17422 matches found
PT-2024-5949 · Qnap · Qts +1
Name of the Vulnerable Software and Affected Versions: QTS versions prior to 4.5.4.2790 build 20240605 QuTS hero versions prior to h4.5.4.2626 build 20231225 Description: An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the...
QNAP Systems Video Station 命令注入漏洞
QNAP Systems Video Station is a video management and playback application from QNAP Systems. A command injection vulnerability exists in QNAP Video Station version 5.8.2 and prior versions, which stems from the inclusion of an operating system command injection vulnerability. An attacker could...
The vulnerability of the Timeperiod component of the Centreon IT infrastructure monitoring software’s web interface allows a hacker to execute arbitrary SQL commands.
The vulnerability of the Timeperiod component of the Centreon IT infrastructure monitoring software’s web interface is related to the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL commands remotely...
QNAP Systems QTS 和QuTS hero 操作系统命令注入漏洞
QNAP QTS is a NAS operating system developed by QNAPSystems, Inc. designed for network attached storage devices, providing data management, backup, multimedia entertainment, etc. QNAP QuTS hero is an enterprise-grade operating system developed by QNAP for its networked storage devices NAS, which ...
The vulnerability of Firefox browsers, including Firefox ESR, stems from a type confusion in the processing of StructFields and ArrayTypes in WASM. This allows attackers to execute arbitrary code.
The vulnerability of Firefox and Firefox ESR is related to a type confusion error in the processing of StructFields and ArrayTypes in WASM. Exploiting this vulnerability allows an attacker to execute arbitrary code on the target system remotely...
Security Bulletin: Vulnerability in Apache Druid affects watsonx.data
Summary It is possible for an authenticated user to send a specially-crafted request that forces Apache Druid to run user-provided JavaScript code for that request, regardless of server configuration. This can be leveraged to execute code on the target machine with the privileges of the Druid...
ROS-20240904-13
A vulnerability in the session cookie pga4session of the pgAdmin 4 database management tool is related to an incorrect serialization. Exploitation of the vulnerability could allow an attacker acting remotely, execute arbitrary code...
The vulnerability of Zyxel Ethernet switches with microprogrammed software in the ATP, USG FLEX, and USG FLEX 50(W)/USG20(W)-VPN series lies in the lack of measures to neutralize special elements used in the operating commands. This allows attackers to execute arbitrary commands.
The vulnerability of Zyxel Ethernet switches with microprogrammed software in the ATP, USG FLEX, and USG FLEX 50W/USG20W-VPN series is related to the lack of measures taken to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker...
ROS-20240904-10
A vulnerability in the Clojure dynamic programming language is related to the deserialization of untrusted data. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial of service A vulnerability in the Clojure dynamic programming language is related to the...
CVE-2024-45623
D-Link DAP-2310 Hardware A Firmware 1.16RC028 allows remote attackers to execute arbitrary code via a stack-based buffer overflow in the ATP binary that handles PHP HTTP GET requests for the Apache HTTP Server httpd. NOTE: This vulnerability only affects products that are no longer supported by t...
CVE-2024-43772
SQL Injection in download student learning course function of Easytest Online Test Platform ver.24E01 and earlier allow remote attackers to execute arbitrary SQL commands via the uid parameter...
Exploit for Code Injection in Ssssssss Spider-Flow
CVE-2024-0195 Improper Control of Generation of Code 'Code In...
Microsoft Host Integration Server 2006 Command Execution
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Microsoft Host Integration Server 2006 Command Execution Vulnerability', 'Description' = %q This module exploits a command-injection vulnerabilit...
WebEx Remote Command Execution Utility
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'WebEx Remote Command Execution Utility', 'Description' = %q This module enables the execution of a single command as System by exploiting a remot...
HP Web JetAdmin 6.5 Server Arbitrary Command Execution
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'HP Web JetAdmin 6.5 Server Arbitrary Command Execution', 'Description' = %q This module abuses a command execution vulnerability within the web...
Tautulli 2.1.9 Shutdown Denial of Service
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Tautulli v2.1.9 - Shutdown Denial of Service', 'Description' = 'Tautulli versions 2.1.9 and prior are vulnerable to denial of service via the...
Microsoft SQL Server Command Execution
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Microsoft SQL Server Command Execution', 'Description' = %q This module will execute a Windows command on a MSSQL/MSDE instance via the xpcmdshel...
PT-2024-38753
Name of the Vulnerable Software and Affected Versions: The Events Calendar Pro plugin for WordPress versions up to, and including, 7.0.2 Description: The issue is related to PHP Object Injection via deserialization of untrusted input from the filters parameter in widgets. This allows authenticate...
Ray cpu_profile Command Injection Exploit
This Metasploit module demonstrates a command injection vulnerability in Ray via cpuprofile. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Ray cpuprofile command injection', 'Description' = %...