Exploit for Code Injection in Apache Airflow

Apache Airflow official report description says: A vulnerab...

Microsoft Windows Multiple Vulnerabilities (KB5027231)

This host is missing an important security update according to Microsoft KB5027231 SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...

CVE-2023-38646

Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level. Authentication is not required for exploitation. The other fixed versions are 0.45.4.1, 1.45.4.1, 0.44.7.1, 1.44.7.1, 0.43.7.2...

GHSA-45G2-R339-PJWF Cockpit CMS Cross-Site Request Forgery vulnerability

A Cross-Site Request Forgery CSRF in the Admin portal of Cockpit CMS v2.5.2 allows attackers to execute arbitrary Administrator commands...

CVE-2023-37650

A Cross-Site Request Forgery CSRF in the Admin portal of Cockpit CMS v2.5.2 allows attackers to execute arbitrary Administrator commands...

Cross site request forgery (csrf)

A Cross-Site Request Forgery CSRF in the Admin portal of Cockpit CMS v2.5.2 allows attackers to execute arbitrary Administrator commands...

Perimeter81 macOS Application Multiple Vulnerabilities

Overview A command injection vulnerability can be used in the Perimeter81 macOS application to run arbitrary commands with administrative privileges. Description At the time, the latest Perimeter81 MacOS application 10.0.0.19 suffers from local privilege escalation vulnerability inside its...

CVE-2023-37650

A Cross-Site Request Forgery CSRF in the Admin portal of Cockpit CMS v2.5.2 allows attackers to execute arbitrary Administrator commands...

The vulnerability of D-Link DSL-G256DG router’s microprogramming software, related to deficiencies in authentication procedures, allows attackers to execute arbitrary commands.

The vulnerability of D-Link DSL-G256DG router’s microprogramming software is related to deficiencies in authentication procedures. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

The vulnerability of the network access control device Fortinet FortiNAC, related to deficiencies in the deserialization mechanism, allows a perpetrator to execute arbitrary code or perform arbitrary commands.

The vulnerability of the Fortinet FortiNAC network access control device is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary code or perform arbitrary commands...

CVE-2023-25838

There is SQL injection vulnerability in Esri ArcGIS Insights 2022.1 for ArcGIS Enterprise and that may allow a remote, authorized attacker to execute arbitrary SQL commands against the back-end database. The effort required to generate the crafted input required to exploit this issue is complex a...

Weak JWT Secrets

github.com/IceWhaleTech/CasaOS is vulnerable to Weak JWT Secrets. The vulnerability exists because the InitV1Router function of v1.go and InitV2Router function of v2.go does not properly validate the JWT tokens, which allows an attacker to send maliciously crafted JWTs and access the features tha...

PT-2023-5450 · Tp Link · Deco M4

Name of the Vulnerable Software and Affected Versions: Deco M4 firmware versions prior to 'Deco M4JP V2 1.5.8 Build 20230619' Description: The issue allows a network-adjacent authenticated attacker to execute arbitrary OS commands. This is related to the failure to neutralize special elements in...

CVE-2021-37522

SQL injection vulnerability in HKing2802 Locke-Bot 2.0.2 allows remote attackers to run arbitrary SQL commands via crafted string to /src/db.js, /commands/mute.js, /modules/event/messageDelete.js...

CVE-2021-37522

SQL injection vulnerability in HKing2802 Locke-Bot 2.0.2 allows remote attackers to run arbitrary SQL commands via crafted string to /src/db.js, /commands/mute.js, /modules/event/messageDelete.js...

CVE-2023-37265

CasaOS is an open-source Personal Cloud system. Due to a lack of IP address verification an unauthenticated attackers can execute arbitrary commands as root on CasaOS instances. The problem was addressed by improving the detection of client IP addresses in 391dd7f. This patch is part of CasaOS...

CVE-2023-37265 Incorrect identification of source IP addresses in CasaOS

CasaOS is an open-source Personal Cloud system. Due to a lack of IP address verification an unauthenticated attackers can execute arbitrary commands as root on CasaOS instances. The problem was addressed by improving the detection of client IP addresses in 391dd7f. This patch is part of CasaOS...

CVE-2023-37265

CVE-2023-37265 concerns CasaOS: an authentication bypass via incorrect handling of internal IP addresses in the CasaOS Gateway. The flaw allows an unauthenticated attacker to execute commands with root privileges on CasaOS instances due to IP verification weaknesses. Affected are versions prior t...

CVE-2023-37266 Weak json web token (JWT) secrets in CasaOS

CasaOS is an open-source Personal Cloud system. Unauthenticated attackers can craft arbitrary JWTs and access features that usually require authentication and execute arbitrary commands as root on CasaOS instances. This problem was addressed by improving the validation of JWTs in commit 705bf1f...

CasaOS contains weak JWT secrets

Impact Unauthenticated attackers can craft arbitrary JWTs and access features that usually require authentication and execute arbitrary commands as root on CasaOS instances. Patches The problem was addressed by improving the validation of JWTs in 705bf1f. This patch is part of CasaOS 0.4.4...