CVE-2023-48887

A deserialization vulnerability in Jupiter v1.3.1 allows attackers to execute arbitrary commands via sending a crafted RPC request...

Deserialization of untrusted data

A deserialization vulnerability in NettyRpc v1.2 allows attackers to execute arbitrary commands via sending a crafted RPC request...

Security Bulletin: Pydash is vulnerable to CVE-2023-26145 used in IBM Maximo Application Suite - Monitor Component

Summary IBM Maximo Application Suite - Monitor Component uses pydash, which is vulnerable to CVE-2023-26145. This bulletin identifies the steps to take to address the vulnerability. Vulnerability Details CVEID:CVE-2023-26145 DESCRIPTION: Python pydash package could allow a remote attacker to...

Design/Logic Flaw

IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout command to execute arbitrary commands. IBM X-Force ID: 267966...

CVE-2023-48887

A deserialization vulnerability in Jupiter v1.3.1 allows attackers to execute arbitrary commands via sending a crafted RPC request...

D-Link Go-RT-AC750 安全漏洞

The D-Link GO-RT-AC750 is a wireless dual-band simple router from China's AUO D-Link. A command injection vulnerability exists in the D-Link Go-RT-AC750 revAv101b03 version, which stems from the service parameter of hedwig.cgi failing to correctly filter the construct command special characters,...

Vulnerability fixed in IBM AIX

IBM has fixed a vulnerability in AIX. Through an error in the invscout command, a local malicious person can execute arbitrary execute arbitrary commands on the system. IBM has released updates to fix the vulnerability in AIX invscout. For more information, see:...

SolarWinds Platform 2023.3.x < 2023.3.1 Multiple Vulnerabilities

The version of SolarWinds Platform installed on the remote host is prior to 2023.3. It is, therefore, affected by multiple vulnerabilities as referenced in the security advisory. - The SolarWinds Platform was susceptible to the Incorrect Comparison Vulnerability. This vulnerability allows users...

IBM AIX Security Vulnerabilities

IBM AIX is an open standards-based UNIX operating system developed by International Business Machines IBM for the IBM Power architecture. A security vulnerability exists in IBM AIX that originated from a vulnerability that could allow an unprivileged local user to execute arbitrary commands using...

TOTOLINK X6000R 安全漏洞

TOTOLINK X6000R is a wireless router from China's Gion Electronics TOTOLINK. A security vulnerability exists in the TOTOLINK X6000R shttpd sub4119A0, which can be exploited by a remote attacker to submit a special request that can be used in an application context to execute arbitrary commands...

PT-2023-25947 · Nec · Nec Platforms Dt900

Name of the Vulnerable Software and Affected Versions: NEC Platforms DT900 and DT900S Series all versions Description: An OS Command injection issue allows an attacker to execute any command on the device. This issue was found inside the firmware of a NEC telephone. Recommendations: For NEC...

Fedora 38 : qbittorrent (2023-185f3e8ad7)

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-185f3e8ad7 advisory. - Update Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this issue but...

Security Bulletin: Systeminformation is vulnerable to CVE-2023-42810 used in IBM Maximo Application Suite - Monitor Component

Summary IBM Maximo Application Suite - Monitor Component uses systeminformation which is vulnerable to CVE-2023-42810. This bulletin identifies the steps to take to address the vulnerability. Vulnerability Details CVEID: CVE-2023-42810 DESCRIPTION: systeminformation could allow a remote attacker ...

Remote Code Execution (RCE)

uptime-kuma is vulnerable to Remote Code Execution RCE. The vulnerability is due to input validation for the hostname field being solely implemented on the client-side front-end JavaScript code which means that an attacker can circumvent the validation by modifying the HTML code of the input fiel...

PT-2023-9078 · Wazuh · Wazuh

Name of the Vulnerable Software and Affected Versions: Wazuh versions prior to 4.7.2 Description: The issue is related to the host deny script in Wazuh's active response feature, which allows for the execution of arbitrary commands on the target system due to improper input validation. This can b...

Sophos Web Appliance UsrBlocked.php command injection

Added: 11/24/2023 CVE: CVE-2023-1671 Background Sophos Web Appliance is a web proxy providing HTTP security. Problem A vulnerability in UsrBlocked.php allows remote attackers to inject arbitrary commands into an HTTP request. Resolution Upgrade to Sophos Web Appliance 4.3.10.4 or higher. Referenc...

Ironman Software PowerShell Universal Security Vulnerability

Ironman Software PowerShell Universal is a single pane for managing and delegating access to automation environments from Ironman Software. A security vulnerability exists in Ironman Software PowerShell Universal versions 3.0.0 through 4.2.0, which stems from an invalid filtering of input strings...

Command injection

Zoho ManageEngine RecoveryManager Plus before 6070 allows admin users to execute arbitrary commands via proxy settings...

ZOHO ManageEngine RecoveryManager Plus Security Vulnerability

ZOHO ManageEngine RecoveryManager Plus is a backup and recovery solution from ZOHO, Inc. A security vulnerability exists in ZOHO ManageEngine RecoveryManager Plus versions prior to 6070 that originates from allowing an administrator user to execute arbitrary commands via proxy settings...

CVE-2023-48646

Zoho ManageEngine RecoveryManager Plus before 6070 is affected by a command-injection vulnerability that allows admin users to execute arbitrary commands via proxy settings. The root cause is improper handling/neutralization of input in the affected component (getEscapedValue) and related proxy c...