CVE-2023-33412

The web interface in the Intelligent Platform Management Interface IPMI baseboard management controller BMC implementation on Supermicro X11 and M11 based devices, with firmware versions before 3.17.02, allows remote authenticated users to execute arbitrary commands via a crafted request targetin...

CVE-2023-33412

The web interface in the Intelligent Platform Management Interface IPMI baseboard management controller BMC implementation on Supermicro X11 and M11 based devices, with firmware versions before 3.17.02, allows remote authenticated users to execute arbitrary commands via a crafted request targetin...

CVE-2023-33413

The configuration functionality in the Intelligent Platform Management Interface IPMI baseboard management controller BMC implementation on Supermicro X11 and M11 based devices, with firmware versions through 3.17.02, allows remote authenticated users to execute arbitrary commands...

ConQuest Dicom Server 1.5.0d Remote Command Execution Exploit

!/usr/bin/env python3 --------------------------------------------------------- preauth rce poc for ConQuest Dicom Server 1.5.0d --------------------------------------------------------- 04.08.2023 @ 22:07 code610 blogspot com import socket target = '192.168.56.106' rport = 5678 pkt1 =...

PT-2023-8803

Name of the Vulnerable Software and Affected Versions Supermicro X11 and M11 based devices versions prior to 3.17.02 Description The web interface in the Intelligent Platform Management Interface IPMI baseboard management controller BMC implementation allows remote authenticated users to execute...

ConQuest Dicom Server 1.5.0d Remote Command Execution

!/usr/bin/env python3 --------------------------------------------------------- preauth rce poc for ConQuest Dicom Server 1.5.0d --------------------------------------------------------- 04.08.2023 @ 22:07 code610 blogspot com import socket target = '192.168.56.106' rport = 5678 pkt1 =...

CVE-2023-33413

The PT-Security entry for CVE-2023-33413 details a flaw in Supermicro IPMI BMC on X11/M11 devices up to firmware 3.17.02. The root cause is hardcoded configuration file encryption keys used by the IPMI BMC config function, enabling remote authenticated users to craft/upload a malicious configurat...

PT-2023-24338

Name of the Vulnerable Software and Affected Versions Supermicro X11 and M11 based devices versions through 3.17.02 Description The configuration functionality in the Intelligent Platform Management Interface IPMI baseboard management controller BMC implementation allows remote authenticated user...

The vulnerability of the authentication function of ASUS RT-AX55 router’s microprogramming software allows a hacker to execute arbitrary commands.

The vulnerability of the authentication function of ASUS RT-AX55 router software exists due to the lack of measures taken to neutralize the special elements used in the operating system command. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

The vulnerability of the microprogramming software of Osprey Pump Controller allows a intruder to execute arbitrary commands.

The vulnerability of the microprogrammed software of Osprey Pump Controller controllers exists due to the lack of measures taken to neutralize certain special elements. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands via the HTTP POST parameter...

The vulnerability of the account_print.cgi component in the microprogramming software for Zyxel USG FLEX and VPN devices allows a hacker to execute arbitrary commands.

The vulnerability of the accountprint.cgi component in the Zyxel USG FLEX and VPN network devices is related to an incorrect limitation on the path name to the tmp directory. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

The vulnerability of the authentication function of ASUS RT-AX55 router’s microprogramming software allows a hacker to execute arbitrary commands.

The vulnerability of the authentication function of ASUS RT-AX55 router software exists due to the failure to take measures to neutralize the special elements used in the operating system command. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

The vulnerability of the authentication function of ASUS RT-AX55 router’s microprogramming software allows a hacker to execute arbitrary commands.

The vulnerability of the authentication function of ASUS RT-AX55 router software exists due to the failure to take measures to neutralize the special elements used in the operating system command. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

The vulnerability of the authentication function of ASUS RT-AX55 router’s microprogramming software allows a hacker to execute arbitrary commands.

The vulnerability of the authentication function of ASUS RT-AX55 router software exists due to the lack of measures taken to neutralize the special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

CVE-2023-48800

In TOTOLINK X6000RFirmware V9.4.0cu.852B20230719, the shttpd file sub417338 function obtains fields from the front-end, connects them through the snprintf function, and passes them to the CsteSystem function, resulting in a command execution vulnerability...

VulnCheck KEV: CVE-2023-45852

In Vitogate 300 2.1.3.0, /cgi-bin/vitogate.cgi allows an unauthenticated attacker to bypass authentication and execute arbitrary commands via shell metacharacters in the ipaddr params JSON data for the put method...

The vulnerability of the microprogrammed software for Zyxel NAS326 and NAS542 networks exists due to the lack of measures taken to neutralize special elements used in the operating system commands. This allows a perpetrator to execute any desired operating system command.

The vulnerability of Zyxel NAS326 and NAS542 network storage devices due to the lack of measures to neutralize specific elements used in the operating system commands exists. Exploiting this vulnerability allows a malicious actor to execute arbitrary operating system commands by sending a special...

WBCE CMS 1.6.1 Shell Upload Vulnerability

Exploit Title: WBCE CMS Version : 1.6.1 Remote Command Execution Exploit Author: tmrswrr Vendor Homepage: https://wbce-cms.org/ Software Link: https://github.com/WBCE/WBCECMS/archive/refs/tags/1.6.1.zip Version: 1.6.1 Tested on: https://www.softaculous.com/apps/cms/WBCECMS POC: 1 Login with admin...

SUSE CVE-2023-30801

All versions of the qBittorrent client through 4.5.5 use default credentials when the web user interface is enabled. The administrator is not forced to change the default credentials. As of 4.5.5, this issue has not been fixed. A remote attacker can use the default credentials to authenticate and...

WBCE CMS 1.6.1 Shell Upload

Exploit Title: WBCE CMS Version : 1.6.1 Remote Command Execution Date: 30/11/2023 Exploit Author: tmrswrr Vendor Homepage: https://wbce-cms.org/ Software Link: https://github.com/WBCE/WBCECMS/archive/refs/tags/1.6.1.zip Version: 1.6.1 Tested on: https://www.softaculous.com/apps/cms/WBCECMS POC: 1...