CVE-2023-29193 SpiceDB binding metrics port to untrusted networks and can leak command-line flags

SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical application permissions. The spicedb serve command contains a flag named --grpc-preshared-key which is used to protect the gRPC API from being accessed by unauthorized requests. The...

CVE-2023-29193 SpiceDB binding metrics port to untrusted networks and can leak command-line flags

SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical application permissions. The spicedb serve command contains a flag named --grpc-preshared-key which is used to protect the gRPC API from being accessed by unauthorized requests. The...

CVE-2023-1863

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Eskom Water Metering Software allows Command Line Execution through SQL Injection. This issue affects Water Metering Software: before 23.04.06...

CVE-2023-1863

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Eskom Water Metering Software allows Command Line Execution through SQL Injection.This issue affects Water Metering Software: before 23.04.06...

Sql injection

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Eskom Water Metering Software allows Command Line Execution through SQL Injection.This issue affects Water Metering Software: before 23.04.06...

CVE-2023-1863 SQLi in Eskom Computer Water Metering Software

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Eskom Water Metering Software allows Command Line Execution through SQL Injection. This issue affects Water Metering Software: before 23.04.06...

CVE-2023-1863: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Eskom Water Metering Software allows Command Line Execution through SQL Injection. This issue affects Water Metering Software: before 23.04.06...

PT-2023-17292

Name of the Vulnerable Software and Affected Versions Eskom Water Metering Software versions prior to 23.04.06 Description The issue is related to an SQL Injection vulnerability, which allows for Command Line Execution through SQL Injection. This is due to the improper neutralization of special...

Lenovo Smart Clock Essential 信任管理问题漏洞

Lenovo Smart Clock Essential is a smart stereo from Chinese company Lenovo Lenovo. Lenovo Smart Clock Essential version 4.9.113 suffers from a Trust Management Issue vulnerability that stems from the presence of a hard-coded password vulnerability, which can be exploited by an attacker to enhance...

Fedora: Security Advisory for skopeo (FEDORA-2023-28c182b657)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

The vulnerability of the command-line interface (CLI) of Cisco Aironet Access Point microprogramming software allows a attacker to execute arbitrary commands with root privileges.

The vulnerability of the command-line interface CLI of Cisco Aironet Access Point software exists because measures to neutralize special elements used in operating system commands have not been taken. Exploiting this vulnerability allows an attacker to execute arbitrary commands with root...

Jenkins: Temporary file parameter created with insecure permissions

A flaw was found in Jenkins. When triggering a build from the Jenkins CLI, Jenkins creates a temporary file on the controller if a file parameter is provided through the CLI’s standard input. Affected versions of Jenkins create this temporary file in the default temporary directory with the defau...

New Cylance Ransomware Targets Linux and Windows Operating Systems

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary Cylance ransomware is a new malware that is capable of adjusting to customized encryption tactics and can accept different command-line parameters. To receive real-time threat advisories, please follow...

PT-2023-2397 · Microsoft · Sql Server

Name of the Vulnerable Software and Affected Versions: Microsoft SQL Server affected versions not specified Description: The issue is related to a buffer overflow in memory in the SQLcmd utility of Microsoft SQL Server. This can be exploited by a remote attacker using specially crafted data to...

Siemens SCALANCE Missing Encryption of Sensitive Data (CVE-2021-37731)

A local path traversal vulnerability was discovered in Aruba SD-WAN Software and Gateways; Aruba Operating System Software versions: Prior to 8.6.0.0-2.2.0.4; Prior to 8.7.1.1, 8.6.0.7, 8.5.0.12, 8.3.0.16. Aruba has released patches for Aruba SD-WAN Software and Gateways and ArubaOS that address...

FortiWeb & FortiADC - OS command injection in CLI

An improper neutralization of special elements used in an OS command vulnerability CWE-78 in the command line interpreter of FortiWeb & FortiADC may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments to existing commands...

Siemens SCALANCE W1750D Command Injection (CVE-2022-37893)

An authenticated command injection vulnerability exists in the Aruba InstantOS and ArubaOS 10 command line interface. Successful exploitation of this vulnerability results in the ability to execute arbitrary commands as a privileged user on the underlying operating system of Aruba InstantOS 6.4.x...

The vulnerability of the command-line interface of Cisco IOS XE SD-WAN software allows a attacker to execute arbitrary commands.

The vulnerability of the command-line interface of Cisco IOS XE SD-WAN software exists due to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to execute arbitrary commands...

The vulnerability of the Cisco Identity Services Engine (ISE) platform, related to the lack of data cleansing at the management level, allows attackers to execute arbitrary commands and elevate their privileges to the root level.

The vulnerability of the Cisco Identity Services Engine ISE platform relates to the lack of data cleansing measures at the management level. Exploiting this vulnerability allows an attacker to execute arbitrary commands and elevate their privileges to root using a specially created CLI command...

The vulnerability of the Cisco Identity Services Engine (ISE) platform, related to the lack of data cleansing at the management level, allows attackers to execute arbitrary commands and elevate their privileges to the root level.

The vulnerability of the Cisco Identity Services Engine ISE platform relates to the lack of data cleansing measures at the management level. Exploiting this vulnerability allows an attacker to execute arbitrary commands and elevate their privileges to root using a specially created CLI command...