Command injection

Command injection vulnerability in RaspAP raspap-webgui 2.8.8 and earlier allows remote attackers to run arbitrary commands via crafted POST request to hostapd settings form...

SPIP password reset serialization vulnerability

Added: 06/23/2023 Background SPIP is a web-based publishing system written in PHP. Problem Mishandling of serialized data in SPIP's password reset form allows remote attackers to execute arbitrary commands. Resolution Upgrade to SPIP 3.2.18, 4.0.10, 4.1.8, 4.2.1 or higher. References...

CVE-2023-30260

CVE-2023-30260 affects RaspAP raspap-webgui (versions up to 2.8.8). The root cause is a command injection via a crafted POST to the hostapd settings form, enabling remote execution of arbitrary commands. Documented impact is high (C, I, A) with network attack vector and low privileges. Some conne...

CVE-2023-30258

Command Injection vulnerability in MagnusSolution magnusbilling 6.x and 7.x allows remote attackers to run arbitrary commands via unauthenticated HTTP request...

CVE-2023-30260

Command injection vulnerability in RaspAP raspap-webgui 2.8.8 and earlier allows remote attackers to run arbitrary commands via crafted POST request to hostapd settings form...

Barracuda Email Security Gateway < 9.2.0.008 Command Injection (CVE-2023-2868)

According to its self-reported version, the Barracuda Email Security Gateway on the remote web server is 9.2.0.008. It is, therefore, affected by a command injection vulnerability in the processing of .tar files that could allow a remote, unauthenticated attacker to execute arbitrary commands wit...

CVE-2023-30258

CVE-2023-30258 affects MagnusBilling magnusbilling 6.x and 7.x with an unauthenticated remote command injection in lib/icepay/icepay.php via the democ parameter. An attacker can craft a request to run arbitrary OS commands, enabling full system compromise as indicated by connected templates and e...

SPIP password reset serialization vulnerability

Added: 06/23/2023 Background SPIP is a web-based publishing system written in PHP. Problem Mishandling of serialized data in SPIP's password reset form allows remote attackers to execute arbitrary commands. Resolution Upgrade to SPIP 3.2.18, 4.0.10, 4.1.8, 4.2.1 or higher. References...

CVE-2022-45287

An access control issue in Registration.aspx of Temenos CWX 8.5.6 allows authenticated attackers to escalate privileges and perform arbitrary Administrative commands...

Command injection

An access control issue in Registration.aspx of Temenos CWX 8.5.6 allows authenticated attackers to escalate privileges and perform arbitrary Administrative commands...

SPIP 4.2.1 Remote Code Execution

!/usr/bin/env python3 -- coding: utf-8 -- Exploit Title: SPIP v4.2.1 - Remote Code Execution Unauthenticated Google Dork: inurl:"/spip.php?page=login" Date: 19/06/2023 Exploit Author: nuts7 https://github.com/nuts7/CVE-2023-27372 Vendor Homepage: https://www.spip.net/ Software Link:...

The vulnerability of the network and application monitoring tool used by VMware Aria Operations for Networks (previously known as vRealize Network Insight) lies in the lack of measures for data cleaning at the management level. This allows a malicious actor to gain unauthorized access to protected information and execute arbitrary commands.

The vulnerability of the network and application monitoring tool, VMware Aria Operations for Networks previously vRealize Network Insight, is related to the lack of measures for data cleaning at the management level. Exploiting this vulnerability could allow a malicious actor to gain unauthorized...

SystemK NVR 504/508/516 Command Injection

Exploit Title: SystemK NVR 504/508/516 Command Injection Exploit Author: Keniver Wang Publish Date: 19/06/2023 Date of found: 20/01/2021 Vendor: SystemK Vendor Homepage: https://nvr.bz/ Version: NVR 504/508/516 2.3.5SK.30084998 Greets: Weber Tsai CHT Security Description A Command Injection...

CVE-2023-32752 L7 Networks InstantScan & InstantQoS - Arbitrary File Upload

L7 Networks InstantScan IS-8000 & InstantQoS IQ-8000’s file uploading function does not restrict upload of file with dangerous type. An unauthenticated remote attacker can exploit this vulnerability to upload and run arbitrary executable files to perform arbitrary system commands or disrupt servi...

The vulnerability of the GPON-terminal software of Tenda G103, related to the lack of measures for cleaning input data, allows a intruder to enhance their privileges and execute arbitrary commands.

The vulnerability of the GPON-terminal software of Tenda G103 is related to the lack of measures for cleaning incoming data. Exploiting this vulnerability can allow a remote attacker to enhance their privileges and execute arbitrary commands...

CVE-2022-21235

A flaw was found in the VCS package, caused by improper validation of user-supplied input. By using a specially-crafted argument, a remote attacker could execute arbitrary commands on the system...

CVE-2022-32752

IBM Security Directory Suite VA 8.0.1 through 8.0.1.19 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-Force ID: 228439...

Design/Logic Flaw

IBM Security Directory Suite VA 8.0.1 through 8.0.1.19 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-Force ID: 228439...

CVE-2022-32752 IBM Security Directory Suite VA command execution

IBM Security Directory Suite VA 8.0.1 through 8.0.1.19 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-Force ID: 228439...

CVE-2022-32752

CVE-2022-32752 affects IBM Security Directory Suite VA 8.0.1 through 8.0.1.19. A remote authenticated attacker can execute arbitrary commands on the system by sending a specially crafted request. IBM’s advisory and related sources identify the affected product and provide a fix: update to IBM Sec...