Debian: Security Advisory (DLA-3257-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security Bulletin: Multiple vulnerabilities in OpenSSL affect IBM Tivoli Netcool System Service Monitors/Application Service Monitors

Summary OpenSSL is used by IBM Tivoli Netcool System Service Monitors/Application Service Monitors for Network Transport. CVE-2022-2068 and CVE-2022-2097 are identified as potential risks for products using older versions of OpenSLL. These potential risks are resolved by updating IBM Tivoli Netco...

Cisco Identity Services Engine Vulnerabilities (cisco-sa-ise-7Q4TNYUx)

According to its self-reported version, Cisco Identity Services Engine is affected by multiple vulnerabilities. - A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to inject arbitrary commands on the underlying operating system...

Security Bulletin: Vulnerability in Fabric OS firmware used by IBM b-type SAN directors and switches [CVE-2022-33186]

Summary Public disclosed vulnerability in the Fabric OS FOS used by IBM b-type SAN directors and switches. The vulnerability has been addressed and can be resolved by applying one of the FOS code levels listed below. CVE-2022-33186 Vulnerability Details CVEID:CVE-2022-33186 DESCRIPTION: Broadcom...

Apache Airflow Command Injection Vulnerability (CNVD-2023-05224)

Apache Airflow is an open source platform for creating, managing and monitoring workflows from the Apache Foundation. Apache Airflow is vulnerable to a command injection vulnerability that could be exploited by remote attackers to submit ad hoc requests that could execute arbitrary commands in th...

CVE-2022-44015

An issue was discovered in Simmeth Lieferantenmanager before 5.6. An attacker can inject raw SQL queries. By activating MSSQL features, the attacker is able to execute arbitrary commands on the MSSQL server via the xpcmdshell extended procedure...

Sql injection

An issue was discovered in Simmeth Lieferantenmanager before 5.6. An attacker can inject raw SQL queries. By activating MSSQL features, the attacker is able to execute arbitrary commands on the MSSQL server via the xpcmdshell extended procedure...

Sql injection

Planet eStream before 6.72.10.07 allows a remote attacker who is a publisher or admin to obtain access to all records stored in the database, and achieve the ability to execute arbitrary SQL commands, via Search the StatisticsResults.aspx flt parameter...

Design/Logic Flaw

ThinkPHP Framework before 6.0.14 allows local file inclusion via the lang parameter when the language pack feature is enabled langswitchon=true. An unauthenticated and remote attacker can exploit this to execute arbitrary operating system commands, as demonstrated by including pearcmd.php...

CVE-2021-32692

Activity Watch is a free and open-source automated time tracker. Versions prior to 0.11.0 allow an attacker to execute arbitrary commands on any macOS machine with ActivityWatch running. The attacker can exploit this vulnerability by having the user visiting a website with the page title set to a...

CVE-2022-47945

ThinkPHP Framework before 6.0.14 allows local file inclusion via the lang parameter when the language pack feature is enabled langswitchon=true. An unauthenticated and remote attacker can exploit this to execute arbitrary operating system commands, as demonstrated by including pearcmd.php...

Security Bulletin: A security vulnerability in Node.js shell-quote affects IBM Cloud Pak for Multicloud Management Managed Services [CVE-2021-42740]

Summary A security vulnerability in Node.js shell-quote affects IBM Cloud Pak for Multicloud Management Managed Services CVE-2021-42740, the fix removes Node.js shell-quote Vulnerability Details CVEID:CVE-2021-42740 DESCRIPTION: Node.js shell-quote module could allow a remote attacker to execute...

Command Injection

apacheairflowprovidersapachehive is vulnerable to command injection. The vulnerability exists because parameters are not properly defined in hook but in connection definition allowing an attacker to inject and execute arbitrary commands...

CVE-2022-43443

OS command injection vulnerability in Buffalo network devices allows an network-adjacent attacker to execute an arbitrary OS command if a specially crafted request is sent to the management page...

CVE-2022-43486

Hidden functionality vulnerability in Buffalo network devices allows a network-adjacent attacker with an administrative privilege to enable the debug functionalities and execute an arbitrary command on the affected devices...

PT-2022-26938 · Buffalo · Buffalo Network Devices

Name of the Vulnerable Software and Affected Versions: Buffalo network devices affected versions not specified Description: A hidden functionality issue in Buffalo network devices allows an attacker with administrative privileges to enable debug functionalities and execute arbitrary commands on t...

CVE-2022-47208

The “puhttpsniff” service, which runs by default, is susceptible to command injection due to improperly sanitized user input. An unauthenticated attacker on the same network segment as the router can execute arbitrary commands on the device without authentication...

Command injection

The “puhttpsniff” service, which runs by default, is susceptible to command injection due to improperly sanitized user input. An unauthenticated attacker on the same network segment as the router can execute arbitrary commands on the device without authentication...

Design/Logic Flaw

The default console presented to users over telnet when enabled is restricted to a subset of commands. Commands issued at this console, however, appear to be fed directly into a system call or other similar function. This allows any authenticated user to execute arbitrary commands on the device...

Command injection

Command injection vulnerability in nwinterface.html in SHARP multifunction printers MFPs's Digital Full-color Multifunctional System 202 or earlier, 120 or earlier, 600 or earlier, 121 or earlier, 500 or earlier, 402 or earlier, 790 or earlier, and Digital Multifunctional System Monochrome 200 or...