CVE-2023-41724

Ivanti Standalone Sentry is affected by CVE-2023-41724, a remote code execution/command-injection vulnerability in which an unauthenticated threat actor can execute arbitrary commands on the appliance’s underlying OS when on the same network. The vulnerability affects Standalone Sentry versions p...

CVE-2023-41724

A command injection vulnerability in Ivanti Sentry prior to 9.19.0 allows unauthenticated threat actor to execute arbitrary commands on the underlying operating system of the appliance within the same physical or logical network...

Ivanti Sentry 命令注入漏洞

Ivanti Sentry is an in-line gateway from Ivanti USA, Inc. It is used to manage, encrypt and protect traffic between mobile devices and back-end enterprise systems. A security vulnerability exists in Ivanti Sentry versions prior to 9.19.0. An attacker exploiting this vulnerability could execute...

CVE-2024-28009

Improper authentication vulnerability in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP, WG1200HP2, W1200EX-MS, WG1200HS, WG1200HP, WF300HP2, W300P, WF800HP, WR8165N, WG2200HP, WF1200HP2, WG1800HP2, WF1200HP, WG600HP, WG300HP, WF300HP, WG1800HP,...

CVE-2024-28009

CVE-2024-28009 affects NEC Aterm router series (e.g., WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, W1200EX-MS, WG1200HS/HP, WF300HP2, WR8165N, WG1810HP, MR01LN/MR02LN, WM3400RN, WR8400N, etc.). The issue is an improper authentication vulnerability that enables an attacker to ...

NEC Aterm 安全漏洞

NEC Aterm is a series of wireless routers from Nippon Electric NEC. A security vulnerability exists in NEC Aterm that originates from an attacker with elevated privileges who can execute arbitrary operating system commands. The following products and versions are affected: WG1800HP4, WG1200HS3,...

PT-2024-22774 · Svr-116 · Svr-116

Name of the Vulnerable Software and Affected Versions: SVR-116 firmware version 1.6.0.30028871 Description: The issue allows a remote authenticated attacker with administrative privileges to execute arbitrary OS commands by sending a specially crafted request to the product. Recommendations: For...

CVE-2024-20306

A vulnerability in the Unified Threat Defense UTD configuration CLI of Cisco IOS XE Software could allow an authenticated, local attacker to execute arbitrary commands as root on the underlying host operating system. To exploit this vulnerability, an attacker must have level 15 privileges on the...

CVE-2024-20306

CVE-2024-20306 affects Cisco IOS XE with a vulnerability in the Unified Threat Defense (UTD) configuration CLI. An authenticated, local attacker with level 15 privileges can craft CLI input to execute arbitrary commands as root on the underlying OS due to inadequate input validation. The issue is...

CVE-2024-20306

A vulnerability in the Unified Threat Defense UTD configuration CLI of Cisco IOS XE Software could allow an authenticated, local attacker to execute arbitrary commands as root on the underlying host operating system. To exploit this vulnerability, an attacker must have level 15 privileges on the...

CVE-2024-28815

A vulnerability in the BluStar component of Mitel InAttend 2.6 SP4 through 2.7 and CMG 8.5 SP4 through 8.6 could allow access to sensitive information, changes to the system configuration, or execution of arbitrary commands within the context of the system...

Artica Proxy Unauthenticated PHP Deserialization Exploit

A command injection vulnerability in Artica Proxy appliance versions 4.50 and 4.40 allows remote attackers to run arbitrary commands via an unauthenticated HTTP request. The Artica Proxy administrative web application will deserialize arbitrary PHP objects supplied by unauthenticated users and...

CVE-2024-28815

A vulnerability in the BluStar component of Mitel InAttend 2.6 SP4 through 2.7 and CMG 8.5 SP4 through 8.6 could allow access to sensitive information, changes to the system configuration, or execution of arbitrary commands within the context of the system...

Cisco IOS XE Software 安全漏洞

Cisco IOS XE Software is an operating system from Cisco, Inc. A single operating system for enterprise wired and wireless access, aggregation, core, and WAN, Cisco IOS XE reduces business and network complexity. A security vulnerability exists in Cisco IOS XE Software, which stems from a...

OpenNMS Horizon 31.0.7 Remote Command Execution Exploit

This Metasploit module exploits built-in functionality in OpenNMS Horizon in order to execute arbitrary commands as the opennms user. For versions 32.0.2 and higher, this module requires valid credentials for a user with ROLEFILESYSTEMEDITOR privileges and either ROLEADMIN or ROLEREST. For versio...

CVE-2024-28815

A vulnerability in the BluStar component of Mitel InAttend 2.6 SP4 through 2.7 and CMG 8.5 SP4 through 8.6 could allow access to sensitive information, changes to the system configuration, or execution of arbitrary commands within the context of the system...

Artica Proxy Unauthenticated PHP Deserialization

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Artica Proxy Unauthenticated PHP Deserialization Vulnerability', 'Description' = %q A Command Injection vulnerability in Artica Proxy appliance...

CVE-2024-28815

CVE-2024-28815 affects Mitel InAttend BluStar component and Mitel CMG: InAttend 2.6 SP4 through 2.7, CMG 8.5 SP4 through 8.6. The vulnerability could allow access to sensitive information, changes to system configuration, or execution of arbitrary commands within the system context. Root cause is...

Code Injection

getgrav/grav is vulnerable to Code Injection. The vulnerability is due to unrestricted access to the twig extension class from the Grav context within twig.php, which allows attackers to redefine the escape function and execute arbitrary commands...

WebProxy vulnerable to OS command injection

Overview WebProxy provided by LunarNight Laboratory according to the original report submitted by the reporter is software to build a proxy server. WebProxy contains an OS command injection vulnerability CWE-78. During the meeting of Committee for authorizing the disclosure of unresolved...