CVE-2021-33965

China Mobile An Lianbao WF-1 V1.0.1 router provides a web interface /api/ZRMesh/setZRMesh which receives parameters by POST request, and the parameter meshenable and meshdevice have a command injection vulnerability. An attacker can use the vulnerability to execute remote commands...

CVE-2021-33964

China Mobile An Lianbao WF-1 V1.0.1 router provides a web interface /api/ZRRuleFilter/setfirewalllevel which receives parameters by POST request, and the parameter firewalllevel has a command injection vulnerability. An attacker can use the vulnerability to execute remote commands...

China Mobile An Lianbao WF-1 router 命令注入漏洞

China Mobile An Lianbao WF-1 router is a router from China Mobile China. A security vulnerability in China Mobile An Lianbao WF-1 router V1.0.1 can be exploited by an attacker to execute remote commands...

China Mobile An Lianbao WF-1 router命令注入漏洞

China Mobile An Lianbao WF-1 router is a router from China Mobile China. A security vulnerability exists in China Mobile An Lianbao WF-1 V1.0.1, which can be exploited by an attacker to execute remote commands...

Directory traversal

Bytecode Viewer BCV is a Java/Android reverse engineering suite. Versions of the package prior to 2.11.0 are vulnerable to Arbitrary File Write via Archive Extraction AKA "Zip Slip". The vulnerability is exploited using a specially crafted archive that holds directory traversal filenames e.g...

CVE-2022-23118

Jenkins Debian Package Builder Plugin 1.6.11 and earlier implements functionality that allows agents to invoke command-line git at an attacker-specified path on the controller, allowing attackers able to control agent processes to invoke arbitrary OS commands on the controller...

CVE-2022-21675

BCV (Bytecode Viewer) versions prior to 2.11.0 are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip). A crafted archive with directory traversal filenames (e.g., ../../evil.exe) can overwrite files across formats such as zip, jar, tar, war, cpio, apk, rar, 7z, enabling file ove...

CVE-2022-21675 Bytecode Viewer v2.10.x Zip Slip

Bytecode Viewer BCV is a Java/Android reverse engineering suite. Versions of the package prior to 2.11.0 are vulnerable to Arbitrary File Write via Archive Extraction AKA "Zip Slip". The vulnerability is exploited using a specially crafted archive that holds directory traversal filenames e.g...

CVE-2022-21675 Bytecode Viewer v2.10.x Zip Slip

Bytecode Viewer BCV is a Java/Android reverse engineering suite. Versions of the package prior to 2.11.0 are vulnerable to Arbitrary File Write via Archive Extraction AKA "Zip Slip". The vulnerability is exploited using a specially crafted archive that holds directory traversal filenames e.g...

CVE-2021-44650

Zoho ManageEngine M365 Manager Plus before Build 4419 allows remote command execution when updating proxy settings through the Admin ProxySettings and Tenant ProxySettings components...

CVE-2021-44650

Zoho ManageEngine M365 Manager Plus before Build 4419 allows remote command execution when updating proxy settings through the Admin ProxySettings and Tenant ProxySettings components...

CVE-2021-44650

Zoho ManageEngine M365 Manager Plus before Build 4419 allows remote command execution when updating proxy settings through the Admin ProxySettings and Tenant ProxySettings components...

CVE-2021-44650

Zoho ManageEngine M365 Manager Plus (before Build 4419) contains a command-injection vulnerability in the ProxySettings update flow (Admin ProxySettings and Tenant ProxySettings). This allows remote command execution. Affected versions are prior to Build 4419; remediation is to upgrade to Build 4...

Bytecode Viewer 路径遍历漏洞

Bytecode Viewer is an advanced lightweight Java/Android reverse engineering suite decompiler, editor, debugger, etc.. A path traversal vulnerability exists in Bytecode Viewer versions prior to 2.11.0, which stems from the software's susceptibility to an arbitrary file write attack via archive...

VulnCheck KEV: CVE-2013-6719

delivery.php in the Passive Capture Application PCA web console in IBM Tealeaf CX 7.x, 8.x through 8.6, 8.7 before FP2, and 8.8 before FP2 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the testconnhost parameter...

PT-2022-1436 · Cisco · Cisco Tetration

Name of the Vulnerable Software and Affected Versions: Cisco Tetration affected versions not specified Description: The issue is related to insufficient input validation in the web-based management interface and API subsystem, allowing an authenticated, remote attacker to inject arbitrary command...

Backdoor.Win32.Controlit.10 Code Execution

Discovery / credits: Malvuln - malvuln.com c 2022 Original source: https://malvuln.com/advisory/859aab793a42868343346163bd42f485.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Controlit.10 Vulnerability: Unauthenticated Remote Command Execution Description: The...

CVE-2021-43297

A deserialization vulnerability existed in dubbo hessian-lite 3.2.11 and its earlier versions, which could lead to malicious code execution. Most Dubbo users use Hessian2 as the default serialization/deserialization protocol, during Hessian catch unexpected exceptions, Hessian will log out some...

CVE-2021-44458

Linux users running Lens 5.2.6 and earlier could be compromised by visiting a malicious website. The malicious website could make websocket connections from the victim's browser to Lens and so operate the local terminal feature. This would allow the attacker to execute arbitrary commands as the...

Deserialization of untrusted data

A deserialization vulnerability existed in dubbo hessian-lite 3.2.11 and its earlier versions, which could lead to malicious code execution. Most Dubbo users use Hessian2 as the default serialization/deserialization protocol, during Hessian catch unexpected exceptions, Hessian will log out some...