116 matches found
CVE-2023-48646
Zoho ManageEngine RecoveryManager Plus before 6070 allows admin users to execute arbitrary commands via proxy settings...
Vulnerability fixed in Ivanti MobileIron Sentry
Ivanti has fixed a vulnerability in MobileIron Sentry. A unauthenticated malicious person with access to the management interface could exploit the vulnerability to use API calls to manipulate the Sentry system and execute commands with administrator privileges. For successful misuse, the malicio...
matrix-appservice-irc IRC command injection via admin commands containing newlines
Impact It is possible to craft a command with newlines which would not be properly parsed. This would mean you could pass a string of commands as a channel name, which would then be run by the IRC bridge bot. Patches Versions 1.0.1 and above are patched. Workarounds There are no robust workaround...
GHSA-3PMJ-JQQP-2MJ3 matrix-appservice-irc IRC command injection via admin commands containing newlines
Impact It is possible to craft a command with newlines which would not be properly parsed. This would mean you could pass a string of commands as a channel name, which would then be run by the IRC bridge bot. Patches Versions 1.0.1 and above are patched. Workarounds There are no robust workaround...
CVE-2023-38690 matrix-appservice-irc IRC command injection via admin commands containing newlines
matrix-appservice-irc is a Node.js IRC bridge for Matrix. Prior to version 1.0.1, it is possible to craft a command with newlines which would not be properly parsed. This would mean you could pass a string of commands as a channel name, which would then be run by the IRC bridge bot. Versions 1.0....
PT-2023-4417 · Solarwinds · Solarwinds Orion Platform
Name of the Vulnerable Software and Affected Versions: SolarWinds Orion Platform affected versions not specified Description: The issue is related to an incorrect comparison vulnerability in the UpdateActionsProperties method of the SolarWinds Orion Platform. This vulnerability allows a remote...
CVE-2023-33443
Incorrect access control in the administrative functionalities of BES--6024PB-I50H1 VideoPlayTool v2.0.1.0 allow attackers to execute arbitrary administrative commands via a crafted payload sent to the desired endpoints...
PT-2023-3000 · Juniper Networks · Junos Evolved
Name of the Vulnerable Software and Affected Versions: Juniper Networks Junos OS Evolved versions prior to 20.4R3-S5-EVO Juniper Networks Junos OS Evolved 21.2 versions prior to 21.2R3-EVO Juniper Networks Junos OS Evolved 21.3 versions prior to 21.3R2-EVO Juniper Networks Junos OS Evolved 21.4...
Aztech WMB250AC 命令注入漏洞
The Aztech WMB250AC is a wireless router from Aztech. A security vulnerability exists in the Aztech WMB250AC Mesh Routers Firmware version 016 2020 that stems from incorrectly managing sessions. An attacker could use the vulnerability to bypass authentication and execute arbitrary commands with...
多款Panasonic产品跨站请求伪造漏洞
The Panasonic VCC-HD5600P, among others, is a surveillance camera from Panasonic Corporation Panasonic of Japan. A cross-site request forgery vulnerability exists in multiple Panasonic products, versions 1.02-05 and 2.03-0x, which stems from vulnerability to cross-site request forgery attacks. An...
CVE-2022-43553
A remote code execution vulnerability in EdgeRouters Version 2.0.9-hotfix.4 and earlier allows a malicious actor with an operator account to run arbitrary administrator commands.This vulnerability is fixed in Version 2.0.9-hotfix.5 and later...
GHSA-9R7G-325H-MXRM Improper Authentication in Apache Hadoop
Apache Hadoop 0.23.x before 0.23.11 and 2.x before 2.4.1, as used in Cloudera CDH 5.0.x before 5.0.2, do not check authorization for the 1 refreshNamenodes, 2 deleteBlockPool, and 3 shutdownDatanode HDFS admin commands, which allows remote authenticated users to cause a denial of service DataNode...
CVE-2022-20739
A vulnerability in the CLI of Cisco SD-WAN vManage Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system as the root user. The attacker must be authenticated on the affected system as a low-privileged user to exploit this...
GHSA-86F3-HF24-76Q4 Use of Hard-coded Cryptographic Key in Netmaker
Impact There is a hard-coded cryptographic key in the code base which can be exploited to run admin commands on a remote server, if you know the address and username of the admin. This effects the server netmaker component, and not clients. Patches This has been patched in Netmaker v0.8.5, v0.9.4...
Hardcoded credentials
Netmaker is a platform for creating and managing virtual overlay networks using WireGuard. Prior to versions 0.8.5, 0.9.4, and 010.0, there is a hard-coded cryptographic key in the code base which can be exploited to run admin commands on a remote server if the exploiter know the address and...
CVE-2022-23650
Netmaker server component contains a hard-coded cryptographic key that, prior to v0.8.5, v0.9.4, and v0.10.0, could be exploited to run admin commands on a remote server if the attacker knows the admin’s address and username. The issue is limited to the Netmaker server and not clients. Patches ar...
CVE-2022-23650 Use of Hard-coded Cryptographic Key in Netmaker
Netmaker is a platform for creating and managing virtual overlay networks using WireGuard. Prior to versions 0.8.5, 0.9.4, and 010.0, there is a hard-coded cryptographic key in the code base which can be exploited to run admin commands on a remote server if the exploiter know the address and...
PT-2022-16161
Name of the Vulnerable Software and Affected Versions Netmaker versions prior to 0.8.5 Netmaker versions prior to 0.9.4 Netmaker versions prior to 0.10.0 Description The issue is related to a hard-coded cryptographic key in the code base of Netmaker, a platform for creating and managing virtual...
CVE-2021-42758
An improper access control vulnerability CWE-284 in FortiWLC 8.6.1 and below may allow an authenticated and remote attacker with low privileges to execute any command as an admin user with full access rights via bypassing the GUI restrictions...