CVE-2024-33411

A SQL injection vulnerability in /model/getadminprofile.php in Campcodes Complete Web-Based School Management System 1.0 allows attacker to execute arbitrary SQL commands via the myindex parameter...

SQL Injection Vulnerability in Crypto M6 Integration Management Platform System of Xiamen Crypto Information Technology Company Limited (CNVD-2024-27112)

Ltd. is an innovative high-tech enterprise dedicated to the research and development of information integration management system. Xiamen Crypto Information Technology Co., Ltd. Crypto M6 Integration Management Platform system suffers from a SQL injection vulnerability, which can be exploited by ...

CVE-2024-33405

SQL injection vulnerability in addfriends.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to execute arbitrary SQL commands via the friendindex parameter...

The vulnerability of the QTS, QuTS Hero, QuTScloud, and myQNAPcloud operating systems exists due to the lack of measures taken to neutralize the special elements used in the operating system’s command set. This allows attackers to execute arbitrary commands.

The vulnerability of the QTS, QuTS Hero, QuTScloud, and myQNAPcloud operating systems exists due to the lack of measures taken to neutralize the special elements used in the operating system commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

CVE-2023-37407

IBM Aspera Orchestrator 4.0.1 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-Force ID: 260116...

CVE-2023-37407 IBM Aspera Orchestrator command execution

IBM Aspera Orchestrator 4.0.1 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-Force ID: 260116...

The vulnerability of the svc_tcpdump utility in the Dell Unity Operating Environment’s management and data storage system allows a hacker to execute arbitrary commands.

The vulnerability of the svctcpdump utility in the Dell Unity Operating Environment’s storage management and functioning system exists due to the lack of measures taken to neutralize special elements used in the operating system’s commands. Exploiting this vulnerability allows an attacker to...

The vulnerability of the host_deny script in the Wazuh intrusion detection and prevention system allows a perpetrator to escalate their privileges and execute arbitrary commands.

The vulnerability of the hostdeny script in the Wazuh intrusion detection and prevention system is related to the lack of IP address checking for blocking incoming connections due to incorrect code generation. Exploiting this vulnerability allows a remote attacker to enhance their privileges and...

Security Bulletin: IBM Aspera Orchestrator affected by a command injection vulnerability (CVE-2023-37407)

Summary IBM Aspera Orchestrator has addressed a vulnerability that could allow execution of arbitrary code CVE-2023-37407. Vulnerability Details CVEID:CVE-2023-37407 DESCRIPTION: IBM Aspera Orchestrator could allow a remote authenticated attacker to execute arbitrary commands on the system by...

CVE-2024-31966

A vulnerability on Mitel 6800 Series and 6900 Series SIP Phones through 6.3 SP3 HF4, 6900w Series SIP Phone through 6.3.3, and 6970 Conference Unit through 5.1.1 SP8 allows an authenticated attacker with administrative privilege to conduct an argument injection attack due to insufficient paramete...

CVE-2024-31963

A vulnerability on Mitel 6800 Series and 6900 Series SIP Phones through 6.3 SP3 HF4, 6900w Series SIP Phone through 6.3.3, and 6970 Conference Unit through 5.1.1 SP8 allows an authenticated attacker to conduct a buffer overflow attack due to insufficient bounds checking and input sanitization. A...

CVE-2024-31963

A vulnerability on Mitel 6800 Series and 6900 Series SIP Phones through 6.3 SP3 HF4, 6900w Series SIP Phone through 6.3.3, and 6970 Conference Unit through 5.1.1 SP8 allows an authenticated attacker to conduct a buffer overflow attack due to insufficient bounds checking and input sanitization. A...

CVE-2024-31966

The CVE-2024-31966 issue affects Mitel 6800 Series and 6900 Series SIP Phones (through 6.3 SP3 HF4), Mitel 6900w Series SIP Phone (through 6.3.3), and Mitel 6970 Conference Unit (through 5.1.1 SP8). The root cause is insufficient parameter sanitization, allowing an authenticated attacker with adm...

Meinberg LANTIME Improper Filename Validation of the Upload Function (CVE-2023-1731)

In Meinbergs LTOS versions prior to V7.06.013, the configuration file upload function would not correctly validate the input, which would allow an remote authenticated attacker with high privileges to execute arbitrary commands. This plugin only works with Tenable.ot. Please visit...

CVE-2024-31963

Mitel 6800/6900 Series SIP Phones (through 6.3 SP3 HF4; 6900w through 6.3.3; 6970 Conference Unit through 5.1.1 SP8) are affected by a buffer overflow caused by insufficient bounds checking and input sanitization. The vulnerability allows an authenticated attacker to access sensitive information,...

CVE-2024-31966

A vulnerability on Mitel 6800 Series and 6900 Series SIP Phones through 6.3 SP3 HF4, 6900w Series SIP Phone through 6.3.3, and 6970 Conference Unit through 5.1.1 SP8 allows an authenticated attacker with administrative privilege to conduct an argument injection attack due to insufficient paramete...

CVE-2024-28764 IBM WebSphere Automation CSV injection

IBM WebSphere Automation 1.7.0 could allow an attacker with privileged access to the network to conduct a CSV injection. An attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 285623...

CVE-2024-28764 IBM WebSphere Automation CSV injection

IBM WebSphere Automation 1.7.0 could allow an attacker with privileged access to the network to conduct a CSV injection. An attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 285623...

CVE-2024-28764

IBM WebSphere Automation 1.7.0 is affected by a CSV injection vulnerability caused by improper validation of CSV file contents. An attacker with privileged network access could execute arbitrary commands on the system (impacting confidentiality, integrity, and availability). The issue stems from ...

Security Bulletin: Vulnerabilities in OpenSSH, Linux Kernel might affect IBM Storage Copy Data Management

Summary IBM Storage Copy Data Management can be affected by vulnerabilities in OpenSSL and Linux Kernel. A remote or local authenticated attacker could exploit these vulnerabilities to break SSH extension negotiation and downgrading the client connection security, to cause the system to crash, to...