CVE-2023-28700 ITPison OMICARD EDM - Arbitrary File Upload

OMICARD EDM backend system’s file uploading function does not restrict upload of file with dangerous type. A local area network attacker with administrator privileges can exploit this vulnerability to upload and run arbitrary executable files to perform arbitrary system commands or disrupt servic...

CVE-2023-28701 ELITE Web Fax - SQL Injection

ELITE TECHNOLOGY CORP. Web Fax has a vulnerability of SQL Injection. An unauthenticated remote attacker can inject SQL commands into the input field of the login page to perform arbitrary system commands, disrupt service or terminate service...

CVE-2023-28700: Unrestricted Upload of File with Dangerous Type

OMICARD EDM backend system’s file uploading function does not restrict upload of file with dangerous type. A local area network attacker with administrator privileges can exploit this vulnerability to upload and run arbitrary executable files to perform arbitrary system commands or disrupt servic...

CVE-2023-20852

aEnrich Technology a+HRD has a vulnerability of Deserialization of Untrusted Data within its MSMQ interpreter. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary system commands to perform arbitrary system operation or disrupt service...

Deserialization of untrusted data

aEnrich Technology a+HRD has a vulnerability of Deserialization of Untrusted Data within its MSMQ asynchronized message process. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary system commands to perform arbitrary system operation or disrupt service...

CVE-2023-20852

CVE-2023-20852 affects aEnrich Technology a+HRD, where Deserialization of Untrusted Data occurs in the MSMQ interpreter. The vulnerability allows an unauthenticated, remote attacker to execute arbitrary system commands, potentially taking arbitrary system operations or disrupting service. The CVS...

CVE-2023-20853: Deserialization of Untrusted Data

aEnrich Technology a+HRD has a vulnerability of Deserialization of Untrusted Data within its MSMQ asynchronized message process. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary system commands to perform arbitrary system operation or disrupt service...

CVE-2023-20853 aEnrich a+HRD - Deserialization of Untrusted Data

aEnrich Technology a+HRD has a vulnerability of Deserialization of Untrusted Data within its MSMQ asynchronized message process. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary system commands to perform arbitrary system operation or disrupt service...

CVE-2023-20853

The CVE-2023-20853 entry concerns aDeserialization of Untrusted Data in the aEnrich Technology a+HRD MSMQ asynchronous message processing. An unauthenticated remote attacker could trigger arbitrary command execution and disrupt services via deserialization of untrusted data. Affected component: M...

CVE-2023-20852: Deserialization of Untrusted Data

aEnrich Technology a+HRD has a vulnerability of Deserialization of Untrusted Data within its MSMQ interpreter. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary system commands to perform arbitrary system operation or disrupt service...

Panasonic AiSEG2 操作系统命令注入漏洞

Panasonic AiSEG2 is a series of home IoT products from Panasonic Corporation Panasonic of Japan. A security vulnerability exists in Panasonic AiSEG2 version 2.80F through 2.93A. An attacker could exploit the vulnerability to execute arbitrary operating system commands...

CVE-2023-24837

CVE-2023-24837 describes a command-injection flaw in HGiga PowerStation’s remote management function. Insufficient input filtering lets an authenticated remote user with general privileges inject and execute arbitrary system commands, potentially taking arbitrary system actions or disrupting serv...

Internet Bug Bounty: RCE vulnerability in apache-airflow-providers-apache-sqoop 3.1.0

A remote code execution vulnerability was found in the Apache Airflow Sqoop Provider before version 3.1.1, due to improper input validation in the libjars parameter, allowing attackers to execute arbitrary system commands on the machine performing the MR task...

K06024431: BIG-IQ vulnerability CVE-2021-23024

Security Advisory Description The BIG-IQ Configuration utility has an authenticated remote command execution vulnerability in undisclosed pages. CVE-2021-23024 Impact This vulnerability allows an authenticated admin user or a user account assigned with an administrator role and no shell access to...

K55580033: iControl REST vulnerability CVE-2022-35728

Security Advisory Description An authenticated user's iControl REST token may remain valid for a limited time after logging out from the Configuration utility. CVE-2022-35728 Impact A remote unauthenticated attacker may be able to reuse, for a limited time, an authenticated user's iControl REST...

Exploit for Server-Side Request Forgery in F5 Big-Ip_Access_Policy_Manager

CVE-2021-22986 This vulnerability allows for unauthenticated...

CVE-2022-43483: Improper Neutralization of Special Elements used in an OS Command

Sewio’s Real-Time Location System RTLS Studio version 2.0.0 up to and including version 2.6.2 does not properly validate the input module name to the monitor services of the software. This could allow a remote attacker to access sensitive functions of the application and execute arbitrary system...

CVE-2022-46304

ChangingTec ServiSign component has insufficient filtering for special characters in the connection response parameter. An unauthenticated remote attacker can host a malicious website for the component user to access, which triggers command injection and allows the attacker to execute arbitrary...

Realtek GPON router 安全漏洞

The Realtek GPON router is a series of routers from China-based Realtek Semiconductor Realtek. A security vulnerability exists in the Realtek GPON router, which stems from an insufficient filtering of special characters that could allow a remote attacker with administrator privileges to perform a...

Zoom Client for Meetings < 5.2.0 Vulnerability (ZSB-21005)

The version of Zoom Client for Meetings installed on the remote host is prior to 5.2.0. It is, therefore, affected by a vulnerability as referenced in the ZSB-21005 advisory. - It was discovered that the installation packages of the Zoom Client for Meetings for macOS Standard and for IT Admin...