CVE-2023-47254

An OS Command Injection in the CLI interface on DrayTek Vigor167 version 5.2.2, allows remote attackers to execute arbitrary system commands and escalate privileges via any account created within the web interface...

Code injection

Honeywell ProWatch, 4.5, including all Service Pack versions, contain a Vulnerability in Application Server's executable folders. An attacker could potentially exploit this vulnerability, leading to a standard user to have arbitrary system code execution. Honeywell recommends updating to the most...

CVE-2023-6179 Incorrect Permission assignment to program executable folders

Honeywell ProWatch, 4.5, including all Service Pack versions, contain a Vulnerability in Application Server's executable folders. An attacker could potentially exploit this vulnerability, leading to a standard user to have arbitrary system code execution. Honeywell recommends updating to the most...

CVE-2023-41357

Galaxy Software Services Corporation Vitals ESP is an online knowledge base management portal, it has insufficient filtering and validation during file upload. An authenticated remote attacker with general user privilege can exploit this vulnerability to upload and execute scripts onto arbitrary...

CVE-2023-41356

NCSIST ManageEngine Mobile Device ManagerMDM APP's special function has a path traversal vulnerability. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication and read arbitrary system files...

Privilege escalation

Galaxy Software Services Corporation Vitals ESP is an online knowledge base management portal, it has insufficient filtering and validation during file upload. An authenticated remote attacker with general user privilege can exploit this vulnerability to upload and execute scripts onto arbitrary...

CVE-2023-41356 WisdomGarden Tronclass ilearn - Path Traversal

NCSIST ManageEngine Mobile Device ManagerMDM APP's special function has a path traversal vulnerability. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication and read arbitrary system files...

CVE-2023-41351

Chunghwa Telecom NOKIA G-040W-Q has a vulnerability of authentication bypass, which allows an unauthenticated remote attacker to bypass the authentication mechanism to log in to the device by an alternative URL. This makes it possible for unauthenticated remote attackers to log in as any existing...

Authentication flaw

Chunghwa Telecom NOKIA G-040W-Q has a vulnerability of authentication bypass, which allows an unauthenticated remote attacker to bypass the authentication mechanism to log in to the device by an alternative URL. This makes it possible for unauthenticated remote attackers to log in as any existing...

CVE-2023-41357 Galaxy Software Services Vitals ESP - Arbitrary File Upload

Galaxy Software Services Corporation Vitals ESP is an online knowledge base management portal, it has insufficient filtering and validation during file upload. An authenticated remote attacker with general user privilege can exploit this vulnerability to upload and execute scripts onto arbitrary...

CVE-2023-41353 Chunghwa Telecom NOKIA G-040W-Q - Weak Password Requirements

Chunghwa Telecom NOKIA G-040W-Q has a vulnerability of weak password requirements. A remote attacker with regular user privilege can easily infer the administrator password from system information after logging system, resulting in admin access and performing arbitrary system operations or disrup...

CVE-2023-41351 Chunghwa Telecom NOKIA G-040W-Q - Broken Access Control

Chunghwa Telecom NOKIA G-040W-Q has a vulnerability of authentication bypass, which allows an unauthenticated remote attacker to bypass the authentication mechanism to log in to the device by an alternative URL. This makes it possible for unauthenticated remote attackers to log in as any existing...

CVE-2023-41351

The CVE-2023-41351 entry concerns the Nokia G-040W-Q (Chunghwa Telecom) modem, where an authentication bypass allows an unauthenticated remote attacker to log in via an alternate URL as any existing user (including administrators), enabling arbitrary system operations or service disruption. Docum...

CVE-2023-41351 Chunghwa Telecom NOKIA G-040W-Q - Broken Access Control

Chunghwa Telecom NOKIA G-040W-Q has a vulnerability of authentication bypass, which allows an unauthenticated remote attacker to bypass the authentication mechanism to log in to the device by an alternative URL. This makes it possible for unauthenticated remote attackers to log in as any existing...

F5 Networks BIG-IP : BIG-IP Configuration utility authenticated SQL injection vulnerability (K000137365)

The version of F5 Networks BIG-IP installed on the remote host is prior to 13.1.5.1 + Hotfix-BIGIP-13.1.5.1.0.20.2-ENG / 14.1.5.6 + Hotfix-BIGIP-14.1.5.6.0.10.6-ENG / 15.1.10.2 + Hotfix-BIGIP-15.1.10.2.0.44.2-ENG / 15.1.10.3 / 16.1.4.1 + Hotfix-BIGIP-16.1.4.1.0.50.5-ENG / 16.1.4.2 / 17.1.0.3 +...

F5 Networks BIG-IP : BIG-IP Configuration utility unauthenticated remote code execution vulnerability (K000137353)

The version of F5 Networks BIG-IP installed on the remote host is prior to 13.1.5.1 + Hotfix-BIGIP-13.1.5.1.0.20.2-ENG / 14.1.5.6 +Hotfix-BIGIP-14.1.5.6.0.10.6-ENG / 15.1.10.2 + Hotfix-BIGIP-15.1.10.2.0.44.2-ENG / 16.1.4.1 + Hotfix- BIGIP-16.1.4.1.0.50.5-ENG / 17.1.0.3 +...

F5 BIG-IP Remote Code Execution Vulnerability (CNVD-2023-82300)

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, and remote access policy management. F5 BIG-IP suffers from a remote code execution vulnerability caused by a configuration utility authentication bypass flaw. An...

Sql injection

An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which may allow an authenticated attacker with network access to the Configuration utility through the BIG-IP management port and/or self IP addresses to execute arbitrary system commands. Note: Software...

CVE-2023-46748 BIG-IP Configuration utility authenticated SQL injection vulnerability

An authenticated SQL injection vulnerability exists in the BIG-IP Configuration utility which may allow an authenticated attacker with network access to the Configuration utility through the BIG-IP management port and/or self IP addresses to execute arbitrary system commands. Note: Software...

CVE-2023-46748

CVE-2023-46748 is an authenticated SQL injection vulnerability in F5 BIG-IP’s Configuration utility. An attacker with network access via the BIG-IP management port and/or self IPs can execute arbitrary system commands through the vulnerable Configuration utility. Affected BIG-IP versions include ...