PT-2023-25199

Name of the Vulnerable Software and Affected Versions Avaya Call Management System CMS Supervisor affected versions not specified Description A CSV injection issue was found in the Avaya Call Management System CMS Supervisor web application, allowing a user with administrative privileges to input...

CVE-2023-3527: Improper Neutralization of Formula Elements in a CSV File

A CSV injection vulnerability was found in the Avaya Call Management System CMS Supervisor web application which allows a user with administrative privileges to input crafted data which, when exported to a CSV file, may attempt arbitrary command execution on the system used to open the file by a...

1Panel Operating System Command Injection Vulnerability

1Panel is an open source Linux server operations and management panel for the Chinese 1panel community. Operating system command injection vulnerability exists in versions prior to 1Panel 1.4.3. The vulnerability stems from the presence of an operating system command injection vulnerability, whic...

CVE-2023-37265

CasaOS is an open-source Personal Cloud system. Due to a lack of IP address verification an unauthenticated attackers can execute arbitrary commands as "root" on CasaOS instances. The problem was addressed by improving the detection of client IP addresses in "391dd7f". This patch is part of CasaO...

CVE-2023-37265: Missing Authentication for Critical Function

CasaOS is an open-source Personal Cloud system. Due to a lack of IP address verification an unauthenticated attackers can execute arbitrary commands as root on CasaOS instances. The problem was addressed by improving the detection of client IP addresses in 391dd7f. This patch is part of CasaOS...

CVE-2023-37567

Command injection vulnerability in ELECOM and LOGITEC wireless LAN routers allows a remote unauthenticated attacker to execute an arbitrary command by sending a specially crafted request to a certain port of the web management page. Affected products and versions are as follows: WRC-1167GHBK3-A...

CVE-2023-37568

ELECOM wireless LAN routers WRC-1167GHBK-S v1.03 and earlier, and WRC-1167GEBK-S v1.03 and earlier allow a network-adjacent authenticated attacker to execute an arbitrary command by sending a specially crafted request to the web management page...

Command injection

Command injection vulnerability in ELECOM and LOGITEC wireless LAN routers allows a remote unauthenticated attacker to execute an arbitrary command by sending a specially crafted request to a certain port of the web management page. Affected products and versions are as follows: WRC-1167GHBK3-A...

Command injection

Command injection vulnerability in ELECOM and LOGITEC wireless LAN routers allows a network-adjacent authenticated attacker to execute an arbitrary command by sending a specially crafted request to the web management page. Affected products and versions are as follows: WRC-1167GHBK3-A v1.24 and...

CVE-2023-37568

ELECOM wireless LAN routers WRC-1167GHBK-S v1.03 and earlier, and WRC-1167GEBK-S v1.03 and earlier allow a network-adjacent authenticated attacker to execute an arbitrary command by sending a specially crafted request to the web management page...

CVE-2023-37568

ELECOM wireless LAN routers WRC-1167GHBK-S v1.03 and earlier, and WRC-1167GEBK-S v1.03 and earlier allow a network-adjacent authenticated attacker to execute an arbitrary command by sending a specially crafted request to the web management page...

CVE-2023-37567

Command injection vulnerability in ELECOM and LOGITEC wireless LAN routers allows a remote unauthenticated attacker to execute an arbitrary command by sending a specially crafted request to a certain port of the web management page. Affected products and versions are as follows: WRC-1167GHBK3-A...

CVE-2023-37567

Command injection vulnerability in ELECOM and LOGITEC wireless LAN routers allows a remote unauthenticated attacker to execute an arbitrary command by sending a specially crafted request to a certain port of the web management page. Affected products and versions are as follows: WRC-1167GHBK3-A...

CVE-2023-37566

Command injection vulnerability in ELECOM and LOGITEC wireless LAN routers allows a network-adjacent authenticated attacker to execute an arbitrary command by sending a specially crafted request to the web management page. Affected products and versions are as follows: WRC-1167GHBK3-A v1.24 and...

CVE-2023-37568: Improper Neutralization of Special Elements used in a Command

ELECOM wireless LAN routers WRC-1167GHBK-S v1.03 and earlier, and WRC-1167GEBK-S v1.03 and earlier allow a network-adjacent authenticated attacker to execute an arbitrary command by sending a specially crafted request to the web management page...

CVE-2023-38198

acme.sh before 3.0.6 runs arbitrary commands from a remote server via eval, as exploited in the wild in June 2023...

WAVLINK WL-WN531AX2 Arbitrary Command Execution

The vulnerability of the WAVLINK WL-WN531AX2 router’s microprogramming software is related to the implementation of security functions at the client side. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

ELECOM WRC Command Injection Vulnerability

ELECOM WRC is a home-ready IP camera from ELECOM Japan. Command injection vulnerability exists in ELECOM WRC-1167FEBK-A v1.18 and earlier, WRC-1167GEBK-S v1.03 and earlier, WRC-1167GHBK-S v1.03 and earlier, WRC-1167GHBK3-A v1.24 and earlier, which originates from the presence of a command injecti...

Arbitrary command execution on Windows

Description Opening files from an untrusted directory can lead to execution of arbitrary commands on Windows systems, this is possible by having a malicious file with the same name as a trusted executable, Windows gives priority to the current directory when searching for executables. Several...

CVE-2023-28958: Improper Neutralization of Formula Elements in a CSV File

IBM Watson Knowledge Catalog on Cloud Pak for Data 4.0 is potentially vulnerable to CSV Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 251782...