CVE-2024-41714

A command injection vulnerability exists in the Web Interface component of Mitel MiCollab (through 9.8 SP1/9.8.1.5) and MiVoice Business Solution Virtual Instance (MiVB SVI) (through 1.0.0.27). The root cause is insufficient parameter sanitization , which could allow an authenticated attacker to ...

CVE-2024-35287: Incorrect Default Permissions

A vulnerability in the NuPoint Messenger NPM component of Mitel MiCollab through version 9.8 SP1 9.8.1.5 could allow an authenticated attacker with administrative privilege to conduct a privilege escalation attack due to the execution of a resource with unnecessary privileges. A successful exploi...

CVE-2024-35287

A vulnerability in the NuPoint Messenger NPM component of Mitel MiCollab through version 9.8 SP1 9.8.1.5 could allow an authenticated attacker with administrative privilege to conduct a privilege escalation attack due to the execution of a resource with unnecessary privileges. A successful exploi...

CVE-2024-41712

A vulnerability in the Web Conferencing Component of Mitel MiCollab through 9.8.1.5 could allow an authenticated attacker to conduct a command injection attack, due to insufficient validation of user input. A successful exploit could allow an attacker to execute arbitrary commands on the system...

CVE-2024-48509

Learning with Texts LWT 2.0.3 is vulnerable to SQL Injection. This occurs when the application fails to properly sanitize user inputs, allowing attackers to manipulate SQL queries by injecting malicious SQL statements into URL parameters. By exploiting this vulnerability, an attacker could gain...

CVE-2024-48509

CVE-2024-48509 affects Learning with Texts (LWT) 2.0.3. Multiple sources describe a SQL Injection vulnerability caused by inadequate input sanitization in URL parameters, enabling an attacker to manipulate queries and potentially access, modify, or delete data and execute arbitrary commands. The ...

CVE-2024-35287

A privilege escalation vulnerability exists in the NuPoint Messenger (NPM) component of Mitel MiCollab through version 9.8 SP1 (9.8.1.5) . The root cause is identified as insufficient access control and the execution of a resource with unnecessary privileges. An authenticated attacker with admini...

CVE-2024-35287

A vulnerability in the NuPoint Messenger NPM component of Mitel MiCollab through version 9.8 SP1 9.8.1.5 could allow an authenticated attacker with administrative privilege to conduct a privilege escalation attack due to the execution of a resource with unnecessary privileges. A successful exploi...

CVE-2024-41712: Improper Control of Generation of Code

A vulnerability in the Web Conferencing Component of Mitel MiCollab through 9.8.1.5 could allow an authenticated attacker to conduct a command injection attack, due to insufficient validation of user input. A successful exploit could allow an attacker to execute arbitrary commands on the system...

Cisco NX-OS Protection Mechanism Failure (CVE-2024-20284)

A vulnerability in the Python interpreter of Cisco NX-OS Software could allow an authenticated, low-privileged, local attacker to escape the Python sandbox and gain unauthorized access to the underlying operating system of the device. The vulnerability is due to insufficient validation of...

Advantech ADAM-5630 Authentication Bypass Command Injection

The vulnerability of the microprogrammed logic controller PLC Advantech ADAM-5630 software is related to the absence of authentication for the critical function. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands and cause malfunctions in the system...

CVE-2023-26785

Disputed A flaw was found in MariaDB. This flaw allows a remote attacker to use a specially crafted payload to execute arbitrary commands in certain configurations. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product...

CVE-2024-27766

Disputed A flaw was found in MariaDB. This flaw allows a remote attacker to use a specially crafted payload to execute arbitrary commands in certain configurations. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product...

Red Hat OpenShift Container Platform Privilege Escalation

The vulnerability of the Red Hat OpenShift Container Platform is related to insecure management of privileges. Exploiting this vulnerability allows a malicious actor to increase their privileges and execute arbitrary commands using a specially created .gitconfig file during cloning processes...

CVE-2023-39593

Insecure permissions in the sysexec function of MariaDB v10.5 allows authenticated attackers to execute arbitrary commands with elevated privileges. NOTE: this is disputed by the MariaDB Foundation because no privilege boundary is crossed...

CVE-2024-48637

D-Link DIR882FW130B06 and DIR878 DIR878FW130B08 were discovered to contain a command injection vulnerability via the VLANID:1/VID parameter in the SetVLANSettings function. This vulnerability allows attackers to execute arbitrary OS commands via a crafted POST request...

Palo Alto Networks Expedition Privilege Escalation Command Injection

The vulnerability of the Palo Alto Networks Expedition configuration migration tool lies in the lack of measures taken to neutralize special elements used in the operating system team. Exploiting this vulnerability allows a malicious actor to increase their privileges and execute arbitrary comman...

CVE-2024-48635

D-Link DIR_882 (dual-band wireless router) and DIR_878 (wireless router) are affected by a command injection vulnerability (CWE-78) within the SetVLANSettings function of the prog.cgi script. The root cause is a failure to neutralize special elements used in operating system commands, specificall...

CVE-2023-39593

MariaDB version 10.5 is vulnerable to a code injection flaw due to insecure permissions in the sys_exec function. This allows authenticated attackers to execute arbitrary commands with elevated privileges. While the MariaDB Foundation disputes the severity because no privilege boundary is crossed...

CVE-2023-39593

Insecure permissions in the sysexec function of MariaDB v10.5 allows authenticated attackers to execute arbitrary commands with elevated privileges. NOTE: this is disputed by the MariaDB Foundation because no privilege boundary is crossed...