CVE-2023-38576

CVE-2023-38576 relates to a hidden functionality vulnerability in the ELECOM/LOGITEC LAN-WH300N/RE management console. An authenticated user can execute arbitrary OS commands on the device. The incident is described across multiple sources, with the Red Hat entry and PT-Security summary confirmin...

CVE-2023-38576

Hidden functionality vulnerability in LAN-WH300N/RE all versions provided by LOGITEC CORPORATION allows an authenticated user to execute arbitrary OS commands on a certain management console...

CVE-2023-35991

Hidden functionality vulnerability in LOGITEC wireless LAN routers allows an unauthenticated attacker to log in to the product's certain management console and execute arbitrary OS commands. Affected products and versions are as follows: LAN-W300N/DR all versions, LAN-WH300N/DR all versions,...

CVE-2023-35991

Hidden functionality vulnerability in LOGITEC wireless LAN routers allows an unauthenticated attacker to log in to the product's certain management console and execute arbitrary OS commands. Affected products and versions are as follows: LAN-W300N/DR all versions, LAN-WH300N/DR all versions,...

CVE-2023-35991

CVE-2023-35991 affects LOGITEC LAN-W300N/DR, LAN-WH300N/DR, LAN-W300N/P, LAN-WH450N/GP, LAN-WH300AN/DGP, LAN-WH300N/DGP, and LAN-WH300ANDGPE. It is a hidden functionality vulnerability allowing an unauthenticated attacker to log in to a management console and execute arbitrary OS commands. The is...

CVE-2023-32626

CVE-2023-32626 affects LAN-W300N/RS and LAN-W300N/PR5 from ELECOM/LOGITEC. A hidden functionality flaw allows an unauthenticated attacker to log in to a management console and execute arbitrary OS commands (remote code execution). Exploitation is network-based and does not require user interactio...

CVE-2023-32626

Hidden functionality vulnerability in LAN-W300N/RS all versions, and LAN-W300N/PR5 all versions allows an unauthenticated attacker to log in to the product's certain management console and execute arbitrary OS commands...

CVE-2023-39416

Proself Enterprise/Standard Edition Ver5.61 and earlier, Proself Gateway Edition Ver1.62 and earlier, and Proself Mail Sanitize Edition Ver1.07 and earlier allow a remote authenticated attacker with an administrative privilege to execute arbitrary OS commands...

CVE-2023-39416

CVE-2023-39416 affects Proself Enterprise/Standard Edition v5.61 and earlier, Proself Gateway Edition v1.62 and earlier, and Proself Mail Sanitize Edition v1.07 and earlier. The vulnerability is an OS command injection that can be triggered by a remote attacker with administrative privileges afte...

Maltrail 0.53 Unauthenticated Command Injection Exploit

Maltrail is a malicious traffic detection system, utilizing publicly available blacklists containing malicious and/or generally suspicious trails. Maltrail versions below 0.54 suffer from a command injection vulnerability. The subprocess.checkoutput function in mailtrail/core/http.py contains a...

CVE-2023-33013

A post-authentication command injection vulnerability in the NTP feature of Zyxel NBG6604 firmware version V1.01ABIR.1C0 could allow an authenticated attacker to execute some OS commands remotely by sending a crafted HTTP request...

CVE-2023-33013

CVE-2023-33013 affects Zyxel NBG6604 firmware V1.01(ABIR.1)C0, where a post-authentication command injection in the NTP feature could let an authenticated attacker remotely execute OS commands by sending a crafted HTTP request. Root cause described as insufficient input handling/filtering in the ...

CVE-2023-33013

A post-authentication command injection vulnerability in the NTP feature of Zyxel NBG6604 firmware version V1.01ABIR.1C0 could allow an authenticated attacker to execute some OS commands remotely by sending a crafted HTTP request...

CVE-2023-3267

When adding a remote backup location, an authenticated user can pass arbitrary OS commands through the username field. The username is passed without sanitization into CMD running as NT/Authority System. An authenticated attacker can leverage this vulnerability to execute arbitrary code with...

CVE-2023-3264

The Dataprobe iBoot PDU running firmware version 1.43.03312023 or earlier uses hard-coded credentials for all interactions with the internal Postgres database. A malicious agent with the ability to execute operating system commands on the device can leverage this vulnerability to read, modify, or...

PT-2023-23945 · Cyberpower · Cyberpower Powerpanel Enterprise

Name of the Vulnerable Software and Affected Versions: CyberPower PowerPanel Enterprise affected versions not specified Description: The issue allows an authenticated user to pass arbitrary OS commands through the username field when adding a remote backup location. This field is passed without...

Design/Logic Flaw

DSM 2022.2 SU2 and all prior versions allows a local low privileged account to execute arbitrary OS commands as the DSM software installation user...

CVE-2023-28129

DSM 2022.2 SU2 and all prior versions allows a local low privileged account to execute arbitrary OS commands as the DSM software installation user...

CVE-2023-38641

Siemens SICAM TOOLBOX II is affected by CVE-2023-38641 (Execute with Unnecessary Privileges). All versions prior to V07.10 expose a database service running as NT AUTHORITY\SYSTEM, enabling a local attacker with low privileges and no user interaction to execute OS commands with elevated privilege...

CVE-2023-37569

This vulnerability exists in ESDS Emagic Data Center Management Suit due to lack of input sanitization in its Ping component. A remote authenticated attacker could exploit this by injecting OS commands on the targeted system. Successful exploitation of this vulnerability could allow the attacker ...