IBM AIX security vulnerabilities

IBM AIX Advanced Interactive eXecutive is a UNIX operating system developed by IBM. An elevation of privilege vulnerability exists in IBM AIX, which can be exploited by an attacker to execute arbitrary commands...

CVE-2023-25507

NVIDIA DGX-1 BMC contains a vulnerability in the SPX REST API, where an attacker with the appropriate level of authorization can inject arbitrary shell commands, which may lead to code execution, denial of service, information disclosure, and data tampering...

CVE-2023-30621

Gipsy is a multi-purpose discord bot which aim to be as modular and user-friendly as possible. In versions prior to 1.3 users can run command on the host machine with sudoer permission. The !ping command when provided with an IP or hostname used to run a bash ping without verification that the IP...

Command injection

Gipsy is a multi-purpose discord bot which aim to be as modular and user-friendly as possible. In versions prior to 1.3 users can run command on the host machine with sudoer permission. The !ping command when provided with an IP or hostname used to run a bash ping without verification that the IP...

CVE-2023-30621 OS command injection in Gipsy

Gipsy is a multi-purpose discord bot which aim to be as modular and user-friendly as possible. In versions prior to 1.3 users can run command on the host machine with sudoer permission. The !ping command when provided with an IP or hostname used to run a bash ping without verification that the IP...

CVE-2023-30621

Gipsy (Curiosity Open Source)

CVE-2023-30621: Improper Neutralization of Special Elements used in an OS Command

Gipsy is a multi-purpose discord bot which aim to be as modular and user-friendly as possible. In versions prior to 1.3 users can run command on the host machine with sudoer permission. The !ping command when provided with an IP or hostname used to run a bash ping without verification that the IP...

CVE-2022-36963: Improper Control of Generation of Code

The SolarWinds Platform was susceptible to the Command Injection Vulnerability. This vulnerability allows a remote adversary with a valid SolarWinds Platform admin account to execute arbitrary commands...

CVE-2022-3874

A command injection flaw was found in foreman. This flaw allows an authenticated user with admin privileges on the foreman instance to transpile commands through CoreOS and Fedora CoreOS configurations in templates, possibly resulting in arbitrary command execution on the underlying operating...

CVE-2023-20865

VMware Aria Operations for Logs contains a command injection vulnerability. A malicious actor with administrative privileges in VMware Aria Operations for Logs can execute arbitrary commands as root...

D-Link DIR820LA1 ping.ccp Command Execution

The vulnerability of the ping.ccp component of the D-Link DIR820LA1 router’s microprogramming software exists due to the lack of measures taken to neutralize the special elements used in the operating system commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary...

PT-2023-2386 · Cisco · Cisco Industrial Network Director

Name of the Vulnerable Software and Affected Versions: Cisco Industrial Network Director affected versions not specified Description: The issue exists due to improper input validation when uploading a Device Pack, allowing an authenticated, remote attacker to execute arbitrary commands with...

Red Hat Satellite operating system command injection vulnerability

Red Hat Satellite is a system management platform from Red Hat. The platform can be used to extend Linux infrastructures and provide system management functions such as administration, configuration, and monitoring. A security vulnerability exists in Red Hat Satellite, which originates in the...

CVE-2021-28254

A deserialization vulnerability in the destruct function of Laravel v8.5.9 allows attackers to execute arbitrary commands...

PT-2023-12125 · Laravel · Laravel

Name of the Vulnerable Software and Affected Versions: Laravel version 8.5.9 Description: A deserialization vulnerability in the destruct function allows attackers to execute arbitrary commands. Recommendations: For Laravel version 8.5.9, consider disabling the destruct function until a patch is...

Laravel code issues and vulnerabilities

Laravel is a web application framework from the Laravel community. A security vulnerability exists in Laravel version v8.5.9 that stems from the presence of a deserialization vulnerability that allows an attacker to execute arbitrary commands...

SipXopenfire Plugin Privilege Escalation

The vulnerability lies in the function initializePlugin of the sipXopenfire\presence-plugin\src\org\sipfoundry\openfire\plugin\presence\SipXOpenfirePlugin.java file. In the PBX server of the corporate IP telephony management system, CoreDial sipXcom sipXopenfire relies on the implementation or...

Cisco Small Business: Input validation error vulnerability

Cisco Small Business is a switch from Cisco. An input validation error vulnerability exists in Cisco Small Business that originates from allowing an attacker to execute arbitrary commands in the web-based management interface. Affected products and versions: Cisco Small Business Routers RV016,...

PBX Server Openfire Privilege Escalation

The vulnerability of the /etc/init.d/openfire file in the CoreDial sipXcom sipXopenfire server of the corporate IP-telephony management system is related to improper privilege assignment. Exploiting this vulnerability could allow an attacker to enhance their privileges or execute arbitrary comman...

NETGEAR Orbi Satellite RBS750 Arbitrary Command Execution

The vulnerability of NETGEAR Orbi Satellite RBS750 router’s microprogramming software is related to the presence of undocumented commands. Exploiting this vulnerability could allow a remote attacker to execute arbitrary commands using a specially created package...