D-LINK GO-RT-AC750 Router Command Injection

The vulnerability of the D-LINK GO-RT-AC750 router’s microprogramming software is related to the lack of measures taken to neutralize special elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands using the genacgimain parameter...

CVE-2023-1722 Yoga Class Registration System 1.0 - ATO

Yoga Class Registration System version 1.0 allows an administrator to execute commands on the server. This is possible because the application does not correctly validate the thumbnails of the classes uploaded by the administrators...

Remote Command Execution by Improper Escaping of Output

Description Improper Encoding or Escaping of Output in Froxlor export configuration. Hackers can use it to create a json file with PHP code inside then trigger the code by set php-fpm to process .json extension. php foreach $POST'system' as $sysdaemon $params'system' = $sysdaemon; $paramscontent ...

VulnCheck KEV: CVE-2022-45699

Command injection in the administration interface in APSystems ECU-R version 5203 allows a remote unauthenticated attacker to execute arbitrary commands as root using the timezone parameter...

PT-2023-9236 · Nexgen · Nextgen Mirth Connect

Name of the Vulnerable Software and Affected Versions: NextGen Mirth Connect version 4.3.0 Description: A remote command execution issue allows attackers to execute arbitrary commands on the hosting server. The vulnerability is related to the XStreamSerializer class and is due to a lack of data...

Exploit for Code Injection in Vmware Spring_Framework

Spring4Shell Spring4Shell CVE-2022-22965 Proof Of Concept wi...

Exploit for Code Injection in Vmware Spring_Framework

Spring4Shell Spring4Shell CVE-2022-22965 Proof Of Concept wi...

TOTOLINK X18 Router Command Execution

The vulnerability of the setTracerouteCfg function in TOTOLINK X18 router microprogramming systems is related to insufficient checking of arguments passed in commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

CVE-2023-27992

The pre-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21AAZF.14C0, NAS540 firmware versions prior to V5.21AATB.11C0, and NAS542 firmware versions prior to V5.21ABAG.11C0 could allow an unauthenticated attacker to execute some operating system OS...

CVE-2023-27992

The pre-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21AAZF.14C0, NAS540 firmware versions prior to V5.21AATB.11C0, and NAS542 firmware versions prior to V5.21ABAG.11C0 could allow an unauthenticated attacker to execute some operating system OS...

CVE-2023-27396: Missing Authentication for Critical Function

FINS Factory Interface Network Service is a message communication protocol, which is designed to be used in closed FA Factory Automation networks, and is used in FA networks composed of OMRON products. Multiple OMRON products that implement FINS protocol contain following security issues --...

Metasploit Weekly Wrap-Up

Metasploit T-Shirt Design Contest In honor of Metasploit's 20th anniversary, Rapid7 is launching special edition t-shirts - and we're inviting members of our community to have a hand in its creation. The contest winner will have their design featured on the shirts, which will then be available to...

Multiple vulnerabilities in Panasonic AiSEG2

Overview Panasonic AiSEG2 contains multiple vulnerabilities listed below. OS Command Injection CWE-78 - CVE-2023-28726 Improper Authentication CWE-287 - CVE-2023-28727 Taku Toyama of NEC Corporation reported CVE-2023-28726 and CVE-2023-28727 vulnerabilities to Panasonic and coordinated. Panasonic...

PT-2023-24001 · L7 Networks · L7 Networks Instantqos Iq-8000 +1

Name of the Vulnerable Software and Affected Versions: L7 Networks InstantScan IS-8000 & InstantQoS IQ-8000 affected versions not specified Description: The file uploading function in the affected devices does not properly restrict the upload of files with dangerous types. This allows an...

WlanNetworkRpm Component Arbitrary Command Execution

The vulnerability of the WlanNetworkRpm component /userRpm/WlanNetworkRpm.htm of TP-Link routers such as TL-WR940N, TL-WR740N, and TL-WR841N is related to the failure to eliminate special elements used in the operating system’s processing of the ssid1 parameter. Exploiting this vulnerability allo...

D-Link DIR-842V2 Router Arbitrary Command Execution

The vulnerability of D-Link DIR-842V2 router microprogramming software is related to the lack of measures taken to clean data at the control level. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands by importing a specially created binary file...

iperf3 Component Arbitrary Command Execution

The vulnerability of the iperf3 component of D-Link DIR-842V2 router microprogramming software is related to the lack of measures taken to clean data at the management level. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

Hitron CODA-5310 Command Injection

The vulnerability of the Hitron CODA-5310 cable gateway exists due to the failure to take measures to neutralize special elements used in the operating system’s commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

CVE-2022-32752 IBM Security Directory Suite VA command execution

IBM Security Directory Suite VA 8.0.1 through 8.0.1.19 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-Force ID: 228439...

PT-2023-13190 · Ibm · Ibm Security Directory Suite Va

Name of the Vulnerable Software and Affected Versions: IBM Security Directory Suite VA versions 8.0.1 through 8.0.1.19 Description: The issue allows a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. Recommendations: For IBM Securit...