Jspxcms v10.2.0 allows attackers to execute arbitrary commands via uploading malicious files...

Design/Logic Flaw

A vulnerability in $"freemarker.template.utility.Execute"?new of UJCMS Jspxcms v10.2.0 allows attackers to execute arbitrary commands via uploading malicious files...

CVE-2022-23329

A vulnerability in $"freemarker.template.utility.Execute"?new of UJCMS Jspxcms v10.2.0 allows attackers to execute arbitrary commands via uploading malicious files...

Command injection

Tenda routers G1 and G3 v15.11.0.179502CN were discovered to contain a command injection vulnerability in the function formSetDMZ. This vulnerability allows attackers to execute arbitrary commands via the dmzHost1 parameter...

Command injection

TOTOLINK X5000R v9.1.0u.6118B20201102 was discovered to contain a command injection vulnerability in the function NTPSyncWithHost. This vulnerability allows attackers to execute arbitrary commands via the parameter hosttime...

CVE-2021-44247

Totolink devices A3100R v4.1.2cu.5050B20200504, A830R v5.9c.4729B20191112, and A720R v4.1.5cu.470B20200911 were discovered to contain command injection vulnerability in the function setNoticeCfg. This vulnerability allows attackers to execute arbitrary commands via the IpFrom parameter...

CVE-2021-46456

D-Link device D-Link DIR-823-Pro v1.0.2 was discovered to contain a command injection vulnerability in the function SetWLanACLSettings. This vulnerability allows attackers to execute arbitrary commands via the wl0.0maclist parameter...

CVE-2022-24168

Tenda routers G1 and G3 v15.11.0.179502CN were discovered to contain a command injection vulnerability in the function formSetIpGroup. This vulnerability allows attackers to execute arbitrary commands via the IPGroupStartIP and IPGroupEndIP parameters...

PT-2022-15932

Name of the Vulnerable Software and Affected Versions UJCMS Jspxcms version 10.2.0 Description A vulnerability in the Execute function of the freemarker.template.utility package allows attackers to execute arbitrary commands via uploading malicious files. Recommendations For UJCMS Jspxcms version...

Korenix Technology Korenix JetWave security vulnerabilities

Korenix Technology Korenix JetWave is a series of wireless access points from Korenix Technology. A security vulnerability exists in Korenix JetWave that stems from the software's lack of authentication of user data. An authenticated user can execute arbitrary code via syscmd.asp...

CVE-2022-23329: Unrestricted Upload of File with Dangerous Type

A vulnerability in $"freemarker.template.utility.Execute"?new of UJCMS Jspxcms v10.2.0 allows attackers to execute arbitrary commands via uploading malicious files...

CVE-2022-20703

Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization protections Fetch and run unsigned softwa...

Cisco Small Business buffer error vulnerability

Cisco Small Business is a switch from Cisco USA. Cisco Small Business RV Series Routers has buffer error vulnerabilities that result from an insufficient authorization enforcement mechanism. An attacker can exploit these vulnerabilities by submitting specific commands to the affected device...

TIBCO Security Advisory: February 15, 2022 - TIBCO AuditSafe -2022-22770

TIBCO AuditSafe API Authentication vulnerability Original release date: February 15, 2022 Lastrevised: --- CVE-2022-22770 Source: TIBCOSoftware Inc. Products Affected TIBCO AuditSafe versions 1.1.0 and below The following component is affected: Web Server Description The component listed above...

CVE-2021-23521

This affects the package juce-framework/JUCE before 6.1.5. This vulnerability is triggered when a malicious archive is crafted with an entry containing a symbolic link. When extracted, the symbolic link is followed outside of the target dir allowing writing arbitrary files on the target host. In...

Elite Graphix Elite Cms has a SQL injection vulnerability

Elite Graphix Elite Cms is a Web Content Management written in Php language by Elite Graphix India. A platform for storing and organizing information and documents. Elite Graphix Elite Cms suffers from a SQL injection vulnerability that stems from a lack of validation of externally entered SQL...

Microsoft Internet Explorer Memory Corruption Vulnerability

Microsoft Internet Explorer contains a memory corruption vulnerability that allows remote attackers to execute code in the context of the current user...