CVE-2021-37608 Arbitrary file upload vulnerability in OFBiz

Unrestricted Upload of File with Dangerous Type vulnerability in Apache OFBiz allows an attacker to execute remote commands. This issue affects Apache OFBiz version 17.12.07 and prior versions. Upgrade to at least 17.12.08 or apply patches at https://issues.apache.org/jira/browse/OFBIZ-12297...

The vulnerability of the EVlink City, Parking, and Smart Wallbox software lies in the use of rigidly defined credentials. This allows a malicious actor to send unauthorized commands to the web server with administrative privileges.

The vulnerability of the EVlink City, Parking, and Smart Wallbox software systems lies in the use of rigidly defined credentials. Exploiting this vulnerability could allow an attacker to remotely send unauthorized commands to the web server with administrative privileges...

CVE-2021-20108

Manage Engine Asset Explorer Agent 1.0.34 listens on port 9000 for incoming commands over HTTPS from Manage Engine Server. The HTTPS certificates are not verified which allows any arbitrary user on the network to send commands over port 9000. While these commands may not be executed due to...

p11-kit: out-of-bounds read in p11_rpc_buffer_get_byte_array function in rpc-message.c

An issue was discovered in p11-kit 0.21.1 through 0.23.21. A heap-based buffer over-read has been discovered in the RPC protocol used by thep11-kit server/remote commands and the client library. When the remote entity supplies a byte array through a serialized PKCS11 function call, the receiving...

openSUSE Security Update : nextcloud-desktop (openSUSE-2021-577)

This update for nextcloud-desktop fixes the following issues : nextcloud-desktop was updated to 3.1.3 : - desktop2884 stable-3.1 Add support for Hirsute - desktop2920 stable-3.1 Validate sensitive URLs to onle allow https schemes. - desktop2926 stable-3.1 Validate the providers ssl certificate -...

Injection Vulnerability

Nextcloud Desktop Client prior to 3.1.3 is vulnerable to resource injection by way of missing validation of URLs, allowing a malicious server to execute remote commands. User interaction is needed for exploitation...

Command Execution Vulnerability in SecFox O&M Security Management and Audit System of Chianson

SecFox O&M Security Management and Audit System is a hardened computer that can defend against attacks with strong security protection. A command execution vulnerability exists in the Chianson SecFox Operations Security Management and Audit System. An attacker can exploit the vulnerability to...

OPENSUSE-SU-2021:0577-1 Security update for nextcloud-desktop

This update for nextcloud-desktop fixes the following issues: nextcloud-desktop was updated to 3.1.3: - desktop2884 stable-3.1 Add support for Hirsute - desktop2920 stable-3.1 Validate sensitive URLs to onle allow https schemes. - desktop2926 stable-3.1 Validate the providers ssl certificate -...

CVE-2021-22879

Nextcloud Desktop Client prior to 3.1.3 is vulnerable to resource injection by way of missing validation of URLs, allowing a malicious server to execute remote commands. User interaction is needed for exploitation...

Design/Logic Flaw

Nextcloud Desktop Client prior to 3.1.3 is vulnerable to resource injection by way of missing validation of URLs, allowing a malicious server to execute remote commands. User interaction is needed for exploitation...

UBUNTU-CVE-2021-22879

Nextcloud Desktop Client prior to 3.1.3 is vulnerable to resource injection by way of missing validation of URLs, allowing a malicious server to execute remote commands. User interaction is needed for exploitation...

CVE-2021-22879

Nextcloud Desktop Client prior to 3.1.3 is vulnerable to resource injection by way of missing validation of URLs, allowing a malicious server to execute remote commands. User interaction is needed for exploitation...

PT-2021-2538 · Cisco · Rv345P +9

Name of the Vulnerable Software and Affected Versions: Cisco Small Business RV Series Routers versions prior to 1.0.01.03 RV160, RV160W, RV260, RV260P, RV260W, RV340, RV340W, RV345, and RV345P affected versions not specified Description: Multiple vulnerabilities exist in the web-based management...

Accellion FTA OS Command Injection Vulnerability

Accellion File Transfer Appliance FTA is a secure file transfer service that allows users to share and synchronize files online, all encrypted with AES 128/256. An OS command injection vulnerability exists in Accellion FTA 912370 and earlier versions. An attacker can exploit this vulnerability by...

CVE-2020-22425

Centreon 19.10-3.el7 is affected by a SQL injection vulnerability, where an authorized user is able to inject additional SQL queries to perform remote command execution...

Backdoor.Win32.BackAttack.18 Missing Authentication

Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/c806d23f4343ab40cf897e9c38b5c1c3.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.BackAttack.18 Vulnerability: Multiple Vulnerabilities Description: BackAttack.18 v1.8...

CVE-2021-1138

Multiple vulnerabilities in the web UI of Cisco Smart Software Manager Satellite could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system. For more information about these vulnerabilities, see the Details section of this advisory...

The vulnerability of NETGEAR’s integrated software on routers exists due to the lack of measures to neutralize specific components, allowing attackers to execute arbitrary commands.

The vulnerability in NETGEAR’s embedded software exists because measures to neutralize specific components have not been taken. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

CVE-2020-24638

Multiple authenticated remote command executions are possible in Airwave Glass before 1.3.3 via the glassadmin cli. These allow for a user with glassadmin privileges to execute arbitrary code as root on the underlying host operating system...

A Second Hacker Group May Have Also Breached SolarWinds, Microsoft Says

As the probe into the SolarWinds supply chain attack continues, new digital forensic evidence has brought to light that a separate threat actor may have been abusing the IT infrastructure provider's Orion software to drop a similar persistent backdoor on target systems. "The investigation of the...