Deserialization of untrusted data

In WSFTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WSFTP Server operating system...

CVE-2023-40044 WS_FTP Server Ad Hoc Transfer Module .NET Deserialization Vulnerability

In WSFTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WSFTP Server operating system...

CVE-2023-40044

In WSFTP Server versions prior to 8.7.4 and 8.8.2, a pre-authenticated attacker could leverage a .NET deserialization vulnerability in the Ad Hoc Transfer module to execute remote commands on the underlying WSFTP Server operating system. Recent assessments: sfewer-r7 at October 02, 2023 8:11am UT...

CVE-2023-35893

IBM Security Guardium 10.6, 11.3, 11.4, and 11.5 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-Force ID: 258824...

Rockwell Automation Armor PowerFlex Security Breach

Rockwell Automation Armor PowerFlex is a line of inverters from Rockwell Automation, Inc. A security vulnerability exists in the Rockwell Automation Armor PowerFlex that stems from a vulnerability that allows an attacker to send network commands to cause the product to generate a large amount of...

Locke-Bot SQL注入漏洞

Locke-Bot is a custom discord bot developed for LOCKE by HKing2802 Personal Developer. A security vulnerability exists in Locke-Bot version 2.0.2, which stems from an SQL injection vulnerability that allows remote attackers to run arbitrary SQL commands via a crafted string...

PT-2023-22560 · Prestashop · Prestashop Boxtal

Name of the Vulnerable Software and Affected Versions: PrestaShop Boxtal envoimoinscher module versions after 3.1.10 Description: A SQL injection issue allows remote attackers to execute arbitrary SQL commands via the key GET parameter. This affects the Boxtal module for PrestaShop...

Researchers Discover New Sophisticated Toolkit Targeting Apple macOS Systems

Cybersecurity researchers have uncovered a set of malicious artifacts that they say is part of a sophisticated toolkit targeting Apple macOS systems. "As of now, these samples are still largely undetected and very little information is available about any of them," Bitdefender researchers Andrei...

Malicious code in fc-amount (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware deda6264abf52468856de6a91a887594ca7b427f7093f2486999d3323f096408 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-27988

The post-authentication command injection vulnerability in the Zyxel NAS326 firmware versions prior to V5.21AAZF.13C0 could allow an authenticated attacker with administrator privileges to execute some operating system OS commands on an affected device remotely...

New COSMICENERGY Malware Exploits ICS Protocol to Sabotage Power Grids

A new strain of malicious software that's engineered to penetrate and disrupt critical systems in industrial environments has been unearthed. Google-owned threat intelligence firm Mandiant dubbed the malware COSMICENERGY, adding it was uploaded to the VirusTotal public malware scanning utility in...

libssh 授权问题漏洞

libssh is a C development package from the libssh organization for accessing SSH services that can perform remote commands, file transfers, and also provide a secure transport channel for remote programs. A security vulnerability exists in libssh that stems from not properly performing...

Serious Unpatched Vulnerability Uncovered in Popular Belkin Wemo Smart Plugs

The second generation version of Belkin's Wemo Mini Smart Plug has been found to contain a buffer overflow vulnerability that could be weaponized by a threat actor to inject arbitrary commands remotely. The issue, assigned the identifier CVE-2023-27217 , was discovered and reported to Belkin on...

PT-2023-2520 · Zyxel · Zyxel Dx5401-B0

Name of the Vulnerable Software and Affected Versions: ZyXEL DX5401-B0 firmware versions prior to V5.17ABYO.1C0 Description: The issue is related to a buffer overflow vulnerability in the libclinkc.so library of the zhttpd web server. This vulnerability could allow a remote unauthenticated attack...

The vulnerability of the graphical and application software interface of the FortiTester hardware-based diagnostic and audit software exists due to the failure to take measures to neutralize the special elements used in the operating system’s command set. This allows attackers to execute arbitrary commands.

The vulnerability of the graphical and application software interface of the FortiTester hardware-based diagnostic and audit software exists due to the failure to take measures to neutralize the special elements used in the operating system command set. Exploiting this vulnerability allows a...

CVE-2023-27767

An issue found in Wondershare Technology Co.,Ltd Dr.Fone v.12.4.9 allows a remote attacker to execute arbitrary commands via the drfonesetupfull3360.exe file...

PT-2023-21923 · Panasonic · Panasonic Aiseg2

Name of the Vulnerable Software and Affected Versions: Panasonic AiSEG2 versions 2.80F through 2.93A Description: The issue allows remote attackers to execute arbitrary OS commands. Recommendations: For versions 2.80F through 2.93A, update to a version that contains a fix for this issue. At the...

SUSE CVE-2007-6424

registry.pl in Fonality Trixbox 2.0 PBX products, when running in certain environments, reads and executes a set of commands from a remote web site without sufficiently validating the origin of the commands, which allows remote attackers to disable trixbox and execute arbitrary commands via a DNS...

SUSE CVE-2009-4491

thttpd 2.25b0 writes data to a log file without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal emulator...

SUSE CVE-2010-4098

monotone before 0.48.1, when configured to allow remote commands, allows remote attackers to cause a denial of service crash via an empty argument to the mtn command...