CVE-2021-33736

CVE-2021-33736 (SINEC NMS) affects Siemens SINEC NMS versions prior to 1.0 SP2 Update 1. A privileged authenticated attacker could execute arbitrary commands in the local database by sending crafted requests to the webserver. The Red Hat and NVD entries corroborate the same issue; Nessus lists it...

CVE-2021-33735

A vulnerability has been identified in SINEC NMS All versions V1.0 SP2 Update 1. A privileged authenticated attacker could execute arbitrary commands in the local database by sending crafted requests to the webserver of the affected application...

CVE-2021-33734

A vulnerability has been identified in SINEC NMS All versions V1.0 SP2 Update 1. A privileged authenticated attacker could execute arbitrary commands in the local database by sending crafted requests to the webserver of the affected application...

CVE-2021-33733

A vulnerability has been identified in SINEC NMS All versions V1.0 SP2 Update 1. A privileged authenticated attacker could execute arbitrary commands in the local database by sending crafted requests to the webserver of the affected application...

CVE-2021-33732

A vulnerability has been identified in SINEC NMS All versions V1.0 SP2 Update 1. A privileged authenticated attacker could execute arbitrary commands in the local database by sending crafted requests to the webserver of the affected application...

CVE-2021-33732

Siemens SINEC NMS is affected by CVE-2021-33732 (SQL Injection) in all versions prior to 1.0 SP2 Update 1. A privileged, authenticated attacker could send crafted requests to the web server and execute arbitrary commands in the local database. Remediation: update to v1.0 SP2 Update 1 or later. Th...

CVE-2021-33731

CVE-2021-33731 affects Siemens SINEC NMS versions prior to 1.0 SP2 Update 1. It is a SQL injection vulnerability in the web server that could allow a privileged, authenticated attacker to execute arbitrary commands in the local database by sending crafted requests. Glimpse of impact from sources:...

CVE-2021-33730

CVE-2021-33730 affects Siemens SINEC NMS prior to v1.0 SP2 Update 1. The issue allows a privileged authenticated attacker to execute arbitrary commands in the local database by sending crafted requests to the web server of the affected application. The Red Hat, NVD, and Siemens/ISAS Nessus/CSAs e...

CVE-2021-33730

A vulnerability has been identified in SINEC NMS All versions V1.0 SP2 Update 1. A privileged authenticated attacker could execute arbitrary commands in the local database by sending crafted requests to the webserver of the affected application...

CVE-2021-33729

A vulnerability has been identified in SINEC NMS All versions V1.0 SP2 Update 1. An authenticated attacker that is able to import firmware containers to an affected system could execute arbitrary commands in the local database...

Security Updates for Microsoft SharePoint Server 2013 (October 2021)

The Microsoft SharePoint Server 2013 installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities : - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands...

Moodle Authenticated Spelling Binary Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'rexml/document' class MetasploitModule 'Moodle Authenticated Spelling Binary RCE', 'Description' = %q Moodle allows an authenticated user to define spellcheck...

WordPress Support Board Plugin SQL Injection (CVE-2021-24741)

An SQL injection vulnerability exists in Support Board WordPress plugin before 3.3.4. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system...

CVE-2021-1594

A vulnerability in the REST API of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to perform a command injection attack and elevate privileges to root. This vulnerability is due to insufficient input validation for specific API endpoints. An attacker in a...

CVE-2021-1594 Cisco Identity Services Engine Privilege Escalation Vulnerability

A vulnerability in the REST API of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to perform a command injection attack and elevate privileges to root. This vulnerability is due to insufficient input validation for specific API endpoints. An attacker in a...

The vulnerability of the Linux operating system arises from buffer overflows, which allow attackers to execute arbitrary control commands.

The vulnerability of the Linux operating system arises due to buffer overflow. Exploiting this vulnerability allows an attacker to execute arbitrary control commands...

WordPress 插件 SQL注入漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports PHP and MySQL servers to set up a personal blog site.WordPress Plugin is a WordPress open source application plugin . The WordPress Meow Gallery plugin suffers from a SQL...

CVE-2021-34352

A command injection vulnerability has been reported to affect QNAP device running QVR. If exploited, this vulnerability could allow remote attackers to run arbitrary commands. We have already fixed this vulnerability in the following versions of QVR: QVR 5.1.5 build 20210902 and later...

CVE-2021-34352 Command Injection Vulnerability in QVR

A command injection vulnerability has been reported to affect QNAP device running QVR. If exploited, this vulnerability could allow remote attackers to run arbitrary commands. We have already fixed this vulnerability in the following versions of QVR: QVR 5.1.5 build 20210902 and later...

Input validation

An improper neutralization of formula elements in a csv file in Fortinet FortiManager version 6.4.3 and below, 6.2.7 and below allows attacker to execute arbitrary commands via crafted IPv4 field in policy name, when exported as excel file and opened unsafely on the victim host...