17422 matches found
CVE-2023-36183
Buffer Overflow vulnerability in OpenImageIO v.2.4.12.0 and before allows a remote to execute arbitrary code and obtain sensitive information via a crafted file to the readimg function...
CVE-2020-22151
Permissions vulnerability in Fuel-CMS v.1.4.6 allows a remote attacker to execute arbitrary code via a crafted zip file to the assests parameter of the upload function...
Iranian Hackers Using POWERSTAR Backdoor in Targeted Espionage Attacks
Charming Kitten, the nation-state actor affiliated with Iran's Islamic Revolutionary Guard Corps IRGC, has been attributed to a bespoke spear-phishing campaign that delivers an updated version of a fully-featured PowerShell backdoor called POWERSTAR. "There have been improved operational security...
Delta Electronics InfraSuite Device Master
1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Delta Electronics Equipment: InfraSuite Device Master Vulnerabilities: Improper Access Control, Deserialization of Untrusted Data 2. RISK EVALUATION Successful exploitation of these...
Trend Micro Apex One Path Traversal Vulnerability
Trend Micro Apex One is an endpoint protection software from Trend Micro. Trend Micro Apex One suffers from a path traversal vulnerability, which arises when the program fails to properly filter for specific elements in the path of a resource or file, and can be exploited by an attacker to upload...
CVE-2023-21197
In btmaclprocessscacmplpkt of btmacl.cc, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:...
The vulnerability of the JavaScript script handler in Google Chrome’s V8 engine allows attackers to execute arbitrary code.
The vulnerability of the JavaScript script handler in Google Chrome’s V8 engine is related to access to resources through incompatible types. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
PT-2023-3301 · Google +3 · Google Chrome +4
Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 114.0.5735.198 Description: The issue is related to a type confusion vulnerability in the V8 engine of Google Chrome, allowing a remote attacker to potentially exploit heap corruption via a crafted HTML page...
VulnCheck KEV: CVE-2023-27992
Multiple Zyxel network-attached storage NAS devices contain a pre-authentication command injection vulnerability that could allow an unauthenticated attacker to execute commands remotely via a crafted HTTP request...
PT-2023-22611 · Raspap · Raspap
Name of the Vulnerable Software and Affected Versions: RaspAP raspap-webgui versions 2.8.8 and earlier Description: A command injection issue allows remote attackers to execute arbitrary commands by sending a crafted POST request to the hostapd settings form. This can be achieved via the hostapd...
RaspAP 命令注入漏洞
RaspAP is a simple wireless AP setup and management for Debian-based devices. RaspAP A command injection vulnerability exists in raspap-webgui version 2.8.8 and earlier versions, which originates from allowing a remote attacker to run arbitrary commands via a crafted POST request to the hostapd...
Zyxel Multiple NAS Devices Command Injection Vulnerability
Multiple Zyxel network-attached storage NAS devices contain a pre-authentication command injection vulnerability that could allow an unauthenticated attacker to execute commands remotely via a crafted HTTP request...
ROS-20230621-06
The vulnerability in ImageMagick graphical editor is related to writing outside and buffer overflow on a heap-based buffer overflow. Exploitation of the vulnerability could allow an attacker acting remotely to cause a crash of the of the application. The vulnerability in the ImageMagick graphical...
PT-2023-3483 · 1Panel · 1Panel
Name of the Vulnerable Software and Affected Versions: 1Panel versions prior to 1.3.6 Description: The issue is related to command injection when entering the container terminal in 1Panel, an open source Linux server operation and maintenance management panel. An authenticated attacker can craft...
PT-2023-25385 · Npm · @Backstage/Plugin-Scaffolder-Backend
Name of the Vulnerable Software and Affected Versions: @backstage/plugin-scaffolder-backend versions prior to 1.15.0 Description: The Backstage scaffolder-backend plugin uses a templating library that requires a sandbox, allowing for code injection. A malicious actor with write access to a...
PT-2023-3543 · 1Panel · 1Panel
Name of the Vulnerable Software and Affected Versions: 1Panel versions prior to 1.3.6 Description: The issue is related to command injection when adding container repositories. An authenticated attacker can craft a malicious payload to achieve this. The vulnerability is due to the lack of proper...
CVE-2020-21325
An issue in WUZHI CMS v.4.1.0 allows a remote attacker to execute arbitrary code via the setchache method of the function\common.func.php file...
CVE-2020-21474
File Upload vulnerability in NucleusCMS v.3.71 allows a remote attacker to execute arbitrary code via the /nucleus/plugins/skinfiles/?dir=rsd parameter...