PT-2023-28965 · Unknown · Wrc-X3000Gs2A-B +1

Name of the Vulnerable Software and Affected Versions: WRC-X3000GS2-W versions 1.05 and earlier WRC-X3000GS2-B versions 1.05 and earlier WRC-X3000GS2A-B versions 1.05 and earlier Description: The issue allows a network-adjacent authenticated user to execute an arbitrary OS command by sending a...

Multiple vulnerabilities in ELECOM and LOGITEC routers

Overview Multiple routers provided by ELECOM CO.,LTD. and LOGITEC CORPORATION contain multiple vulnerabilities listed below. OS Command Injection CWE-78 - CVE-2023-43752 Inadequate Encryption Strength CWE-326 - CVE-2023-43757 CVE-2023-43752 Chuya Hayakawa of 00One, Inc. reported this vulnerabilit...

CVE-2023-36553

A improper neutralization of special elements used in an os command 'os command injection' in Fortinet FortiSIEM version 5.4.0 and 5.3.0 through 5.3.3 and 5.2.5 through 5.2.8 and 5.2.1 through 5.2.2 and 5.1.0 through 5.1.3 and 5.0.0 through 5.0.1 and 4.10.0 and 4.9.0 and 4.7.2 allows attacker to...

Command injection

A improper neutralization of special elements used in an os command 'os command injection' in Fortinet FortiSIEM version 5.4.0 and 5.3.0 through 5.3.3 and 5.2.5 through 5.2.8 and 5.2.1 through 5.2.2 and 5.1.0 through 5.1.3 and 5.0.0 through 5.0.1 and 4.10.0 and 4.9.0 and 4.7.2 allows attacker to...

PT-2023-6918 · Fortinet · Fortisiem

Name of the Vulnerable Software and Affected Versions: Fortinet FortiSIEM versions 4.7.2 through 5.4.0 Description: The issue is related to an improper neutralization of special elements used in an os command, also known as 'os command injection'. This allows an attacker to execute unauthorized...

QNAP QuTS hero OS Command Injection Vulnerability (QSA-23-24)

QNAP QuTS hero is prone to an OS command injection vulnerability. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/o:qnap:qutshero";...

Multiple vulnerabilities in Cisco Firepower Management Center Software

Overview Cisco Firepower Management Center Software provided by Cisco Systems contains multiple vulnerabilities listed below. OS command injection CWE-78 - CVE-2023-20219 Path traversal CWE-22 - CVE-2023-20220 Kentaro Kawane of LAC Co., Ltd. reported these vulnerabilitis to IPA. JPCERT/CC...

VulnCheck KEV: CVE-2022-34753

A CWE-78: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability exists that could cause remote root exploit when the command is compromised. Affected Products: SpaceLogic C-Bus Home Controller 5200WHC2, formerly known as C-Bus Wiser Homer...

ILIAS < 7.26 Multiple Vulnerabilities

ILIAS is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:ilias:ilias"; if description...

JVN#17806703: Multiple vulnerabilities in Cisco Firepower Management Center Software

Cisco Firepower Management Center Software provided by Cisco Systems contains multiple vulnerabilities listed below. OS command injection CWE-78 - CVE-2023-20219 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H| Base Score: 6.6 CVSS v2|...

CVE-2023-39295

An OS command injection vulnerability has been reported to affect QuMagie. If exploited, the vulnerability could allow authenticated users to execute commands via a network. We have already fixed the vulnerability in the following version: QuMagie 2.1.3 and later...

Command injection

An OS command injection vulnerability has been reported to affect QuMagie. If exploited, the vulnerability could allow authenticated users to execute commands via a network. We have already fixed the vulnerability in the following version: QuMagie 2.1.3 and later...

CVE-2023-39295

QuMagie has an OS command injection vulnerability that allows authenticated users to execute commands over the network. Affected versions are prior to 2.1.3; the issue is fixed in 2.1.3 and later. CVSS v3.1 metrics indicate high impact (C/H, I/H, A/H) with network exploitability and low privilege...

Command injection

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2376...

CVE-2023-23367

CVE-2023-23367 affects multiple QNAP platforms (QTS, QuTS hero, QuTScloud) with an OS command injection vulnerability that could allow authenticated administrators to execute commands over the network. Affected versions: QTS 5.0.1.2376 build 20230421 and later; QuTS hero h5.0.1.2376 build 2023042...

Cisco IOX XE unauthenticated OS Command Execution Exploit

msf use auxiliary/admin/http/ciscoiosxeosexeccve202320273 msf auxiliaryciscoiosxeosexeccve202320273 show actions ...actions... msf auxiliaryciscoiosxeosexeccve202320273 set ACTION msf auxiliaryciscoiosxeosexeccve202320273 show options ...show and set options... msf...

Cisco IOX XE unauthenticated OS command execution

This module leverages both CVE-2023-20198 and CVE-2023-20273 against vulnerable instances of Cisco IOS XE devices which have the Web UI exposed. An attacker can execute arbitrary OS commands with root privileges. This module leverages CVE-2023-20198 to create a new admin user, then authenticating...

QNAP warns about critical vulnerabilities in NAS systems

QNAP has published a security advisory about two critical vulnerabilities that could allow remote attackers to execute commands via a network. One of the vulnerabilities affects the QTS and QuTS operating systems OS for QNAP’s network attached storage systems NAS. The second one can be found in...

Rocky Linux 9 : nodejs:18 (RLSA-2022:8832)

The remote Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:8832 advisory. - A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service ReDoS when calling the braceExpand functio...

Rocky Linux 9 : nodejs and nodejs-nodemon (RLSA-2023:0321)

The remote Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2023:0321 advisory. - Minimist =1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey lines 69-95. CVE-2021-44906 - A vulnerability was found in the...