CVE-2023-39237 ASUS RT-AC86U - Command injection vulnerability - 5

ASUS RT-AC86U Traffic Analyzer - Apps analysis function has insufficient filtering of special character. A remote attacker with regular user privilege can exploit this vulnerability to perform command injection attack to execute arbitrary commands, disrupt system or terminate services...

CVE-2023-39935

Archer C5400 firmware versions prior to 'Archer C5400JPV2230506' allows a network-adjacent authenticated attacker to execute arbitrary OS commands...

Malicious code in @dpdgroupuk/design-space-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2d6e51ab6c7050e707d28d79d239a607feea9a777c9db5f9a4765ead15613168 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2023-25981 · Casaos · Casaos

Name of the Vulnerable Software and Affected Versions: CasaOS versions prior to 0.4.4 Description: CasaOS is an open-source personal cloud system. If an authenticated user is able to successfully connect to a controlled SMB server, they are able to execute arbitrary commands. Recommendations: For...

Logitec LAN 安全漏洞

Logitec LAN is a series of routers from Logitec, a Swiss company. A security vulnerability exists in Logitec LAN that stems from the presence of a hidden functionality vulnerability that could allow an unauthenticated attacker to log in to certain management consoles of the product and execute...

PT-2023-26518 · Unknown · Lan-Wh300N/Re

Name of the Vulnerable Software and Affected Versions: LAN-WH300N/RE versions all Description: A hidden functionality vulnerability allows an authenticated user to execute arbitrary OS commands on a certain management console. Recommendations: For LAN-WH300N/RE all versions, at the moment, there ...

Security Bulletin: A vulnerability has been identified in the IBM Storage Scale GUI where a remote authenticated user can execute commands (CVE-2023-33201)

Summary A security vulnerability has been identified in all levels of IBM Storage Scale GUI that could allow a remote authenticated user to execute commands. A fix for this vulnerability is available. Vulnerability Details CVEID:CVE-2023-33201 DESCRIPTION: The Bouncy Castle Crypto Package For Jav...

Malicious code in my-fallen-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e7c1f73f0c85f62e81e5bb2b99f08089c34ecaa76487bac79f482b75c131ef13 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Moxa AWK-3121 Improper Restriction of Operations Within the Bounds of a Memory Buffer (CVE-2018-10703)

An issue was discovered on Moxa AWK-3121 1.14 devices. It provides functionality so that an administrator can run scripts on the device to troubleshoot any issues. However, the same functionality allows an attacker to execute commands on the device. The POST parameter iwserverip is susceptible to...

Moxa NPort IAW5000A-I/O Series Serial Device Server Improper Neutralization of Special Elements Used in an OS Command (CVE-2021-32974)

Improper input validation in the built-in web server in Moxa NPort IAW5000A-I/O series firmware version 2.2 or earlier may allow a remote attacker to execute commands. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information...

CVE-2023-35019

IBM Security Verify Governance, Identity Manager 10.0 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-Force ID: 257873...

Design/Logic Flaw

The SolarWinds Platform was susceptible to the Incorrect Behavior Order Vulnerability. This vulnerability allows users with administrative access to SolarWinds Web Console to execute arbitrary commands with NETWORK SERVICE privileges...

Malicious code in nwa-uikit-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 90a7d076b934f9928aa5301f8d62f0218fd96a1f59a26102659ee688114d764a The OpenSSF Package Analysis project identified 'nwa-uikit-web' @ 1.0.2 npm as malicious. It is considered malicious because: - The package...

CasaOS Gateway vulnerable to incorrect identification of source IP addresses

Impact Unauthenticated attackers can execute arbitrary commands as root on CasaOS instances. Patches The problem was addressed by improving the detection of client IP addresses in 391dd7f. This patch is part of CasaOS 0.4.4. Workarounds Users should upgrade to CasaOS 0.4.4. If they can't, they...

Sql injection

An SQL injection vulnerability exists in TapHome core HandleMessageUpdateDevicePropertiesRequest function before version 2023.2, allowing low privileged users to inject arbitrary SQL directives into an SQL query and execute arbitrary SQL commands and get full reading access. This may also lead to...

Xxe

A vulnerability arises out of a failure to comprehensively sanitize the processing of a zip files. Incomplete neutralization of external commands used to control the process execution of the .zip application allows an authorized user to obtain control of the .zip application to execute arbitrary...

CVE-2023-2625

A vulnerability exists that can be exploited by an authenticated client that is connected to the same network segment as the CoreTec 4, having any level of access VIEWER to ADMIN. To exploit the vulnerability the attacker can inject shell commands through a particular field of the web user...

CVE-2023-2993

A valid, authenticated user with limited privileges may be able to use specifically crafted web management server API calls to execute a limited number of commands on SMM v1, SMM v2, and FPC that the user does not normally have sufficient privileges to execute...

CVE-2023-2993

A valid, authenticated user with limited privileges may be able to use specifically crafted web management server API calls to execute a limited number of commands on SMM v1, SMM v2, and FPC that the user does not normally have sufficient privileges to execute...

PT-2023-5454 · Tp Link · Tp-Link Archer C20

Name of the Vulnerable Software and Affected Versions: TP-Link Archer C20 versions prior to Archer C20JP V1 230616 Description: The issue is related to improper authentication in the TP-Link Archer C20 firmware, which can be exploited by a network-adjacent unauthenticated attacker to execute...