Siemens SINEC NMS Command Injection Vulnerability

SINEC NMS is a new generation network management system NMS for digital enterprises. Siemens SINEC NMS suffers from an operating system command injection vulnerability that can be exploited by an attacker to execute arbitrary commands on the system...

CVE-2023-24332

CVE-2023-24332 describes a stack overflow in the Tenda AC6 router. Affected device: Tenda AC6 with firmware US_AC6V5.0re_V03.03.02.01_cn_TDC01. The vulnerability can be triggered by a crafted POST request to /goform/PowerSaveSet, potentially allowing an attacker to run arbitrary commands. The con...

CVE-2023-51828

A SQL Injection vulnerability in /admin/convert/export.class.php in PMB 7.4.7 and earlier versions allows remote unauthenticated attackers to execute arbitrary SQL commands via the query parameter in getnextnotice function...

CVE-2023-52155

A SQL Injection vulnerability in /admin/sauvegarde/run.php in PMB 7.4.7 and earlier allows remote authenticated attackers to execute arbitrary SQL commands via the sauvegardes variable through the /admin/sauvegarde/run.php endpoint...

CVE-2023-24333

CVE-2023-24333 concerns a stack overflow in the Tenda AC21 router firmware US_AC21V1.0re_V16.03.08.15_cn_TDC01 that permits arbitrary command execution via a crafted POST to /goform/openSchedWifi. Affected component is the device firmware; root cause is a stack overflow in the handling of the ope...

CVE-2023-24331

Command Injection vulnerability in D-Link Dir 816 with firmware version DIR-816A2v1.10CNB04 allows attackers to run arbitrary commands via the urlAdd parameter...

CVE-2023-24334

A stack overflow vulnerability in Tenda AC23 with firmware version USAC23V1.0reV16.03.07.45cnTDC01 allows attackers to run arbitrary commands via schedStartTime parameter...

CVE-2023-24332

A stack overflow vulnerability in Tenda AC6 with firmware version USAC6V5.0reV03.03.02.01cnTDC01 allows attackers to run arbitrary commands via crafted POST request to /goform/PowerSaveSet...

Deserialization of untrusted data

Torrentpier version 2.4.1 allows executing arbitrary commands on the server. This is possible because the application is vulnerable to insecure deserialization...

Command injection

Loomio version 2.22.0 allows executing arbitrary commands on the server. This is possible because the application is vulnerable to OS Command Injection...

PT-2024-20937 · Mrcms · Mrcms

Name of the Vulnerable Software and Affected Versions: MRCMS version 3.1.2 Description: The issue allows attackers to run arbitrary system commands via the status parameter, potentially leading to unauthorized access and control. Recommendations: For MRCMS version 3.1.2, avoid using the status...

The vulnerability of the microprogramming software of Osprey Pump Controller allows a intruder to execute arbitrary commands.

The vulnerability of Microprogrammed Software in Osprey Pump Controller controllers relates to the manipulation of inter-site requests. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands using specially crafted HTTP requests...

CVE-2024-25428

SQL Injection vulnerability in MRCMS v3.1.2 allows attackers to run arbitrary system commands via the status parameter...

MRCMS Security Vulnerabilities

MRCMS is a content management system by markers personal developer. A security vulnerability exists in MRCMS v3.1.2. The vulnerability can be exploited to execute arbitrary system commands via the status parameter...

SUSE SLES15 Security Update : libssh (SUSE-SU-2024:0525-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:0525-1 advisory. Update to version 0.9.8 jscPED-7719: Fix CVE-2023-6004: Command injection using proxycommand bsc1218209 Fix CVE-2023-48795: Potenti...

CVE-2024-1651 Torrentpier 2.4.1 - RCE

Torrentpier version 2.4.1 allows executing arbitrary commands on the server. This is possible because the application is vulnerable to insecure deserialization...

CVE-2024-1651 Torrentpier 2.4.1 - RCE

Torrentpier version 2.4.1 allows executing arbitrary commands on the server. This is possible because the application is vulnerable to insecure deserialization...

CVE-2024-1651

CVE-2024-1651 affects Torrentpier 2.4.1. The root cause is insecure deserialization, allowing arbitrary commands to be executed on the server (Remote Code Execution). Multiple connected sources provide a concrete exploit presence via PoC code on GitHub, and descriptions confirm the vulnerability ...

The vulnerability of the Inter-Device Communication component of Cisco Firepower Threat Defense’s microprogramming software and Cisco Firepower Management Center’s network management software allows a attacker to execute arbitrary commands with root privileges.

The vulnerability of the Inter-Device Communication component of Cisco Firepower Threat Defense’s microprogramming-based network interface controllers, as well as the Cisco Firepower Management Center’s network management software, is related to improper code generation. Exploiting this...

Dell Unity Command Injection Vulnerability (CNVD-2024-09160)

Dell Unity is a unified hybrid storage array for general purpose workloads both locally and in the cloud. A command injection vulnerability exists in Dell Unity, which can be exploited by a local attacker to escape a restricted shell and execute arbitrary OS commands with root privileges...