CVE-2022-45600

Aztech WMB250AC Mesh Routers Firmware Version 016 2020 devices improperly manage sessions, which allows remote attackers to bypass authentication in opportunistic circumstances and execute arbitrary commands with administrator privileges by leveraging an existing web portal login...

K34931053: OpenSMTPD vulnerability CVE-2020-7247

Security Advisory Description smtpmailaddr in smtpsession.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated by shell metacharacters in a MAIL FROM field. This affects the...

K02692210: BIG-IP virtual server with HTTP Explicit Proxy and/or SOCKS vulnerability CVE-2017-6157

Security Advisory Description BIG-IP virtual servers with a configuration using the HTTP Explicit Proxy functionality and/or SOCKS profile are vulnerable to an unauthenticated, remote attack that allows modification of BIG-IP system configuration, extraction of sensitive system files, and/or...

K06024431: BIG-IQ vulnerability CVE-2021-23024

Security Advisory Description The BIG-IQ Configuration utility has an authenticated remote command execution vulnerability in undisclosed pages. CVE-2021-23024 Impact This vulnerability allows an authenticated admin user or a user account assigned with an administrator role and no shell access to...

K25570584: Apache Struts vulnerability CVE-2012-0394

Security Advisory Description DISPUTED The DebuggingInterceptor component in Apache Struts before 2.3.1.1, when developer mode is used, allows remote attackers to execute arbitrary commands via unspecified vectors. NOTE: the vendor characterizes this behavior as not "a security vulnerability...

K01362377: Ghostscript vulnerability CVE-2017-8291

Security Advisory Description Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile %pipe%" substring in a crafted .eps document that is an input to the gs program, as exploited in the wild in April 2017...

K2232: checktrap.pl script may be vulnerable to remote command execution

Security Advisory Description Note: Versions that are not listed in this Solution have not been evaluated for vulnerability to this security advisory. For information about F5 Networks' security policy regarding evaluating older and unsupported versions of F5 Networks products, see K4602: Overvie...

K02714910: TLS vulnerability CVE-2017-6164

Security Advisory Description In some circumstances, the Traffic Management Microkernel TMM does not properly handle certain malformed TLS1.2 records, which allows remote attackers to cause a denial-of-service DoS or possible remote command execution on the BIG-IP system. CVE-2017-6164 Impact A...

K03009991: iControl REST unauthenticated remote command execution vulnerability CVE-2021-22986

Security Advisory Description The iControl REST interface has an unauthenticated remote command execution vulnerability. CVE-2021-22986 Impact This vulnerability allows for unauthenticated attackers with network access to the iControl REST interface, through the BIG-IP management interface and se...

K55543151: BIG-IP TMUI vulnerability CVE-2021-23025

Security Advisory Description An authenticated remote command execution vulnerability exists in the BIG-IP Configuration utility. CVE-2021-23025 Impact This vulnerability may allow an authenticated attacker with network access to the Configuration utility through the BIG-IP management port and/or...

K18132488: Appliance mode TMUI authenticated remote command execution vulnerability CVE-2021-22987

Security Advisory Description When running in Appliance mode, the Traffic Management User Interface TMUI, also referred to as the Configuration utility, has an authenticated remote command execution vulnerability in undisclosed pages. CVE-2021-22987 Note : For systems not running in Appliance mod...

K70031188: TMUI authenticated remote command execution vulnerability CVE-2021-22988

Security Advisory Description The Traffic Management User Interface TMUI, also referred to as the Configuration utility, has an authenticated remote command execution vulnerability in undisclosed pages. CVE-2021-22988 Note : For systems running in Appliance mode, refer to K18132488 Appliance Mode...

K67501282: Overview of F5 vulnerabilities (June 2021)

Security Advisory Description On June 1, 2021, F5 announced the following security issues. This document is intended to serve as an overview of these vulnerabilities to help determine the impact to your F5 devices. You can find the details of each issue in the associated Security Advisory article...

K56142644: Appliance mode Advanced WAF/ASM TMUI authenticated remote command execution vulnerability CVE-2021-22989

Security Advisory Description When running in Appliance mode with Advanced WAF or ASM provisioned, the Traffic Management User Interface TMUI, also referred to as the Configuration utility, has an authenticated remote command execution vulnerability in undisclosed pages. CVE-2021-22989 Note : For...

K45056101: Advanced WAF/ASM TMUI authenticated remote command execution vulnerability CVE-2021-22990

Security Advisory Description On systems with Advanced WAF or BIG-IP ASM provisioned, the Traffic Management User Interface TMUI, also referred to as the Configuration utility, has an authenticated remote command execution vulnerability in undisclosed pages. CVE-2021-22990 Note : For systems...

K02566623: Overview of F5 vulnerabilities (March 2021)

Security Advisory Description On March 10th, 2021, F5 announced twenty-one 21 CVEs, including four Critical vulnerabilities. This document is intended to serve as an overview of these vulnerabilities to help determine the impact on your F5 devices. The details of each issue can be found in the...

K15877: Apache vulnerability CVE-2013-1862

Security Advisory Description modrewrite.c in the modrewrite module in the Apache HTTP Server 2.2.x before 2.2.25 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to execute arbitrary commands via an HTTP request containing an escape sequen...

The vulnerability of the command-line interface (CLI) implementation of Zyxel networking devices allows a perpetrator to execute arbitrary commands.

The vulnerability of CLI implementations for Zyxel network devices involves a lack of measures to neutralize special elements used in OS commands. Exploiting this vulnerability allows an attacker to execute arbitrary commands remotely...

RPyC 4.1.0 through 4.1.1 Remote Command Execution

This module allows remote command execution on RPyC versions 4.1.0 and 4.1.1. You will be able to execute a specified command on the target machine as the user running the RPyC service and view the output. Module Options msf use auxiliary/scanner/http/rpyc/rce msf undefinedrce show actions...

The vulnerability of the monitoring system for critical equipment, StruxureWare Data Center Expert, arises due to the failure to take measures to neutralize special elements used in the operating system’s command set. This allows a perpetrator to execute arbitrary commands.

The vulnerability of the StruxureWare Data Center Expert monitoring system exists because measures to neutralize special elements used in the operating system have not been taken. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands via the SSH protocol remotely...