CVE-2023-27874: Improper Restriction of XML External Entity Reference

IBM Aspera Faspex 4.4.2 is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote authenticated attacker could exploit this vulnerability to execute arbitrary commands. IBM X-Force ID: 249845...

NETGEAR RBR750 security vulnerabilities

The NETGEAR RBR750 is a home WiFi system from NETGEAR. The NETGEAR RBR750 version 4.6.8.5 suffers from a command injection vulnerability that stems from a failure to properly filter constructed command special characters, commands, etc. in the hidden telnet service feature. An attacker could...

CBL Mariner 2.0 Security Update: ctags (CVE-2022-4515)

The version of ctags installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-4515 advisory. - A flaw was found in Exuberant Ctags in the way it handles the -o option. This option specifies the tag filenam...

CVE-2023-28617

org-babel-execute:latex in ob-latex.el in Org Mode through 9.6.1 for GNU Emacs allows attackers to execute arbitrary commands via a file name or directory name that contains shell metacharacters...

CVE-2023-28617

org-babel-execute:latex in ob-latex.el in Org Mode through 9.6.1 for GNU Emacs allows attackers to execute arbitrary commands via a file name or directory name that contains shell metacharacters...

CVE-2023-28617

org-babel-execute:latex in ob-latex.el in Org Mode through 9.6.1 for GNU Emacs allows attackers to execute arbitrary commands via a file name or directory name that contains shell metacharacters...

PT-2023-21850

Name of the Vulnerable Software and Affected Versions Org Mode versions through 9.6.1 Description The issue allows attackers to execute arbitrary commands via a file name or directory name that contains shell metacharacters. This is possible due to a flaw in the org-babel-execute:latex function i...

Tenda AX3 Command Injection Vulnerability (CNVD-2023-21670)

The Tenda Ax3 is an Ax1800 Gigabit Port Dual Band Wifi 6 Wireless Router from Tenda China. Tenda AX3 V16.03.12.11 suffers from a command injection vulnerability that stems from the lanip parameter of /goform/AdvSetLanip failing to correctly filter constructed command special characters, commands,...

PT-2023-19731

Name of the Vulnerable Software and Affected Versions VX Search versions 13.8 through 14.7 Description The issue allows attackers to execute arbitrary commands at elevated privileges via a crafted executable file, due to an unquoted service path vulnerability. Recommendations For versions 13.8...

CVE-2023-24671: Unquoted Search Path or Element

VX Search v13.8 and v14.7 was discovered to contain an unquoted service path vulnerability which allows attackers to execute arbitrary commands at elevated privileges via a crafted executable file...

CVE-2023-24671

VX Search v13.8 and v14.7 was discovered to contain an unquoted service path vulnerability which allows attackers to execute arbitrary commands at elevated privileges via a crafted executable file...

FortiWeb Command Injection

The vulnerability of FortiWeb web applications’ network firewalls is related to the failure to take measures to neutralize special elements used in the operating system’s command set. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands by sending specially crafted...

debmany utility eval Command Execution

The vulnerability of the eval function in the debmany utility package of the Debian-goodies suite is related to the lack of measures taken to neutralize special elements used in operating system commands when processing .deb files. Exploiting this vulnerability allows an attacker to execute...

CVE-2022-4313: Uncontrolled Search Path Element

A vulnerability was reported where through modifying the scan variables, an authenticated user in Tenable products, that has Scan Policy Configuration roles, could manipulate audit policy variables to execute arbitrary commands on credentialed scan targets...

TP-LINK Archer AX21 command injection vulnerability

TP-Link Archer AX21 AX1800 is a WIFI6 router from TP-Link.TP-Link Archer AX21 AX1800 suffers from a command injection vulnerability, which stems from unfiltered user input and can be exploited by attackers to construct malicious requests to execute arbitrary commands...

Tenda AX3 command injection vulnerability

The Tenda Ax3 is an Ax1800 Gigabit Port Dual Band Wifi 6 Wireless Router from Tenda China. Tenda AX3 V16.03.12.11 suffers from a command injection vulnerability that stems from the lanip parameter of /goform/AdvSetLanip failing to correctly filter constructed command special characters, commands,...

CVE-2023-0628

Docker Desktop before 4.17.0 allows an attacker to execute an arbitrary command inside a Dev Environments container during initialization by tricking a user to open a crafted malicious docker-desktop:// URL...

Design/Logic Flaw

Docker Desktop before 4.17.0 allows an attacker to execute an arbitrary command inside a Dev Environments container during initialization by tricking a user to open a crafted malicious docker-desktop:// URL...

CVE-2023-0628 Docker Desktop before 4.17.0 allows an attacker to execute an arbitrary command inside a Dev Environments container during initialization by tricking a user to open a crafted malicious docker-desktop:// URL

Docker Desktop before 4.17.0 allows an attacker to execute an arbitrary command inside a Dev Environments container during initialization by tricking a user to open a crafted malicious docker-desktop:// URL...

CVE-2023-0628

Docker Desktop before 4.17.0 is affected by an issue where an attacker can execute arbitrary commands inside a Dev Environments container during initialization by convincing a user to open a crafted docker-desktop:// URL. Affected product: Docker Desktop (Dev Environments container). Root cause i...