CVE-2023-33487

TOTOLINK X5000R V9.1.0u.6118B20201102 and V9.1.0u.6369B20230113 contains a command insertion vulnerability in setDiagnosisCfg.This vulnerability allows an attacker to execute arbitrary commands through the "ip" parameter...

CVE-2023-33486

TOTOLINK X5000R V9.1.0u.6118B20201102 and V9.1.0u.6369B20230113 contain a command insertion vulnerability in setOpModeCfg. This vulnerability allows an attacker to execute arbitrary commands through the "hostName" parameter...

TOTOLINK X5000R Command Injection Vulnerability

The TOTOLINK X5000R is a router from China's Gion Electronics TOTOLINK. A security vulnerability exists in TOTOLINK X5000R version V9.1.0u.6118B20201102 and V9.1.0u.6369B20230113, which stems from the presence of a command injection vulnerability that allows an attacker to execute arbitrary...

USN-6115-1 texlive-bin vulnerability

Max Chernoff discovered that LuaTeX TeX Live did not properly disable shell escape. An attacker could possibly use this issue to execute arbitrary shell commands...

CVE-2023-30601: Improper Privilege Management

Privilege escalation when enabling FQL/Audit logs allows user with JMX access to run arbitrary commands as the user running Apache Cassandra This issue affects Apache Cassandra: from 4.0.0 through 4.0.9, from 4.1.0 through 4.1.1. WORKAROUND The vulnerability requires nodetool/JMX access to be...

CVE-2023-33779

A lateral privilege escalation vulnerability in XXL-Job v2.4.1 allows users to execute arbitrary commands on another user's account via a crafted POST request to the component /jobinfo/...

CVE-2023-33779: Incorrect Authorization

A lateral privilege escalation vulnerability in XXL-Job v2.4.1 allows users to execute arbitrary commands on another user's account via a crafted POST request to the component /jobinfo/...

USN-6108-1 Jhead vulnerabilities

It was discovered that Jhead did not properly handle certain crafted images while rotating them. An attacker could possibly use this issue to crash Jhead, resulting in a denial of service. CVE-2021-34055 Kyle Brown discovered that Jhead did not properly handle certain crafted images while...

Oracle Linux 8 : emacs (ELSA-2023-3104)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2023-3104 advisory. 1:26.1-10.2 - Bump release 1:26.1-10.1 - Bump release 1:26.1-10 - Fix ob-latex.el command injection vulnerability 2180586 1:26.1-9 - Fix MH-E mail composition...

CVE-2023-31458: Undefined Security Weakness

A vulnerability in the Edge Gateway component of Mitel MiVoice Connect versions 19.3 SP2 22.24.1500.0 and earlier could allow an unauthenticated attacker with internal network access to authenticate with administrative privileges, because initial installation does not enforce a password change. A...

D-Link DIR-816 A2 Arbitrary Command Execution

The vulnerability of the /goform/Diagnosis component of D-Link DIR-816 A2 router microprogramming systems exists due to the failure to take measures to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary...

D-Link DIR-816 A2 Router Arbitrary Command Execution

The vulnerability of the /goform/form2systime.cgi microprogramming system for D-Link DIR-816 A2 exists due to the failure to take measures to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands...

D-Link DIR-816 A2 Router Arbitrary Command Execution

The vulnerability of the /goform/sylogapply component in the D-Link DIR-816 A2 router microprogramming system exists due to the lack of measures taken to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary...

Oracle Linux 8 : ctags (ELSA-2023-2863)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2023-2863 advisory. 5.8-23 - CVE-2022-4515, arbitrary code execution issue Resolves: rhbz2153787 Tenable has extracted the preceding description block directly from the Oracle Linu...

CVE-2023-28392

Wi-Fi AP UNIT AC-PD-WAPU v1.05B04 and earlier, AC-PD-WAPUM v1.05B04 and earlier, AC-PD-WAPU-P v1.05B04P and earlier, AC-PD-WAPUM-P v1.05B04P and earlier, AC-WAPU-300 v1.00B07 and earlier, AC-WAPU-300-P v1.00B08P and earlier, AC-WAPUM-300 v1.00B07 and earlier, and AC-WAPUM-300-P v1.00B08P and...

CVE-2023-27514

OS command injection vulnerability in the download page of SolarView Compact SV-CPT-MC310 versions prior to Ver.8.10 and SV-CPT-MC310F versions prior to Ver.8.10 allows a remote authenticated attacker to execute an arbitrary OS command...

CVE-2023-31826

Skyscreamer Open Source Nevado JMS v1.3.2 does not perform security checks when receiving messages. This allows attackers to execute arbitrary commands via supplying crafted data...

CVE-2023-31708

A Cross-Site Request Forgery CSRF in EyouCMS v1.6.2 allows attackers to execute arbitrary commands via a supplying a crafted HTML file to the Upload software format function...

Contec SolarView Compact operating system command injection vulnerability

Contec SolarView Compact is an application system from Contec Japan. It provides measurement system for photovoltaic power generation. A security vulnerability exists in Contec SolarView Compact SV-CPT-MC310 Ver.8.10 prior and SV-CPT-MC310F Ver.8.10 prior, which stems from the presence of an...

CVE-2023-31708

A Cross-Site Request Forgery CSRF in EyouCMS v1.6.2 allows attackers to execute arbitrary commands via a supplying a crafted HTML file to the Upload software format function...