3049 matches found
CVE-2022-47555
CVE-2022-47555 affects Ormazabal ekorCCP and ekorRCI and is described as an operating system command injection. Multiple sources confirm an authenticated attacker could execute commands, create users with elevated privileges, or backdoor the system. The NVD metrics show a high/critical impact (CV...
CVE-2023-40933: Improper Neutralization of Special Elements used in an SQL Command
A SQL injection vulnerability in Nagios XI v5.11.1 and below allows authenticated attackers with announcement banner configuration privileges to execute arbitrary SQL commands via the ID parameter sent to the updatebannermessage function...
CVE-2023-40931: Improper Neutralization of Special Elements used in an SQL Command
A SQL injection vulnerability in Nagios XI from version 5.11.0 up to and including 5.11.1 allows authenticated attackers to execute arbitrary SQL commands via the ID parameter in the POST request to /nagiosxi/admin/bannermessage-ajaxhelper.php...
CVE-2022-47555: Improper Neutralization of Special Elements used in an OS Command
Operating system command injection in ekorCCP and ekorRCI, which could allow an authenticated attacker to execute commands, create new users with elevated privileges or set up a backdoor...
Arbitrary file listing and deletion through the CLI
...
CVE-2023-4890: Improper Neutralization of Input During Web Page Generation
The JQuery Accordion Menu Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dcwp-jquery-accordion' shortcode in versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...
CVE-2023-39780: Improper Neutralization of Special Elements used in an OS Command
On ASUS RT-AX55 3.0.0.4.386.51598 devices, authenticated attackers can perform OS command injection via the /startapply.htm qosbwrulelist parameter. NOTE: for the similar "token-generated module" issue, see CVE-2023-41345; for the similar "token-refresh module" issue, see CVE-2023-41346; for the...
CVE-2021-40698: Use of Inherently Dangerous Function
ColdFusion version 2021 update 1 and earlier and versions 2018.10 and earlier are impacted by an Use of Inherently Dangerous Function vulnerability that can lead to a security feature bypass . An authenticated attacker could leverage this vulnerability to access and manipulate arbitrary data on...
PT-2023-4964 · Cisco · Cisco Small Business Rv130W +3
Name of the Vulnerable Software and Affected Versions: Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers affected versions not specified Description: A vulnerability in the web-based management interface could allow an authenticated, remote attacker to execute arbitrary code on an...
CVE-2023-40535
Stored cross-site scripting vulnerability in View setting page of VI Web Client prior to 7.9.6 allows a remote authenticated attacker to inject an arbitrary script...
CVE-2023-4718 Font Awesome 4 Menus <= 4.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The Font Awesome 4 Menus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fa' and 'fa-stack' shortcodes in versions up to, and including, 4.7.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticate...
CVE-2023-23772: Improper Verification of Cryptographic Signature
Motorola MBTS Site Controller fails to check firmware update authenticity. The Motorola MBTS Site Controller lacks cryptographic signature validation for firmware update packages, allowing an authenticated attacker to gain arbitrary code execution, extract secret key material, and/or leave a...
CVE-2023-25649: Improper Neutralization of Special Elements used in a Command
There is a command injection vulnerability in a mobile internet product of ZTE. Due to insufficient validation of SETDEVICELED interface parameter, an authenticated attacker could use the vulnerability to execute arbitrary commands...
CVE-2023-25914: Improper Limitation of a Pathname to a Restricted Directory
Due to improper restriction, authenticated attackers could retrieve and read system files of the underlying server through the XML interface. The information that can be read can lead to a full system compromise...
CVE-2023-25915: Improper Input Validation
Due to improper input validation, an authenticated remote attacker could execute arbitrary commands on the target system...
Atlos 安全漏洞
Atlos is an Atlos open source, non-profit platform used by investigators for large-scale cataloging and verification of eyewitness media. A security vulnerability exists in Atlos version v.1.0 that stems from a vulnerability that allows an authenticated attacker to execute arbitrary code in the...
CVE-2023-38843
An issue in Atlos v.1.0 allows an authenticated attacker to execute arbitrary code via a crafted payload into the description field in the incident function...
CVE-2023-38843: Improper Neutralization of Formula Elements in a CSV File
An issue in Atlos v.1.0 allows an authenticated attacker to execute arbitrary code via a crafted payload into the description field in the incident function...
