9019 matches found
NEC Aterm 安全漏洞
The NEC Aterm is a series of wireless routers from Nippon Electric NEC. A security vulnerability exists in NEC Aterm that originates from allowing an attacker to execute arbitrary commands with root privileges over the Internet. The following products and versions are affected: WG1800HP4,...
Dell vApp Manager 操作系统命令注入漏洞
Dell vApp Manager is a virtual application manager from Dell USA. An operating system command injection vulnerability exists in Dell vApp Manager versions prior to 9.2.4.9, which can be exploited by an attacker to execute arbitrary commands on the system...
CVE-2024-28033
OS command injection vulnerability exists in WebProxy 1.7.8 and 1.7.9, which may allow a remote unauthenticated attacker to execute an arbitrary OS command with the privilege of the running web server. Note that the developer was unreachable, therefore, users should consider stop using WebProxy...
CVE-2024-28033
OS command injection vulnerability exists in WebProxy 1.7.8 and 1.7.9, which may allow a remote unauthenticated attacker to execute an arbitrary OS command with the privilege of the running web server. Note that the developer was unreachable, therefore, users should consider stop using WebProxy...
D-Link DIR-845L Command Injection Vulnerability
The D-Link DIR-845 is a wireless router from China-based AUO D-Link. A command injection vulnerability exists in D-Link DIR-845L v1.01KRb03 and earlier versions, which stems from a failure to properly filter construct command special characters, commands, etc. in cgibin binaries. An attacker can...
Multiple vulnerabilities in home gateway HGW BL1500HM
Overview Home gateway HGW BL1500HM provided by KDDI CORPORATION contains multiple vulnerabilities listed below. Use of weak credentials CWE-1391 - CVE-2024-21865, CVE-2024-29071 Command injection CWE-77 - CVE-2024-28041 Chuya Hayakawa of 00One, Inc. reported these vulnerabilities to JPCERT/CC...
CVE-2024-28041
HGW BL1500HM Ver 002.001.013 and earlier allows a network-adjacent unauthenticated attacker to execute an arbitrary command...
CVE-2024-28041
HGW BL1500HM Ver 002.001.013 and earlier allows a network-adjacent unauthenticated attacker to execute an arbitrary command...
Metasploit Weekly Wrap-Up 03/22/2024
New module content 1 OpenNMS Horizon Authenticated RCE Author: Erik Wynter Type: Exploit Pull request: 18618 contributed by ErikWynter Path: linux/http/opennmshorizonauthenticatedrce AttackerKB reference: CVE-2023-0872 Description: This module exploits built-in functionality in OpenNMS Horizon in...
D-Link DIR-845L 安全漏洞
The D-Link DIR-845 is a wireless router from China-based AUO D-Link. A command injection vulnerability exists in D-Link DIR-845L v1.01KRb03 and earlier versions, which stems from a failure to properly filter construct command special characters, commands, etc. in cgibin binaries. An attacker can...
Tenda AC10 OS Command Injection Vulnerability (CNVD-2024-15743)
The Tenda AC10 is a wireless router from the Chinese company Tenda. Tenda AC10U version 15.03.06.49 suffers from an operating system command injection vulnerability, which originates from the mac parameter of the formWriteFacMac function of the /goform/WriteFacMac file failing to correctly filter...
PT-2024-19418 · Csmock · Csmock
Name of the Vulnerable Software and Affected Versions: csmock affected versions not specified Description: A vulnerability was found in csmock where a regular user of the OSH service, with a valid Kerberos ticket, can disclose the confidential Snyk authentication token and run arbitrary commands ...
CVE-2024-28117
Grav (CVE-2024-28117) is vulnerable to Server-Side Template Injection due to improper validation of accessible functions: Utils::isDangerousFunction checks are bypassed for twig_array_map, allowing an attacker to execute arbitrary commands via the Twig processor when static pages are processed. A...
CVE-2024-28848 SpEL Injection in `GET /api/v1/policies/validation/condition/<expr>` in OpenMetadata
OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration. The CompiledRule::validateExpression method evaluates an SpEL expression using an StandardEvaluationContext, allowing the...
OESA-2024-1293 aops-zeus security update
A host and user manager service which is the foundation of aops. Security Fixes: In aops-zeus software versions 1.2.01.4.1, there is a vulnerability in the plugin management command of the zeus/conf/constant file. Through this vulnerability, an attacker can implant arbitrary commands to be execut...
The vulnerability of the CLI interface of ArubaOS operating systems allows a perpetrator to execute arbitrary commands.
The vulnerability of the CLI interface of ArubaOS operating systems is related to the lack of measures taken to neutralize special elements used in operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...
Security Bulletin: AIX is vulnerable to a machine-in-the-middle attack (CVE-2023-48795), arbitrary command execution (CVE-2023-51385), and information disclosure (CVE-2023-51384) due to OpenSSH
Summary Vulnerabilities in AIX's OpenSSH could allow a remote attacker to launch a machine-in-the-middle attack CVE-2023-48795 and execute arbitrary commands CVE-2023-51385, and could allow a local authenticated attacker to obtain sensitive information CVE-2023-51384. OpenSSH is used by AIX for...
BaserCMS Command Injection Vulnerability (CNVD-2024-13537)
baserCMS is an enterprise-level content management system CMS from the baserCMS team. A command injection vulnerability exists in versions of baserCMS prior to 5.0.9, which stems from a failure to properly filter constructed command special characters, commands, etc. in the site search function. ...
Microsoft Windows Multiple Vulnerabilities (KB5035858)
This host is missing a critical security update according to Microsoft KB5035858 SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...