PT-2025-44502

Name of the Vulnerable Software and Affected Versions Nagios XI versions prior to 2024R1.2 Description The software contains a flaw due to insufficient validation of inbound NRDP Nagios Remote Data Processor request parameters. This allows crafted input to reach command execution paths, potential...

Nagios XI 安全漏洞

Nagios XI is a suite of IT infrastructure monitoring solutions from the US-based Nagios. The solution supports monitoring and alerting of applications, services, operating systems, and more. A security vulnerability exists in Nagios XI versions prior to 2024R1.3.2, which stems from insufficient...

VulnCheck KEV: CVE-2020-35714

Belkin LINKSYS RE6500 devices before 1.0.11.001 allow remote authenticated users to execute arbitrary commands via goform/systemCommand?command= in conjunction with the goform/pingstart program...

CVE-2024-14003: Improper Neutralization of Special Elements used in an OS Command

Nagios XI versions prior to 2024R1.2 are vulnerable to remote code execution RCE through its NRDP Nagios Remote Data Processor server plugins. Insufficient validation of inbound NRDP request parameters allows crafted input to reach command execution paths, enabling attackers to execute arbitrary...

Malicious code in ect-987654-ctf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d6f07a32f7f265a234c3b4e84eda91976ba6cdb73f979ef22104a70af28bf4a0 The package ect-987654-ctf was found to contain malicious code. Source: ossf-package-analysis...

EUVD-2025-36670

Incorrect access control in the kernel driver of ThreatFire System Monitor v4.7.0.53 allows attackers to escalate privileges and execute arbitrary commands via an insecure IOCTL...

CVE-2025-64140

Jenkins Azure CLI Plugin 0.9 and earlier does not restrict which commands it executes on the Jenkins controller, allowing attackers with Item/Configure permission to execute arbitrary shell commands...

CVE-2025-61156: Improper Access Control

Incorrect access control in the kernel driver of ThreatFire System Monitor v4.7.0.53 allows attackers to escalate privileges and execute arbitrary commands via an insecure IOCTL...

CVE-2025-1549: Improper Neutralization of Special Elements used in a Command

A local privilege escalation vulnerability in the WatchGuard Mobile VPN with SSL client on Windows enables a local user to execute arbitrary commands with elevated privileges on the Windows system. This vulnerability is an additional unmitigated attack path for CVE-2024-4944. This vulnerability i...

Jenkins plugins Multiple Vulnerabilities (2025-10-29)

According to their self-reported version numbers, the version of Jenkins plugins running on the remote web server are affected by multiple vulnerabilities: - Jenkins Azure CLI Plugin 0.9 and earlier does not restrict which commands it executes on the Jenkins controller, allowing attackers with...

D-Link DNS-343 ShareCenter 安全漏洞

The D-Link DNS-343 ShareCenter is a network storage device from China's AUO D-Link. The D-Link DNS-343 ShareCenter suffers from a command execution vulnerability that stems from insufficient input validation in the Mail Test feature, which can be exploited by an attacker to execute arbitrary...

ThreatFire System Monitor 安全漏洞

ThreatFire System Monitor is a security protection software from ThreatFire, Inc. A security vulnerability exists in ThreatFire System Monitor version v4.7.0.53, which stems from improper kernel driver access control and could lead to elevation of privilege and execution of arbitrary commands...

PT-2025-44305

Name of the Vulnerable Software and Affected Versions ThreatFire System Monitor version 4.7.0.53 Description A flaw exists in the kernel driver of ThreatFire System Monitor that allows for privilege escalation and arbitrary command execution. This is due to insecure access control through an...

CVE-2025-61156

ThreatFire System Monitor version v4.7.0.53 contains a vulnerability in the kernel-mode TfSysMon.sys component due to a lack of proper DACL limiting access to opening a HANDLE to the driver. This incorrect access control allows unprivileged users to send an insecure IOCTL to perform arbitrary pro...

CVE-2025-62801

CVE-2025-62801 affects FastMCP prior to version 2.13.0, where a command-injection vulnerability exists in how the server_name field is processed during the MCP installer cursor flow on Windows. An attacker who can influence the server_name value can cause arbitrary OS commands to run on Windows h...

MAL-2025-48947 Malicious code in geopost-web-component (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da57d3bad54c135655781ae00e108e90ad9a31f6eaa11327df5d4654a411f0d7 The package geopost-web-component was found to contain malicious code. Source: ghsa-malware...

CVE-2025-1037

CVE-2025-1037 affects Hitachi TropOS 4th Gen. The Red Hat, NVD, ENISA/EUVD, CIRCL sighting entries describe a vulnerability in the device’s web-based configuration utility (notably the Logging page) where an authenticated, low-privileged user who can run user-level shell commands can abuse script...

CVE-2025-62777

Use of Hard-Coded Credentials issue exists in MZK-DP300N version 1.07 and earlier, which may allow an attacker within the local network to log in to the affected device via Telnet and execute arbitrary commands...

CVE-2025-62777

The CVE-2025-62777 entry concerns Planex MZK-DP300N, affected when using firmware versions 1.07 and earlier. The underlying issue is hard-coded credentials, which could allow an attacker on the local network to log in via Telnet and execute arbitrary commands. Mitigation is to update the device f...

The vulnerability of the Xerox FreeFlow Core platform for intelligent automation of work processes lies in the incorrect limitation of the path name to the restricted access catalog, allowing attackers to execute arbitrary commands.

The vulnerability of the Xerox FreeFlow Core platform for intelligent automation of work processes is related to an incorrect limitation on the name of the path to the restricted-access catalog. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...