Satel Iberia SenNet Data Logger And Electricity Meters Command Injection

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Satel Iberia SenNet Data Logger and Electricity Meters Command Injection Vulnerability', 'Description' = %q This module exploits an OS Command...

CVE-2024-44717

CVE-2024-44717 is an XSS vulnerability affecting DedeBIZ v6.3.0 , where a crafted payload can cause arbitrary web scripts or HTML execution. Connected documents corroborate the issue across Red Hat, NVD, CNNVD, CVE listing, and enrichment sources, all referencing the same product/version. The ava...

CVE-2024-7110

CVE-2024-7110 affects GitLab EE, spanning all versions 17.0–17.1.6, 17.2 before 17.2.4, and 17.3 before 17.3.1. The issue allows an attacker to execute arbitrary commands in a victim’s pipeline via prompt injection. The available connected documents consistently describe the vulnerability as a co...

CVE-2024-7263 Arbitrary Code Execution in WPS Office

Improper path validation in promecefpluginhost.exe in Kingsoft WPS Office version ranging from 12.2.0.13110 to 12.2.0.17115 exclusive on Windows allows an attacker to load an arbitrary Windows library. The patch released in version 12.1.0.17119 to mitigate CVE-2024-7262 was not restrictive enough...

TOTOLINK X5000R setWiFiWpsCfg Method Command Injection Vulnerability

The TOTOLINK X5000R is a router from China's Gion Electronics TOTOLINK. A command injection vulnerability exists in TOTOLINK X5000R version v9.1.0cu.2350b20230313. The vulnerability stems from the setWiFiWpsCfg method of /cgi-bin/cstecgi.cgi failing to properly filter constructed command special...

TOTOLINK X5000R 操作系统命令注入漏洞

The TOTOLINK X5000R is a router from China's Gion Electronics TOTOLINK. A command injection vulnerability exists in TOTOLINK X5000R version v9.1.0cu.2350b20230313. The vulnerability stems from the setUPnPCfg method of /cgi-bin/cstecgi.cgi failing to properly filter constructed command special...

CVE-2024-29831 Apache DolphinScheduler: RCE by arbitrary js execution

Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server. If you are using the switch task plugin, please upgrade to version 3.2.2...

CVE-2024-41237

A SQL injection vulnerability in /smsa/teacherlogin.php in Kashipara Responsive School Management System v1.0 allows an attacker to execute arbitrary SQL commands via the "username" parameter...

CVE-2024-34021

Unrestricted upload of file with dangerous type vulnerability exists in ELECOM wireless LAN routers. A specially crafted file may be uploaded to the affected product by a logged-in user with an administrative privilege, resulting in an arbitrary OS command execution...

The vulnerability of Microprogrammed Software for FutureNet NXR, FutureNet VXR, and FutureNet WXR arises from the lack of measures taken to neutralize special elements used in the operating system’s command set. This allows attackers to gain unauthorized access to protected information, execute arbitrary commands, or cause service failures.

The vulnerability of the microprogrammed software of FutureNet NXR, FutureNet VXR, and FutureNet WXR is related to the lack of measures taken to neutralize special elements used in the operating system commands. Exploiting this vulnerability can allow an attacker, operating remotely, to gain...

Apple macOS ramrod arbitrary argv[0] execution vulnerability

Talos Vulnerability Report TALOS-2024-2010 Apple macOS ramrod arbitrary argv0 execution vulnerability July 30, 2024 CVE Number CVE-2024-40800 SUMMARY An arbitrary argv0 execution vulnerability exists in the ramrod binary of Apple macOS version 14.5 23F79 x8664. An attacker can inject an arbitrary...

SiberianCMS SQL注入漏洞

SiberianCMS is an enterprise-level content management system that offers a variety of features for creating and managing web content. SiberianCMS suffers from a SQL injection vulnerability that originates from the system failing to properly neutralize special elements in SQL commands. The...

CVE-2024-6881

CVE-2024-6881 concerns a stored XSS in M-Files Hubshare prior to version 5.0.6.0 . The issue allows an authenticated attacker to execute arbitrary JavaScript in a user’s browser session. Affected component is the Hubshare web interface; root cause is a stored XSS condition in the application flow...

SKYSEA Client View 安全漏洞

SKYSEA Client View is a software from SKYSEA Japan that supports information leakage countermeasures and IT operations management. A security vulnerability exists in SKYSEA Client View versions 15.200.13i through 19.210.04e, which stems from a path traversal vulnerability that could allow an...

CVE-2024-7047 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

A cross site scripting vulnerability exists in GitLab CE/EE affecting all versions from 16.6 prior to 17.0.5, 17.1 prior to 17.1.3, 17.2 prior to 17.2.1 allowing an attacker to execute arbitrary scripts under the context of the current logged in user...

CVE-2024-26020

An arbitrary script execution vulnerability exists in the MPV functionality of Ankitects Anki 24.04. A specially crafted flashcard can lead to a arbitrary code execution. An attacker can send malicious flashcard to trigger this vulnerability...

CVE-2024-26020

CVE-2024-26020 : The vulnerability affects Ankitects Anki 24.04, where the MPV functionality in flashcards processes user-supplied content and can trigger arbitrary code execution via a crafted flashcard. Multiple connected sources corroborate exploitation potential and assign high/critical impac...

OS Command Injection

Nuclei is vulnerable to OS Command Injection. The vulnerability is due to the -code option in code templates, allowing users to edit and execute workflow files in some web applications, leading to arbitrary command execution...

CVE-2024-6542 Livestatus injection in mknotifyd

Improper neutralization of livestatus command delimiters in mknotifyd in Checkmk = 2.0.0p39, 2.1.0p47, 2.2.0p32 and 2.3.0p11 allows arbitrary livestatus command execution...

TOTOLINK A6000R 安全漏洞

TOTOLINK A6000R is a wireless router from China's Gion Electronics TOTOLINK. The TOTOLINK A6000R suffers from a command injection vulnerability that stems from the ifname parameter in the apclidoenrpinwps function failing to properly filter construct command special characters, commands, and so o...