The vulnerability of the Nagios XI monitoring tool lies in the lack of protection for the website structure when processing input fields $ARG1$ and $ARG2$. This allows attackers to execute arbitrary commands.

The vulnerability of the Nagios XI monitoring tool is related to the lack of measures taken to protect the structure of the web page during the processing of input fields $ARG1$ and $ARG2$. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

CVE-2023-4724 WP All Export (Free < 1.4.0, Pro < 1.8.6) - Admin+ RCE

The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not validate and sanitise the wpquery parameter which allows an attacker to run arbitrary command on the remote server...

GHSA-QG44-XQWJ-WC28 Apache StreamPark: Authenticated system users could trigger remote command execution

In streampark, there is a project module that integrates Maven's compilation capability. However, there is no check on the compilation parameters of Maven. allowing attackers to insert commands for remote command execution, The prerequisite for a successful attack is that the user needs to log in...

Apache StreamPark: Authenticated system users could trigger remote command execution

In streampark, there is a project module that integrates Maven's compilation capability. However, there is no check on the compilation parameters of Maven. allowing attackers to insert commands for remote command execution, The prerequisite for a successful attack is that the user needs to log in...

CVE-2023-49898

In streampark, there is a project module that integrates Maven's compilation capability. However, there is no check on the compilation parameters of Maven. allowing attackers to insert commands for remote command execution, The prerequisite for a successful attack is that the user needs to log in...

Input validation

In streampark, there is a project module that integrates Maven's compilation capability. However, there is no check on the compilation parameters of Maven. allowing attackers to insert commands for remote command execution, The prerequisite for a successful attack is that the user needs to log in...

CVE-2023-49898 Apache StreamPark (incubating): Authenticated system users could trigger remote command execution

In streampark, there is a project module that integrates Maven's compilation capability. However, there is no check on the compilation parameters of Maven. allowing attackers to insert commands for remote command execution, The prerequisite for a successful attack is that the user needs to log in...

CVE-2023-49898 Apache StreamPark (incubating): Authenticated system users could trigger remote command execution

In streampark, there is a project module that integrates Maven's compilation capability. However, there is no check on the compilation parameters of Maven. allowing attackers to insert commands for remote command execution, The prerequisite for a successful attack is that the user needs to log in...

CVE-2023-49898

CVE-2023-49898 concerns Apache StreamPark: a project module that integrates Maven compilation lacks validation of Maven parameters, allowing remote command execution. The advisory notes that an attacker must be an authenticated system user with high privileges, limiting exposure, and that the ove...

CVE-2023-48376

SmartStar Software CWS is a web-based integration platform, its file uploading function does not restrict upload of file with dangerous type. An unauthenticated remote attacker can exploit this vulnerability to upload arbitrary files to perform arbitrary command or disrupt service...

SmartStar Software CWS Code Issue Vulnerability

SmartStar Software CWS is a Web-based integration platform from China-based SmartStar Software. A code issue vulnerability exists in SmartStar Software CWS v10.25, which stems from the file upload feature not restricting the upload of dangerous types of files, which can be exploited by remote...

PT-2023-31406 · Apache · Maven

Name of the Vulnerable Software and Affected Versions: streampark versions prior to 2.1.2 Description: The issue is related to the project module in streampark that integrates Maven's compilation capability. There is no check on the compilation parameters of Maven, allowing attackers to insert...

The vulnerability of the web application development framework web2py arises from the lack of measures taken to eliminate special elements used in the operating system’s command line. This allows attackers to execute arbitrary commands.

The vulnerability of the web2py web application development framework exists due to the lack of measures taken to neutralize special elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

The vulnerability of Fortinet FortiWLM, a centralized management system for WLAN access points and LAN switches, arises due to the failure to take measures to eliminate special elements used in the operating system’s command set. This vulnerability allows attackers to execute arbitrary commands.

The vulnerability of Fortinet FortiWLM, a centralized management system for WLAN access points and LAN switches, exists due to the failure to take measures to neutralize special elements used in the operating system’s commands. Exploiting this vulnerability allows a malicious actor to execute...

The vulnerability of the IBM DB2 database management system, related to deficiencies in access control, allows a perpetrator to execute arbitrary commands.

The vulnerability of the IBM DB2 database management system is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to execute arbitrary commands remotely...

CVE-2023-48663

Dell vApp Manager, versions prior to 9.2.4.x contain a command injection vulnerability. A remote malicious user with high privileges could potentially exploit this vulnerability leading to the execution of arbitrary OS commands on the affected system...

CVE-2023-50011

PopojiCMS version 2.0.1 is vulnerable to remote command execution in the Meta Social field...

The vulnerability of the sub_4119A0 function in the microprogramming software of the TOTOLINK X6000R router allows a hacker to execute arbitrary code.

The vulnerability of the sub4119A0 function shttpd in the TOTOLINK X6000R router microprogramming system exists due to the lack of measures to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

The vulnerability of the SNMPv2 protocol implementation in ASUS’ ASMB8 iKVM remote control device allows a hacker to execute arbitrary commands.

The vulnerability of the SNMPv2 protocol implementation in ASUS’ ASMB8 iKVM remote control device is related to the lack of measures taken to neutralize specific elements. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

CVE-2023-50011

PopojiCMS 2.0.1 is reported vulnerable to remote command execution via the Meta Social field (CVE-2023-50011). The vulnerability is described across multiple sources (NVD, Red Hat, OSV, CVE list) as a remote command execution issue in PopojiCMS 2.0.1. The available sources confirm the affected pr...