Email-Worm.Win32.Sidex Remote Command Execution

Discovery / credits: Malvuln - malvuln.com c 2022 Original source: https://malvuln.com/advisory/a98cdaa89da57bf269873db63e22a939.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Email-Worm.Win32.Sidex Vulnerability: Unauthenticated Remote Command Execution Description: The...

WSO2 Multiple Products File Upload Remote Command Execution (CVE-2022-29464)

Binary data wso2CVE-2022-29464.nbin...

CVE-2022-29077

CVE-2022-29077 is a heap-based buffer overflow in rippled prior to 1.8.5. An attacker could crash the node or remotely execute commands, potentially causing XRPL mainnet DoS and compromising all XRPL assets. Remediation: upgrade to rippled 1.8.5 or apply the vendor’s fix as described in the refer...

PT-2022-19400

Name of the Vulnerable Software and Affected Versions rippled versions prior to 1.8.5 Description A heap-based buffer overflow exists, allowing attackers to cause a crash or execute commands remotely on a rippled node. This may lead to XRPL mainnet DoS or compromise, exposing all digital assets o...

PT-2022-17681 · Irisnet · Irisnext

Name of the Vulnerable Software and Affected Versions: IRISNext versions through 9.8.28 Description: The issue allows execution of arbitrary commands on the target server by creating a custom search or editing an existing search of the documents. The search components permit adding BeanShell...

PT-2022-3563

Name of the Vulnerable Software and Affected Versions ejs versions 3.1.6 Description The issue is related to the ejs package for Node.js, which allows server-side template injection in settingsview optionsoutputFunctionName. This can be parsed as an internal option and overwrites the...

Struts ParameterInterceptor vulnerability allows remote command execution

Regular expression in ParametersInterceptor matches top'foo' as a valid expression, which OGNL treats as top'foo'0 and evaluates the value of 'foo' action parameter as an OGNL expression. This lets malicious users put arbitrary OGNL statements into any String variable exposed by an action and hav...

PT-2022-10823 · Lenovo · Lenovo System Management Module +1

Name of the Vulnerable Software and Affected Versions: Lenovo Fan Power Controller2 FPC2 and Lenovo System Management Module SMM firmware affected versions not specified SMM2 is not affected. Description: An authentication bypass issue was discovered in an internal service of the Lenovo Fan Power...

CVE-2021-3849: Authentication Bypass Using an Alternate Path or Channel

An authentication bypass vulnerability was discovered in the web interface of the Lenovo Fan Power Controller2 FPC2 and Lenovo System Management Module SMM firmware that could allow an unauthenticated attacker to execute commands on the SMM and FPC2. SMM2 is not affected...

Open Plug and Play

The vulnerability of the Open Plug and Play PnP microprogramming software for Cisco Small Business routers such as RV160, RV160W, RV260, RV260P, RV260W, RV340, RV340W, RV345, and RV345P exists due to the failure to take measures to neutralize the special elements used in the operating system...

GitLab 11.9 < 13.8.8 / 13.9 < 13.9.6 / 13.10 < 13.10.3 (CVE-2021-22205)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote...

Backdoor.Win32.NetCat32.10 Remote Command Execution

Discovery / credits: Malvuln - malvuln.com c 2022 Original source: https://malvuln.com/advisory/dcf16aed5ad4e0058a6cfcc7593dd9e3.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.NetCat32.10 Vulnerability: Unauthenticated Remote Command Execution Description: The...

Backdoor.Win32.NetSpy.10 Remote Command Execution

Discovery / credits: Malvuln - malvuln.com c 2022 Original source: https://malvuln.com/advisory/45d413b46f1d14a45e8fd36921813d62.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.NetSpy.10 Vulnerability: Unauthenticated Remote Command Execution Description: The...

RiteCMS arbitrary file upload vulnerability

RiteCMS is a web CMS. RiteCMS 3.1.0 and earlier contain an arbitrary file upload vulnerability that allows an authenticated attacker to upload PHP files and bypass the .htacess configuration to execute .php files in the media and files directories for remote command execution...

workflow-cps-global-lib: OS command execution through crafted SCM contents

A flaw was found in Jenkins. The JenkinsPipeline: Shared Groovy Libraries uses the same checkout directories for distinct SCMs for Pipeline libraries. This flaw allows attackers with item/configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents. This...

PT-2022-2849 · Cisco · Cisco Iox +1

Name of the Vulnerable Software and Affected Versions: Cisco IOx affected versions not specified Description: Multiple vulnerabilities in the Cisco IOx application hosting environment on multiple Cisco platforms could allow an attacker to inject arbitrary commands into the underlying host operati...

PT-2022-3875 · Cisco · Cisco Iox +1

Name of the Vulnerable Software and Affected Versions: Cisco IOx affected versions not specified Description: The issue allows an attacker to inject arbitrary commands into the underlying host operating system, execute arbitrary code on the underlying host operating system, install applications...

Exploit for Missing Authentication for Critical Function in Terra-Master Terramaster_Operating_System

It is an exploit module for CVE-2022-24990, a TerraMaster TOS Un...

Exploit for Missing Authentication for Critical Function in Terra-Master Terramaster_Operating_System

It is an exploit module for a remote command execution vulnerabi...

httpd-demon system Arbitrary Command Execution

The vulnerability of the httpd-demon microprogramming system for TP-Link TL-WPA4220 relates to the lack of measures taken to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands by sending a special...