PT-2024-6682 · Tenda · Tenda Fh1206

Name of the Vulnerable Software and Affected Versions: Tenda FH1206 version 1.2.0.88155 Description: A critical issue affects the function fromGstDhcpSetSer of the file /goform/GstDhcpSetSer. The manipulation of the argument dips leads to a buffer overflow. This can be exploited remotely, allowin...

Calibre 7.15.0 Python Code Injection

class MetasploitModule 'Calibre Python Code Injection CVE-2024-6782', 'Description' = %q This module exploits a Python code injection vulnerability in the Content Server component of Calibre v6.9.0 - v7.15.0. Once enabled disabled by default, it will listen in its default configuration on all...

The vulnerability of the OLE DB driver for SQL Server, related to buffer overflows in the stack, allows a hacker to execute arbitrary code.

The vulnerability of the OLE DB driver for SQL Server is related to buffer overflow in the stack. Exploiting this vulnerability allows an attacker to execute arbitrary code remotely...

PT-2024-26035 · Librtp.So · Librtp.So

Name of the Vulnerable Software and Affected Versions: librtp.so versions prior to SMR Aug-2024 Release 1 Description: The issue is related to improper input validation, allowing remote attackers to execute arbitrary code with system privilege. User interaction is required to trigger this issue...

Tenda i22 安全漏洞

The Tenda i22 is a dual-band ceiling-mounted wireless access point from Tenda. Tenda i22 /goform/apPortalPhoneAuth Handling formApPortalPhoneAuth A stack overflow vulnerability exists that can be exploited by a remote attacker to submit a special request that can crash the application or can be...

The vulnerability of the OLE DB driver for SQL Server, related to insufficient validation of input data, allows a hacker to execute arbitrary code.

The vulnerability of the OLE DB driver for SQL Server is related to buffer overflow in the “heap”. Exploiting this vulnerability can allow a malicious actor to execute arbitrary code remotely...

SUSE CVE-1999-0067

phf CGI program allows remote command execution through shell metacharacters...

SUSE CVE-1999-0439

Buffer overflow in procmail before version 3.12 allows remote or local attackers to execute commands via expansions in the procmailrc configuration file...

CVE-2024-6782 Calibre Remote Code Execution

Improper access control in Calibre 6.9.0 7.14.0 allow unauthenticated attackers to achieve remote code execution...

ROS-20240806-06

Vulnerability of ruby-find-library-file function of EMACS text editor is related to incorrect neutralization of special elements. neutralization of special elements. Exploitation of the vulnerability could allow an attacker to execute arbitrary code Vulnerability in the lib-src/etags.c file of th...

PT-2024-6460 · D Link · D-Link Di 8004W

Name of the Vulnerable Software and Affected Versions: D-Link DI 8004W version 16.07.26A1 Description: The issue is related to a command execution vulnerability in the msp info htm function of the jhttpd module. This vulnerability may allow a remote attacker to execute arbitrary commands. The...

ROS-20240806-21

Vulnerability of JDBC driver pgjdbc for connecting Java programs to PostgreSQL database is related to Lack of verification of the class implementation of the expected interface. Exploitation of the vulnerability could allow an attacker acting remotely to execute arbitrary code through the...

CVE-2024-34344

Nuxt is a free and open-source framework to create full-stack web applications and websites with Vue.js. Due to the insufficient validation of the path parameter in the NuxtTestComponentWrapper, an attacker can execute arbitrary JavaScript on the server side, which allows them to execute arbitrar...

Pimax Play and PiTool accept WebSocket connections from unintended endpoints

Overview Pimax Play and PiTool provided by Pimax accept WebSocket connections from unintended endpoints CWE-923. Rei Yano reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact Arbitrary code may be executed by a...

Ivanti Virtual Traffic Manager Authentication Bypass (CVE-2024-7593)

This module exploits an access control issue in Ivanti Virtual Traffic Manager vTM, by adding a new administrative user to the web interface of the application. Affected versions include 22.7R1, 22.6R1, 22.5R1, 22.3R2, 22.3, 22.2. Module Options msf use auxiliary/admin/http/ivanti/vtmadmin msf...

PT-2024-5396 · Raisecom · Raisecom Msg2200 +3

Name of the Vulnerable Software and Affected Versions: Raisecom MSG1200, MSG2100E, MSG2200 and MSG2300 version 3.90 Description: The issue is related to the function sslvpn config mod of the file /vpn/list vpn web custom.php in the web interface of the affected devices. It is caused by the failur...

CVE-2024-36268

Improper Control of Generation of Code 'Code Injection' vulnerability in Apache InLong. This issue affects Apache InLong: from 1.10.0 through 1.12.0, which could lead to Remote Code Execution. Users are advised to upgrade to Apache InLong's 1.13.0 or cherry-pick 1 to solve it. 1 ...

PT-2024-6567 · Aruba · Arubaos

Name of the Vulnerable Software and Affected Versions: ArubaOS affected versions not specified Description: An authenticated command injection issue exists in the ArubaOS command line interface, allowing successful exploitation to result in the ability to inject shell commands on the underlying...

PT-2024-28258 · Horizon Business Services Inc. · Caterease

Name of the Vulnerable Software and Affected Versions: Horizon Business Services Inc. Caterease versions 16.0.1.1663 through 24.0.1.2405 Description: The issue allows a remote attacker to expand control over the operating system from the database due to the execution of commands with unnecessary...

CVE-2024-38882

CVE-2024-38882 affects Horizon Business Services Inc. Caterease versions 16.0.1.1663–24.0.1.2405 (and possibly later). The issue is a remote command execution via SQL Injection caused by improper neutralization of special elements used in an OS command. Impact is high (remote, with high confident...