CVE-2023-4542

A vulnerability was found in D-Link DAR-8000-10 up to 20230809. It has been classified as critical. This affects an unknown part of the file /app/sys1.php. The manipulation of the argument cmd with the input id leads to os command injection. It is possible to initiate the attack remotely. The...

PT-2023-4591 · D Link · D-Link Dar-8000-10

Name of the Vulnerable Software and Affected Versions: D-Link DAR-8000-10 up to 20230809 Description: A critical issue affects the file /app/sys1.php, where the manipulation of the cmd argument with the input id leads to os command injection. This can be initiated remotely. The exploit has been...

PT-2023-27640 · Phicomm · Phicomm K2

Name of the Vulnerable Software and Affected Versions: Phicomm k2 version 22.6.529.216 Description: The Phicomm k2 router contains a command injection vulnerability via the luci.sys.call function. This issue allows for remote command execution. Recommendations: For Phicomm k2 version 22.6.529.216...

New "Whiffy Recon" Malware Triangulates Infected Device Location via Wi-Fi Every Minute

The SmokeLoader malware is being used to deliver a new Wi-Fi scanning malware strain called Whiffy Recon on compromised Windows machines. "The new malware strain has only one operation. Every 60 seconds it triangulates the infected systems' positions by scanning nearby Wi-Fi access points as a da...

PT-2023-27685

Name of the Vulnerable Software and Affected Versions Tenda AC8 version US AC8V4.0si V16.03.34.06 cn Zyxel CPE affected versions not specified Description A stack overflow issue was discovered in Tenda AC8 via the firewallEn parameter at the "/goform/SetFirewallCfg" API endpoint. For Zyxel CPE...

CVE-2023-37424

A vulnerability in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation of this vulnerabilit...

CVE-2023-23564

An issue was discovered in Geomatika IsiGeo Web 6.0. It allows remote authenticated users to execute commands...

CVE-2023-4212 Trane Thermostats Injection

​A command injection vulnerability exists in Trane XL824, XL850, XL1050, and Pivot thermostats allowing an attacker to execute arbitrary commands as root using a specially crafted filename. The vulnerability requires physical access to the device via a USB stick...

PT-2023-25956 · Riverbed · Edgeconnect Sd-Wan Orchestrator

Name of the Vulnerable Software and Affected Versions: EdgeConnect SD-WAN Orchestrator affected versions not specified Description: A vulnerability in the EdgeConnect SD-WAN Orchestrator web-based management interface allows remote authenticated users to run arbitrary commands on the underlying...

PT-2023-25955 · Unknown · Edgeconnect Sd-Wan Orchestrator

Name of the Vulnerable Software and Affected Versions: EdgeConnect SD-WAN Orchestrator affected versions not specified Description: A vulnerability in the web-based management interface could allow an authenticated remote attacker to run arbitrary commands on the underlying host. Successful...

PT-2023-27298 · Cbc · Cbc

Name of the Vulnerable Software and Affected Versions: CBC products affected versions not specified Description: A hidden functionality vulnerability in the CBC products allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter its settings. The vendor has...

PT-2023-25952 · Aruba · Edgeconnect Sd-Wan Orchestrator

Name of the Vulnerable Software and Affected Versions: Aruba EdgeConnect SD-WAN Orchestrator affected versions not specified Description: A vulnerability in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an unauthenticated remote attacker to run arbitrary comman...

CVE-2023-25915

Due to improper input validation, an authenticated remote attacker could execute arbitrary commands on the target system...

CVE-2023-25915 Authenticated Remote Command Execution in Danfoss AK-SM800A

Due to improper input validation, an authenticated remote attacker could execute arbitrary commands on the target system...

CVE-2023-25915 Authenticated Remote Command Execution in Danfoss AK-SM800A

Due to improper input validation, an authenticated remote attacker could execute arbitrary commands on the target system...

CBC AMERICA 多款产品授权问题漏洞

CBC AMERICA DR series and CBC AMERICA NR series are a series of digital video recorders from CBC AMERICA. A security vulnerability exists in a number of CBC AMERICA products due to incorrect authentication, which can be exploited by a remote attacker to execute arbitrary operating system commands...

CBC AMERICA 多款产品安全漏洞

CBC AMERICA DR series and CBC AMERICA NR series are a series of digital video recorders from CBC AMERICA. A security vulnerability exists in a number of CBC AMERICA products. The vulnerability stems from the presence of an unknown function, which can be exploited by a remote attacker to execute...

Malicious code in marvelmaniac-devvit-rce (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis db9d8f161a565dceb33bc07806d7e65aae706550b73220940a4ff28cf2a50d5f The OpenSSF Package Analysis project identified 'marvelmaniac-devvit-rce' @ 1.0.3 npm as malicious. It is considered malicious because: - The...

CVE-2023-4414

A vulnerability was found in Byzoro Smart S85F Management Platform up to 20230807. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /log/decodmail.php. The manipulation of the argument file leads to command injection. The attack can be...

CVE-2023-4414

The CVE-2023-4414 entry concerns Byzoro/Beijing Baichuo Smart S85F Management Platform up to 20230807. Affected component: /log/decodmail.php. Issue: manipulation of the file argument leads to remote command injection. Impact is described as critical with high confidentiality, integrity, and avai...