Malicious code in marvelmaniac-devvit-rce (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis db9d8f161a565dceb33bc07806d7e65aae706550b73220940a4ff28cf2a50d5f The OpenSSF Package Analysis project identified 'marvelmaniac-devvit-rce' @ 1.0.3 npm as malicious. It is considered malicious because: - The...

PT-2023-27246 · Elecom · Elecom Wrc-F1167Acf +3

Name of the Vulnerable Software and Affected Versions: ELECOM WRC-F1167ACF all versions ELECOM WRC-1750GHBK all versions ELECOM WRC-1167GHBK2 all versions ELECOM WRC-1750GHBK2-I all versions ELECOM WRC-1750GHBK-E all versions Description: An OS command injection vulnerability in ELECOM wireless L...

CVE-2023-38902

CVE-2023-38902 describes a command injection in Ruijie RG-EW/RG-NBS/RG-S1930/RG-EG/EAP/RAP/NBC devices. Affected are RG-EW series (EW 3.0(1)B11P219), RG-NBS/S1930 (3.0(1)B11P219), RG-EG (3.0(1)B11P219), EAP/RAP (3.0(1)B11P219), and NBC controllers (AC 3.0(1)B11P219). The root cause is a vulnerabi...

PT-2023-25366 · Ibm · Ibm Security Guardium

Name of the Vulnerable Software and Affected Versions: IBM Security Guardium versions 10.6 through 11.5 Description: The issue allows a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. Recommendations: For versions 10.6 through 11.5...

The vulnerability of the Network Time Protocol determination function of the Zyxel NBG6604 switch allows a perpetrator to execute operating system commands.

The vulnerability of the Network Time Protocol NTP function of the Zyxel NBG6604 switch lies in the possibility of executing commands. Exploiting this vulnerability allows a remote attacker to execute operating system commands by sending a specially crafted HTTP request...

The vulnerability of the SaveUserSetting component in the SolarWinds Orion Platform software monitoring solution allows a hacker to execute arbitrary commands.

The vulnerability of the SaveUserSetting component in the SolarWinds Orion Platform software lies in the improper execution of certain actions. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

CVE-2023-33013

A post-authentication command injection vulnerability in the NTP feature of Zyxel NBG6604 firmware version V1.01ABIR.1C0 could allow an authenticated attacker to execute some OS commands remotely by sending a crafted HTTP request...

Zyxel NBG6604 操作系统命令注入漏洞

The Zyxel NBG6604 is a dual-band wireless router from China's Hopkins Zyxel. The Zyxel NBG6604 V1.01ABIR.1C0 suffers from a command injection vulnerability that stems from a failure to properly filter constructed command special characters, commands, etc. in the NTP function. An attacker can...

The vulnerability of the upgrade_handler() functions in the microprogramming software for Netgear WG302v2 and Netgear WAG302v2 allows a hacker to execute arbitrary commands.

The vulnerability of the upgradehandler function in Netgear WG302v2 and Netgear WAG302v2 routers lies in the lack of measures to neutralize special elements during the processing of parameters firmwareRestore and firmwareServerip. Exploiting this vulnerability allows a remote attacker to execute...

PT-2023-4532 · Phoenix Contact · Phoenix Contact Wp 6Xxx Series Web Panels

Name of the Vulnerable Software and Affected Versions: PHOENIX CONTACT WP 6xxx series web panels versions prior to 4.0.10 Description: The issue is related to the SNMP daemon running with root privileges, allowing a remote attacker with knowledge of the SNMPv2 read/write community string to execu...

The vulnerability of the cgi-bin/hosts_dns.tcl component of the Gaia Portal web interface allows a perpetrator to execute arbitrary commands on the Quantum Security Gateways and Quantum Appliances operating systems.

The vulnerability of the cgi-bin/hostsdns.tcl web interface for configuring the Gaia Portal on the operating system of Quantum Security Gateways and Quantum Appliances is related to the failure to eliminate special elements used in the operating system’s command processing when handling the...

CVE-2023-38943

ShuiZe0x727 v1.0 was discovered to contain a remote command execution RCE vulnerability via the component /iniFile/config.ini...

CVE-2023-38943

ShuiZe0x727 v1.0 was discovered to contain a remote command execution RCE vulnerability via the component /iniFile/config.ini...

CVE-2023-38943

ShuiZe0x727 v1.0 was discovered to contain a remote command execution RCE vulnerability via the component /iniFile/config.ini...

CVE-2023-38943

ShuiZe_0x727 v1.0 contains a remote command execution (RCE) vulnerability via the component /iniFile/config.ini. CVSS 3.1 metrics indicate NETWORK vector, high impact to confidentiality, integrity, and availability (8.8). No remediation details or in‑the‑wild exploitation information are provided...

CVE-2023-38943

ShuiZe0x727 v1.0 was discovered to contain a remote command execution RCE vulnerability via the component /iniFile/config.ini...

PT-2023-26700 · Unknown · Shuize 0X727

Name of the Vulnerable Software and Affected Versions: ShuiZe 0x727 version 1.0 Description: A remote command execution issue was found in the component /iniFile/config.ini, allowing for potential exploitation. Recommendations: For ShuiZe 0x727 version 1.0, consider restricting access to the...

CVE-2023-33377

Connected IO v2.1.0 and prior has an OS command injection vulnerability in the set firewall command in part of its communication protocol, enabling attackers to execute arbitrary OS commands on devices...

CVE-2023-33376

Connected IO v2.1.0 and prior has an argument injection vulnerability in its iptables command message in its communication protocol, enabling attackers to execute arbitrary OS commands on devices...

CVE-2023-33374

Connected IO v2.1.0 and prior has a command as part of its communication protocol allowing the management platform to specify arbitrary OS commands for devices to execute. Attackers abusing this dangerous functionality may issue all devices OS commands to execute, resulting in arbitrary remote...