CasaOS Gateway vulnerable to incorrect identification of source IP addresses

Unauthenticated attackers can execute arbitrary commands as root on CasaOS instances...

Exploit for CVE-2023-21746

It is an exploit module/toolkit targeting a vulnerability in a s...

GHSA-JQ43-Q8MX-R7MQ SwiftTerm Code Injection vulnerability

Impact Attacker could modify the window title via a certain character escape sequence and then insert it back to the command line in the user's terminal, e.g. when the user views a file containing the malicious sequence, which could allow the attacker to execute arbitrary commands. Credit These...

SwiftTerm Code Injection vulnerability

Attacker could modify the window title via a certain character escape sequence and then insert it back to the command line in the user's terminal, e.g. when the user views a file containing the malicious sequence, which could allow the attacker to execute arbitrary commands...

Sql injection

A SQL injection vulnerability in the Boxtal envoimoinscher module for PrestaShop, after version 3.1.10, allows remote attackers to execute arbitrary SQL commands via the key GET parameter...

The vulnerability of the 1Panel Linux server’s control panel, related to the failure to eliminate special elements used in the operating system commands, allows a hacker to execute arbitrary commands.

The vulnerability of the 1Panel Linux server control panel is related to the lack of measures taken to neutralize special elements used in the operating system’s command line. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

PT-2023-26026 · Elecom · Wrc-1167Gebk-S

Name of the Vulnerable Software and Affected Versions: ELECOM wireless LAN routers WRC-1167GHBK-S versions 1.03 and earlier ELECOM wireless LAN routers WRC-1167GEBK-S versions 1.03 and earlier Description: The issue allows a network-adjacent authenticated attacker to execute an arbitrary command ...

CVE-2023-30151

A SQL injection vulnerability in the Boxtal envoimoinscher module for PrestaShop, after version 3.1.10, allows remote attackers to execute arbitrary SQL commands via the key GET parameter...

Fortinet FortiWeb OS Command Injection Vulnerability (CNVD-2024-29349)

Fortinet FortiWeb is a Web application layer firewall from the U.S. company Fita Fortinet, which can block threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks to ensure the security of Web applications and protect sensitive database content...

Microsoft Windows Raw Image Extensions RCE (July 2023)

The Windows 'Raw Image Extensions' app installed on the remote host is affected by a remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands. Note that Nessus has not tested for these issues but has instead relied only...

Command Injection

git-commit-info is vulnerable to Command Injection. The vulnerability exists due to a lack of validation in the gitCommitInfo commit parameter, which allows an attacker to inject and execute arbitrary commands...

Security Bulletin: IBM Engineering Workflow Management (EWM) vulnerabilities [CVE-2022-1434, CVE-2022-1343, CVE-2022-1292, CVE-2022-1473]

Summary There are vulnerabilities which affect IBM Engineering Workflow Management EWM. CVE-2022-1434, CVE-2022-1343, CVE-2022-1292, CVE-2022-1473 The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2022-1434 DESCRIPTION: OpenSSL is vulnerable to a man-in-the-middle attack,...

Microsoft Internet Explorer Security Feature Bypass Vulnerability (KB5028167)

This host is missing an important security update according to Microsoft KB5028167 SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

The vulnerability of My Cloud OS, a network storage operating system, allows a perpetrator to execute arbitrary commands.

The vulnerability of My Cloud OS network storage systems is related to the lack of measures for data cleanup at the management level. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

The vulnerability of My Cloud OS, a network storage operating system, allows a perpetrator to execute arbitrary commands.

The vulnerability of My Cloud OS network storage systems is related to the lack of measures for data cleanup at the management level. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

ELECOM WRC 代码注入漏洞

The ELECOM WRC is a home-applicable network camera from ELECOM Japan. A code injection vulnerability exists in ELECOM WRC-1167FEBK-A v1.18 and earlier versions, which stems from the presence of a code injection that allows network-adjacent authenticated attackers to execute arbitrary operating...

Security Updates for Microsoft Office Products (July 2023)

The Microsoft Office Products are missing security updates. It is, therefore, affected by multiple vulnerabilities: - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands. CVE-2023-33149, CVE-2023-33152,...

CVE-2023-28958

IBM Watson Knowledge Catalog on Cloud Pak for Data 4.0 is potentially vulnerable to CSV Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 251782...

Design/Logic Flaw

An authenticated administrator is allowed to remotely execute arbitrary shell commands via the API...

Input validation

IBM Watson Knowledge Catalog on Cloud Pak for Data 4.0 is potentially vulnerable to CSV Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 251782...