CVE-2022-27486

A improper neutralization of special elements used in an os command 'os command injection' in Fortinet FortiDDoS version 5.5.0 through 5.5.1, 5.4.2 through 5.4.0, 5.3.0 through 5.3.1, 5.2.0, 5.1.0, 5.0.0, 4.7.0, 4.6.0 and 4.5.0 and FortiDDoS-F version 6.3.0 through 6.3.1, 6.2.0 through 6.2.2, 6.1...

CVE-2022-27486

A improper neutralization of special elements used in an os command 'os command injection' in Fortinet FortiDDoS version 5.5.0 through 5.5.1, 5.4.2 through 5.4.0, 5.3.0 through 5.3.1, 5.2.0, 5.1.0, 5.0.0, 4.7.0, 4.6.0 and 4.5.0 and FortiDDoS-F version 6.3.0 through 6.3.1, 6.2.0 through 6.2.2, 6.1...

CVE-2022-27486

The issue CVE-2022-27486 affects Fortinet FortiDDoS and FortiDDoS-F CLI, where an improper neutralization of elements in an OS command enables an authenticated attacker to execute shell code as root via the execute command. Affected: FortiDDoS versions 4.5.0–5.5.1; FortiDDoS-F versions 6.1.0–6.3....

CVE-2022-27486

A improper neutralization of special elements used in an os command 'os command injection' in Fortinet FortiDDoS version 5.5.0 through 5.5.1, 5.4.2 through 5.4.0, 5.3.0 through 5.3.1, 5.2.0, 5.1.0, 5.0.0, 4.7.0, 4.6.0 and 4.5.0 and FortiDDoS-F version 6.3.0 through 6.3.1, 6.2.0 through 6.2.2, 6.1...

(0Day) F-Secure Total Link Following Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of F-Secure Total. User interaction on the part of an administrator is required to exploit this vulnerability. The specific flaw exists within the WithSecure plugin hosting service. By creating a symbolic...

MAL-2024-7800 Malicious code in dagit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bdc606f7fb150c7677aed483cf4e524fec208106f3ec8d573a646547034122fb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-7066

A vulnerability was found in F-logic DataCube3 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/configtimesync.php of the component HTTP POST Request Handler. The manipulation of the argument ntpserver leads to os command...

CVE-2024-7066

CVE-2024-7066 affects F-logic DataCube3 1.0. The vulnerability resides in the HTTP POST Request Handler, specifically the file /admin/config_time_sync.php, where manipulating the ntp_server argument enables OS command injection. Exploitation can be remote and the exploit has been disclosed public...

CVE-2024-7066 F-logic DataCube3 HTTP POST Request config_time_sync.php os command injection

A vulnerability was found in F-logic DataCube3 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/configtimesync.php of the component HTTP POST Request Handler. The manipulation of the argument ntpserver leads to os command...

F-logic DataCube3 操作系统命令注入漏洞

F-logic DataCube3 is a small measurement terminal system from F-logic Japan. An operating system command injection vulnerability exists in F-logic DataCube3 version 1.0, which originates from the parameter ntpserver via the file /admin/configtimesync.php that causes operating system command...

PT-2024-38056 · F Logic · F-Logic Datacube3

Name of the Vulnerable Software and Affected Versions: F-logic DataCube3 version 1.0 Description: A critical issue has been found in the HTTP POST Request Handler component, specifically in the file /admin/config time sync.php. The manipulation of the ntp server argument leads to os command...

WordPress MasterStudy LMS Plugin < 3.3.24 is vulnerable to Privilege Escalation

Software MasterStudy LMS Type Plugin Vulnerable versions 3.3.24 Fixed in 3.3.24 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2024-5973 Patch priority High CVSS severity High 7.6 Developer Claim ownership PSID 2f024467e854 Credits Jaime F...

Exploit for Special Element Injection in Google Android

CVE-2024-0044-EXP This tool exploits CVE-2024-0044 to enable...

VulnCheck KEV: CVE-2024-31750

SQL injection vulnerability in f-logic datacube3 v.1.0 allows a remote attacker to obtain sensitive information via the reqid parameter...

PT-2024-28292 · Phpok · Phpok

Name of the Vulnerable Software and Affected Versions: phpok version 6.4.003 Description: The issue is related to a Cross Site Scripting XSS vulnerability. It affects the ok f method located in the framework/api/upload control.php file. Recommendations: For phpok version 6.4.003, consider disabli...

CVE-2024-23766

An issue was discovered on HMS Anybus X-Gateway AB7832-F 3 devices. The gateway exposes a web interface on port 80. An unauthenticated GET request to a specific URL triggers the reboot of the Anybus gateway or at least most of its modules. An attacker can use this feature to carry out a denial of...

CVE-2024-23765

An issue was discovered on HMS Anybus X-Gateway AB7832-F 3 devices. The gateway exposes an unidentified service on port 7412 on the network. All the network services of the gateway become unresponsive after sending 85 requests to this port. The content and length of the frame does not matter. The...

CVE-2024-23765

HMS Anybus X-Gateway AB7832-F (3 devices) exposes an unidentified service on port 7412. After 85 requests to this port, all gateway network services become unresponsive, requiring a restart to resume operations. PT Security notes a temporary workaround to restrict access to port 7412; there is no...

PT-2024-20070 · Hms · Hms Anybus X-Gateway Ab7832-F

Name of the Vulnerable Software and Affected Versions: HMS Anybus X-Gateway AB7832-F version 3 Description: An issue was discovered that allows unauthenticated changes to a device's network configurations through the HICP protocol. Recommendations: For HMS Anybus X-Gateway AB7832-F version 3,...

CVE-2024-23766

An issue was discovered on HMS Anybus X-Gateway AB7832-F 3 devices. The gateway exposes a web interface on port 80. An unauthenticated GET request to a specific URL triggers the reboot of the Anybus gateway or at least most of its modules. An attacker can use this feature to carry out a denial of...