Wazuh security vulnerabilities

Wazuh is a Wazuh open source application. It is used to collect, aggregate, index and analyze security data to help organizations detect intrusions, threats and behavioral anomalies. A security vulnerability exists in Wazuh versions 4.2.0 through 4.7.2, which stems from a hostdeny that allows any...

CVE-2024-24992: Improper Limitation of a Pathname to a Restricted Directory

A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM...

CVE-2024-24997: Improper Limitation of a Pathname to a Restricted Directory

A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM...

CVE-2024-24998: Path Traversal: 'dir\..\..\filename'

A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM...

CVE-2024-24999: Improper Limitation of a Pathname to a Restricted Directory

A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM...

CVE-2024-23535: Improper Limitation of a Pathname to a Restricted Directory

A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM...

CVE-2023-50260: Improper Control of Generation of Code

Wazuh is a free and open source platform used for threat prevention, detection, and response. A wrong validation in the hostdeny script allows to write any string in the hosts.deny file, which can end in an arbitrary command execution on the target system. This vulnerability is part of the active...

CVE-2024-24994: Improper Limitation of a Pathname to a Restricted Directory

A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM...

svc_cbr utility Arbitrary Command Execution

The vulnerability of the svccbr utility in the Dell Unity Operating Environment OE storage system exists due to the lack of measures taken to neutralize the special elements used in the operating system’s commands. Exploiting this vulnerability can allow an attacker to execute arbitrary operating...

CVE-2023-39367

The set of Red Hat CVEs describe multiple issues affecting Peplink Smart Reader v1.2.0 (in QEMU): CVE-2023-39367 is an OS command injection in the web interface mac2name, exploitable by authenticated HTTP requests to execute commands; CVE-2023-40146 is a privilege-escalation via /bin/login that c...

CVE-2023-39367

An OS command injection vulnerability exists in the web interface mac2name functionality of Peplink Smart Reader v1.2.0 in QEMU. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability...

CVE-2023-39367

An OS command injection vulnerability exists in the web interface mac2name functionality of Peplink Smart Reader v1.2.0 in QEMU. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability...

Tenda FH1203 security vulnerabilities

Tenda FH1203 is a dual-band wireless router from Tenda China, mainly used for home network coverage. The Tenda FH1203 suffers from a command injection vulnerability that stems from the cmdinput parameter of the formexeCommand method failing to properly filter construct command special characters,...

Tenda AC7 security vulnerabilities

Tenda AC7 is a 1200M dual-band wireless router designed for large households by Tenda Technology, which adopts the 802.11ac standard and supports dual-band concurrent transmission with a wireless rate of up to 1167Mbps. Tenda AC7 suffers from a command injection vulnerability that stems from the...

Tenda W30E security vulnerabilities

Tenda W30E is an enterprise-grade wireless router designed for SOHO, small and micro business offices and small store networking, supporting Wi-Fi 6 technology. The Tenda W30E suffers from a command injection vulnerability that stems from the cmdinput parameter of the formexeCommand method failin...

PT-2024-24360

Name of the Vulnerable Software and Affected Versions Kohya ss versions prior to 23.1.5 Description Kohya ss, a GUI for Kohya's Stable Diffusion trainers, is vulnerable to command injection in the basic caption gui.py file. Recommendations For versions prior to 23.1.5, update to version 23.1.5 to...

nginxWebUI OS Command Injection Vulnerability

nginxWebUI is an nginx web configuration tool. An operating system command injection vulnerability exists in nginxWebUI, which stems from the file parameter of the /adminPage/main/upload file failing to properly filter constructed command special characters, commands, and so on. An attacker can...

Dell PowerProtect Data Manager Command Injection

The software of the centralized backup and disaster recovery system Dell PowerProtect Data Manager is vulnerable because measures are not taken to neutralize the special elements used in the operating system command set. Exploiting this vulnerability could allow a malicious actor to execute any...

CVE-2023-33806

Insecure default configurations in Hikvision Interactive Tablet DS-D5B86RB/B V2.3.0 build220119, allows attackers to execute arbitrary commands...

CVE-2024-30220

Command injection vulnerability in PLANEX COMMUNICATIONS wireless LAN routers allows a network-adjacent unauthenticated attacker to execute an arbitrary command by sending a specially crafted request to a certain port. Note that MZK-MF300N is no longer supported, therefore the update for this...