17423 matches found
Sewio Real-Time Location System (RTLS) Studio 操作系统命令注入漏洞
Sewio Real-Time Location System RTLS Studio is a real-time location system from Sewio, Inc. An operating system command injection vulnerability exists in Sewio Real-Time Location System RTLS Studio versions 2.0.0 through 2.6.2, which stems from not properly validating the input module name of the...
Adobe Acrobat Reader DC resetForm Use-After-Free Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe Acrobat Reader DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...
CVE-2023-22279
MAHO-PBX NetDevancer Lite/Uni/Pro/Cloud prior to Ver.1.11.00, MAHO-PBX NetDevancer VSG Lite/Uni prior to Ver.1.11.00, and MAHO-PBX NetDevancer MobileGate Home/Office prior to Ver.1.11.00 allow a remote unauthenticated attacker to execute an arbitrary OS command...
ruby-git 代码注入漏洞
ruby-git is a Ruby library. It can be used to create, read, and manipulate Git repositories by wrapping system calls into git binaries. A security vulnerability exists in ruby-git v1.13.0 and earlier versions that could allow an authenticated, remote attacker to execute arbitrary ruby code by...
PT-2023-1189 · Oracle · Oracle Bi Publisher
Name of the Vulnerable Software and Affected Versions: Oracle BI Publisher versions 5.9.0.0.0, 6.4.0.0.0 and 12.2.1.4.0 Description: The issue is related to insufficient input validation in the Security component of Oracle BI Publisher, part of the Oracle Fusion Middleware platform. This can be...
The vulnerability of the JavaScript script handler in PDF viewer software like Foxit PDF Reader lies in the use of memory after it is freed, allowing an attacker to execute arbitrary JavaScript code.
The vulnerability of the JavaScript script handler in PDF viewer software, such as Foxit PDF Reader, relates to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to execute arbitrary JavaScript code remotely...
VulnCheck KEV: CVE-2022-44877
CWP Control Web Panel formerly CentOS Web Panel contains an OS command injection vulnerability that allows remote attackers to execute commands via shell metacharacters in the login parameter...
PT-2023-3630 · Ashlar Vellum · Ashlar-Vellum Cobalt
Name of the Vulnerable Software and Affected Versions: Ashlar-Vellum Cobalt affected versions not specified Description: This issue allows remote attackers to execute arbitrary code on affected installations. User interaction is required, where the target must visit a malicious page or open a...
CVE-2023-21548
Windows Secure Socket Tunneling Protocol SSTP Remote Code Execution Vulnerability...
PT-2023-2588 · Zyxel · Zyxel Nbg6604
Name of the Vulnerable Software and Affected Versions: Zyxel NBG6604 version V1.01ABIR.0C0 Description: The issue is related to a post-authentication command injection vulnerability. This could allow an authenticated attacker to execute some OS commands remotely by sending a crafted HTTP request...
Security Update for Microsoft Visual Studio Code (January 2023)
The version of Microsoft Visual Studio Code installed on the remote host is prior to 1.74.3 It is, therefore, affected by a remote execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands. Note that Nessus has not tested for these...
CVE-2022-44149
The web service on Nexxt Amp300 ARN02304U8 42.103.1.5095 and 80.103.2.5045 devices allows remote OS command execution by placing &telnetd in the JSON host field to the ping feature of the goform/sysTools component. Authentication is required...
Design/Logic Flaw
Improper validation of script alert plugin parameters in Apache DolphinScheduler to avoid remote command execution vulnerability. This issue affects Apache DolphinScheduler version 3.0.1 and prior versions; version 3.1.0 and prior versions. This attack can be performed only by authenticated users...
Linux malware leverages plugin exploits to backdoor WordPress sites
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary WordPress sites are being exploited by an unidentified strain of Linux malware that exploits flaws in plugins and compromises the sites by injecting malicious JavaScripts that are run sequentially until...
Google Android 安全漏洞
Google Android is a Linux-based open source operating system from Google Inc. in the United States. Google Android OS has a security vulnerability that stems from the Binder driver component of its kernel that allows an attacker to achieve remote code execution without additional execution...
PT-2023-14249 · Aruba · Aruba Clearpass Policy Manager
Name of the Vulnerable Software and Affected Versions: Aruba ClearPass Policy Manager versions 6.10.7 and below Aruba ClearPass Policy Manager versions 6.9.12 and below Description: The issue allows remote authenticated users to run arbitrary commands on the underlying host. Successful exploitati...
CVE-2022-45867
MyBB before 1.8.33 allows Directory Traversal. The Admin CP Languages module allows remote authenticated users, with high privileges, to achieve local file inclusion and execution...
PT-2023-14247 · Aruba · Aruba Clearpass Policy Manager
Name of the Vulnerable Software and Affected Versions: Aruba ClearPass Policy Manager versions 6.10.x through 6.10.7 and below Aruba ClearPass Policy Manager versions 6.9.x through 6.9.12 and below Description: Vulnerabilities in the ClearPass Policy Manager web-based management interface allow...
CVE-2022-42475
A heap-based buffer overflow vulnerability CWE-122 in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.10, 6.2.0 through 6.2.11, 6.0.15 and earlier and FortiProxy SSL-VPN 7.2.0 through 7.2.1, 7.0.7 and earlier may allow a remote unauthenticated attacker to execute...
