CVE-2023-22326

In BIG-IP versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.8.1, 14.1.x before 14.1.5.3, and all versions of 13.1.x, and all versions of BIG-IQ 8.x and 7.1.x, incorrect permission assignment vulnerabilities exist in the iControl REST and TMOS shell tmsh dig command which...

CVE-2023-20023

Multiple vulnerabilities in specific Cisco Identity Services Engine ISE CLI commands could allow an authenticated, local attacker to perform command injection attacks on the underlying operating system and elevate privileges to root. To exploit these vulnerabilities, an attacker must have valid...

PT-2023-14664

Name of the Vulnerable Software and Affected Versions IdentityIQ versions 8.3 through 8.3p1 IdentityIQ versions 8.2 through 8.2p4 IdentityIQ versions 8.1 through 8.1p6 IdentityIQ versions 8.0 through 8.0p5 IdentityIQ versions prior to 8.0 Description The issue allows authenticated users assigned...

PT-2023-7452 · Zyxel · Zyxel Vpn +1

Name of the Vulnerable Software and Affected Versions: Zyxel USG FLEX series firmware versions 4.50 through 5.35 Zyxel VPN series firmware versions 4.30 through 5.35 Description: A path traversal vulnerability in the account print.cgi CGI program could allow a remote authenticated attacker with...

CVE-2022-43970

A buffer overflow vulnerability exists in Linksys WRT54GL Wireless-G Broadband Router with firmware = 4.30.18.006. A stack-based buffer overflow in the StartEPI function within the httpd binary allows an authenticated attacker with administrator privileges to execute arbitrary commands on the...

PT-2023-14413 · Linksys · Linksys Wumc710 Wireless-Ac Universal Media Connector

Name of the Vulnerable Software and Affected Versions: Linksys WUMC710 Wireless-AC Universal Media Connector version 1.0.02 build3 and earlier Description: An arbitrary code execution issue exists due to the do setNTP function within the httpd binary using unvalidated user input in the constructi...

WordPress plugin Swifty Page Manager 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

CVE-2022-40740

Realtek GPON router has insufficient filtering for special characters. A remote attacker authenticated as an administrator can exploit this vulnerability to perform command injection attacks, to execute arbitrary system command, manipulate system or disrupt service...

PT-2023-13901 · Realtek · Realtek Gpon Router

Name of the Vulnerable Software and Affected Versions: Realtek GPON router affected versions not specified Description: The issue is related to insufficient filtering for special characters in the Realtek GPON router. A remote attacker, who is authenticated as an administrator, can exploit this t...

CVE-2022-25627

An authenticated administrator who has physical access to the environment can carry out Remote Command Execution on Management Console in Symantec Identity Manager 14.4...

Command injection

An authenticated administrator who has physical access to the environment can carry out Remote Command Execution on Management Console in Symantec Identity Manager 14.4...

PT-2022-17419 · Symantec · Symantec Identity Manager

Name of the Vulnerable Software and Affected Versions: Symantec Identity Manager version 14.4 Description: An authenticated administrator with physical access to the environment can execute remote commands on the Management Console. This issue affects the Management Console component...

CVE-2022-25627

An authenticated administrator who has physical access to the environment can carry out Remote Command Execution on Management Console in Symantec Identity Manager 14.4...

PT-2022-20895 · Vmware · Vmware Workspace One Access +1

Name of the Vulnerable Software and Affected Versions: VMware Workspace ONE Access and Identity Manager affected versions not specified Description: The issue is an authenticated remote code execution vulnerability. It has been evaluated to be in the Important severity range. The vulnerability ca...

CVE-2022-41800

In all versions of BIG-IP, when running in Appliance mode, an authenticated user assigned the Administrator role may be able to bypass Appliance mode restrictions, utilizing an undisclosed iControl REST endpoint. A successful exploit can allow the attacker to cross a security boundary. Note:...

Zimbra Collaboration Suite 代码问题漏洞

Zimbra Collaboration Suite ZCS is an open source collaboration suite from Synacor, USA. The product includes WebMail, Calendar, Address Book and more. A code issue vulnerability exists in Zimbra Collaboration Suite versions 8.8.15 and 9.0, which originates from an authenticated administrator user...

CVE-2022-38802

Zkteco BioTime 8.5.3 Build:20200816.447 is vulnerable to Incorrect Access Control via resign, private message, manual log, time interval, attshift, and holiday. An authenticated administrator can read local files by exploiting XSS into a pdf generator when exporting data as a PDF...

CVE-2022-38802

Zkteco BioTime 8.5.3 Build:20200816.447 is vulnerable to Incorrect Access Control via resign, private message, manual log, time interval, attshift, and holiday. An authenticated administrator can read local files by exploiting XSS into a pdf generator when exporting data as a PDF...

CVE-2022-38802

Zkteco BioTime 8.5.3 Build:20200816.447 is vulnerable to Incorrect Access Control via resign, private message, manual log, time interval, attshift, and holiday. An authenticated administrator can read local files by exploiting XSS into a pdf generator when exporting data as a PDF...

Zkteco BioTime 跨站脚本漏洞

Zkteco BioTime is a powerful web-based time and attendance management software from the Chinese company Zkteco. A security vulnerability exists in Zkteco BioTime versions prior to 8.5.4, which stems from vulnerability to incorrect access control, where an authenticated administrator can read a...