CVE-2023-33487

TOTOLINK X5000R V9.1.0u.6118B20201102 and V9.1.0u.6369B20230113 contains a command insertion vulnerability in setDiagnosisCfg.This vulnerability allows an attacker to execute arbitrary commands through the "ip" parameter...

Privilege escalation

Privilege escalation when enabling FQL/Audit logs allows user with JMX access to run arbitrary commands as the user running Apache Cassandra This issue affects Apache Cassandra: from 4.0.0 through 4.0.9, from 4.1.0 through 4.1.1. WORKAROUND The vulnerability requires nodetool/JMX access to be...

CVE-2023-30601

CVE-2023-30601 : Privilege escalation in Apache Cassandra when enabling FQL/Audit logs. A local attacker with nodetool/JMX access can execute arbitrary commands as the Cassandra process user due to a flaw in the FQL/Audit logs implementation. Affected versions: Cassandra 4.0.0–4.0.9 and 4.1.0–4.1...

CVE-2023-30601 Apache Cassandra: Privilege escalation when enabling FQL/Audit logs

Privilege escalation when enabling FQL/Audit logs allows user with JMX access to run arbitrary commands as the user running Apache Cassandra This issue affects Apache Cassandra: from 4.0.0 through 4.0.9, from 4.1.0 through 4.1.1. WORKAROUND The vulnerability requires nodetool/JMX access to be...

Apache Cassandra 安全漏洞

Apache Cassandra is a distributed Nosql database from the Apache Foundation.Cassandra is a hybrid non-relational database similar to Google's BigTable.Its main features are richer than Dynamo a distributed Key-Value storage system, but the support is not as good as MongoDB an open source product...

[SECURITY] [DLA 3437-1] libssh security update

Debian LTS Advisory DLA-3437-1 [email protected] https://www.debian.org/lts/security/ Tobias Frost May 29, 2023 https://wiki.debian.org/LTS Package : libssh Version : 0.8.7-1+deb10u2 CVE ID : CVE-2019-14889 CVE-2023-1667 Debian Bug : 946548 1035832 Two security issues have been discover...

The vulnerability of the Edge Gateway component of the MiVoice Connect business telephone system’s VoIP devices allows a perpetrator to make arbitrary changes to the configuration and execute arbitrary commands.

The vulnerability of the Edge Gateway component in the MiVoice Connect business telephone system’s VoIP devices relates to the absence of a mandatory password change during initial installation. Exploiting this vulnerability allows an attacker to make arbitrary changes to the configuration and...

GHSA-9MMJ-64JH-PH9C Privilege escalation in XXL-Job

A lateral privilege escalation vulnerability in XXL-Job v2.4.1 allows users to execute arbitrary commands on another user's account via a crafted POST request to the component /jobinfo/...

CVE-2023-33779

A lateral privilege escalation vulnerability in XXL-Job v2.4.1 allows users to execute arbitrary commands on another user's account via a crafted POST request to the component /jobinfo/...

Privilege escalation

A lateral privilege escalation vulnerability in XXL-Job v2.4.1 allows users to execute arbitrary commands on another user's account via a crafted POST request to the component /jobinfo/...

Ubuntu: Security Advisory (USN-6108-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2023-33779

CVE-2023-33779 affects XXL-JOB v2.4.1. A lateral privilege escalation exists where a crafted POST to the "/jobinfo/" endpoint allows a user to execute arbitrary commands on another user’s account. The PT-2023-24485 document corroborates the affected version and endpoint. No exploit code is provid...

PT-2023-24485 · Xxl-Job · Xxl-Job

Name of the Vulnerable Software and Affected Versions: XXL-Job version 2.4.1 Description: A lateral privilege escalation issue allows users to execute arbitrary commands on another user's account via a crafted POST request to the "/jobinfo/" API endpoint. Recommendations: For XXL-Job version 2.4....

USN-6108-1: Jhead vulnerabilities

It was discovered that Jhead did not properly handle certain crafted images while rotating them. An attacker could possibly use this issue to crash Jhead, resulting in a denial of service. CVE-2021-34055 Kyle Brown discovered that Jhead did not properly handle certain crafted images while...

CVE-2023-1523

Using the TIOCLINUX ioctl request, a malicious snap could inject contents into the input of the controlling terminal which could allow it to cause arbitrary commands to be executed outside of the snap sandbox after the snap exits. Graphical terminal emulators like xterm, gnome-terminal and others...

CVE-2023-31458

A vulnerability in the Edge Gateway component of Mitel MiVoice Connect versions 19.3 SP2 22.24.1500.0 and earlier could allow an unauthenticated attacker with internal network access to authenticate with administrative privileges, because initial installation does not enforce a password change. A...

Command injection

A vulnerability in the Edge Gateway component of Mitel MiVoice Connect versions 19.3 SP2 22.24.1500.0 and earlier could allow an unauthenticated attacker with internal network access to authenticate with administrative privileges, because initial installation does not enforce a password change. A...

CVE-2023-31459

A vulnerability in the Connect Mobility Router component of Mitel MiVoice Connect versions 9.6.2208.101 and earlier could allow an unauthenticated attacker with internal network access to authenticate with administrative privileges, because the initial installation does not enforce a password...

CVE-2023-31459

A vulnerability in the Connect Mobility Router component of Mitel MiVoice Connect versions 9.6.2208.101 and earlier could allow an unauthenticated attacker with internal network access to authenticate with administrative privileges, because the initial installation does not enforce a password...

SQL injection in Liferay Portal

SQL injection vulnerability in the upgrade process for SQL Server in Liferay Portal 7.3.1 through 7.4.3.17, and Liferay DXP 7.3 before update 6, and 7.4 before update 18 allows attackers to execute arbitrary SQL commands via the name of a database table's primary key index. This vulnerability is...