Command injection

CoreDial sipXcom up to and including 21.04 is vulnerable to Improper Neutralization of Argument Delimiters in a Command. XMPP users are able to inject arbitrary arguments into a system command, which can be used to read files from, and write files to, the sipXcom server. This can also be leverage...

PT-2023-2620 · Nexx · Nexx Smart Alarm +2

Name of the Vulnerable Software and Affected Versions: Nexx Garage Door Controller versions NXG-100B, NXG-200 Nexx Smart Plug version NXPG-100W Nexx Smart Alarm version NXAL-100 Description: The issue is related to a lack of proper access control when executing actions on Nexx Smart Home devices...

CVE-2023-27762

Wondershare DemoCreator 6.0.0 is affected by CVE-2023-27762, where the democreator_setup_full7743.exe executable enables a local attacker with no privileges to cause arbitrary command execution (requires user interaction). The issue is tied to a specific setup-related binary, with high impact on ...

Wondershare 代码问题漏洞

Wondershare is a data transfer tool. A security vulnerability exists in Wondershare version v.10.6.3. An attacker exploiting this vulnerability can remotely execute commands via recoveritsetupfull4134.exe...

CVE-2023-27771

An issue found in Wondershare Technology Co.,Ltd Creative Centerr v.1.0.8 allows a remote attacker to execute arbitrary commands via the wondershareCCsetupfull10819.exe file...

CVE-2023-27763

Summary: CVE-2023-27763 affects Wondershare MobileTrans v4.0.2. The vulnerability lies in the launcher/file mobiletrans_setup_full5793.exe, which can be abused by a local attacker to execute arbitrary commands. The available documents confirm the vulnerable component and the ability to run remote...

PT-2023-21336 · Wondershare · Wondershare Pdf Reader

Name of the Vulnerable Software and Affected Versions: Wondershare Technology Co.,Ltd PDF Reader version 1.0.1 Description: An issue in Wondershare Technology Co.,Ltd PDF Reader allows a remote attacker to execute arbitrary commands via the pdfreader setup full13143.exe file. Recommendations: For...

CVE-2023-26777

CVE-2023-26777 affects Uptime Kuma v1.19.6 and earlier via Cross-Site Scripting in the status_page.js endpoint, allowing stored XSS through description/title/footer/incident creation parameters. Root cause: unsanitized input in the status page. Impact: remote attacker could run arbitrary JavaScri...

CVE-2023-27771

CVE-2023-27771 affects Wondershare Technology Co., Ltd. Creative Center v1.0.8. The vulnerability allows a remote attacker to execute arbitrary commands via the wondershareCC_setup_full10819.exe installer file. Public details describe the issue without detailing an official fixed version; some so...

CVE-2023-27769

An issue found in Wondershare Technology Co.,Ltd PDF Reader v.1.0.1 allows a remote attacker to execute arbitrary commands via the pdfreadersetupfull13143.exe file...

PT-2023-2229 · Sjqzhang · Go-Fastdfs

Name of the Vulnerable Software and Affected Versions: sjqzhang go-fastdfs versions up to 1.4.3 Description: The issue is related to a path traversal vulnerability in the file upload function of the sjqzhang go-fastdfs distributed file system. This vulnerability can be exploited by a remote...

SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Remote Command Execution (RCE)

Exploit Title: SOUND4 IMPACT/FIRST/PULSE/Eco v2.x - Remote Command Execution RCE Exploit Author: LiquidWorm Vendor: SOUND4 Ltd. Product web page: https://www.sound4.com | https://www.sound4.biz Affected version: FM/HD Radio Processing: Impact/Pulse/First Version 2: 1.1/2.15 Impact/Pulse/First...

CVE-2023-28731

AnyMailing Joomla Plugin is vulnerable to unauthenticated remote code execution, when being granted access to the campaign's creation on front-office due to unrestricted file upload allowing PHP code to be injected. This issue affects AnyMailing Joomla Plugin Enterprise in versions below 8.3.0...

Deserialization Vulnerability in U8 Cloud of UFIDA Network Technologies Co.

U8 Cloud is a digital platform for enterprises to go to the cloud, integrating transactions, services and management into a total ERP solution. A deserialization vulnerability exists in UFIDA U8 Cloud, which can be exploited by attackers to remotely execute commands...

The vulnerability of Hitachi Energy System Data Manager SDM600, related to the possibility of loading dangerous files, allows a hacker to execute arbitrary code.

The vulnerability of Hitachi Energy System Data Manager SDM600 relates to the ability to load files of a dangerous type. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

CVE-2022-43617

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Corel CorelDRAW Graphics Suite 23.5.0.506. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists...

CVE-2022-37349

This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the submitForm...

CVE-2022-28316

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.02.34. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists...

CVE-2022-28302

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.02.34. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists...

Design/Logic Flaw

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.02.34. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists...