1298 matches found
CasaOS Gateway vulnerable to incorrect identification of source IP addresses
Impact Unauthenticated attackers can execute arbitrary commands as root on CasaOS instances. Patches The problem was addressed by improving the detection of client IP addresses in 391dd7f. This patch is part of CasaOS 0.4.4. Workarounds Users should upgrade to CasaOS 0.4.4. If they can't, they...
Sql injection
An SQL injection vulnerability exists in TapHome core HandleMessageUpdateDevicePropertiesRequest function before version 2023.2, allowing low privileged users to inject arbitrary SQL directives into an SQL query and execute arbitrary SQL commands and get full reading access. This may also lead to...
Xxe
A vulnerability arises out of a failure to comprehensively sanitize the processing of a zip files. Incomplete neutralization of external commands used to control the process execution of the .zip application allows an authorized user to obtain control of the .zip application to execute arbitrary...
CVE-2023-2625
A vulnerability exists that can be exploited by an authenticated client that is connected to the same network segment as the CoreTec 4, having any level of access VIEWER to ADMIN. To exploit the vulnerability the attacker can inject shell commands through a particular field of the web user...
CVE-2023-2993
A valid, authenticated user with limited privileges may be able to use specifically crafted web management server API calls to execute a limited number of commands on SMM v1, SMM v2, and FPC that the user does not normally have sufficient privileges to execute...
CVE-2023-2993
A valid, authenticated user with limited privileges may be able to use specifically crafted web management server API calls to execute a limited number of commands on SMM v1, SMM v2, and FPC that the user does not normally have sufficient privileges to execute...
PT-2023-5454 · Tp Link · Tp-Link Archer C20
Name of the Vulnerable Software and Affected Versions: TP-Link Archer C20 versions prior to Archer C20JP V1 230616 Description: The issue is related to improper authentication in the TP-Link Archer C20 firmware, which can be exploited by a network-adjacent unauthenticated attacker to execute...
CVE-2023-32753 ITPison OMICARD EDM - Arbitrary File Upload
OMICARD EDM’s file uploading function does not restrict upload of file with dangerous type. An unauthenticated remote attacker can exploit this vulnerability to upload and run arbitrary executable files to perform arbitrary system commands or disrupt service...
Okta Advanced Server Access Client < 1.58.0 Command Injection
The versions of Okta Advanced Server Access Client installed on the remote host is affected by a command injection vulnerability via a specially crafted URL. An attacker, who has knowledge of a valid team name for the victim and also knows a valid target host where the user has access, can execut...
The vulnerability of Juniper Networks’ Junos OS Evolved operating system, related to the lack of standard permission mechanisms, allows attackers to modify existing files or execute arbitrary commands on behalf of users.
The vulnerability of Juniper Networks’ Junos OS Evolved operating system is related to the lack of a mechanism for standard permissions. Exploiting this vulnerability allows an attacker to modify existing files or execute arbitrary commands on behalf of the user...
CVE-2023-28703
ASUS RT-AC86U’s specific cgi function has a stack-based buffer overflow vulnerability due to insufficient validation for network packet header length. A remote attacker with administrator privileges can exploit this vulnerability to execute arbitrary system commands, disrupt system or terminate...
WCMS 代码问题漏洞
WCMS is a content management system CMS. A security vulnerability exists in WCMS version 0.3.2. An attacker can use this vulnerability to write arbitrary strings to custom file names and upload arbitrary files, or write malicious code to execute scripts to trigger command execution...
Cisco DNA Center Authorization Issues Vulnerability
Cisco DNA Center is a network management and command center service from Cisco USA. Cisco DNA Center is vulnerable to an authorization issue. The vulnerability stems from improper authorization of API requests and can be exploited by an authenticated, remote attacker to read information from a...
Shanghai Zhuozhuo Network Technology Co., Ltd. DedeCMS file containment vulnerability
DedeCMS is a PHP open source website management system. Shanghai Zhuozhuo Network Technology Co., Ltd DedeCMS file contains a vulnerability that can be exploited by attackers to execute commands...
Command injection
TOTOLINK X5000R V9.1.0u.6118B20201102 and V9.1.0u.6369B20230113 contain a command insertion vulnerability in setting/setTracerouteCfg. This vulnerability allows an attacker to execute arbitrary commands through the "command" parameter...
Shanghai Zhuozhuo Network Technology Co., Ltd. DedeCMS file containment vulnerability
DedeCMS is a PHP open source website management system. Shanghai Zhuozhuo Network Technology Co., Ltd DedeCMS file contains a vulnerability that can be exploited by attackers to execute commands...
CVE-2023-20852 aEnrich a+HRD - Deserialization of Untrusted Data
aEnrich Technology a+HRD has a vulnerability of Deserialization of Untrusted Data within its MSMQ interpreter. An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary system commands to perform arbitrary system operation or disrupt service...
CVE-2022-43946
Multiple vulnerabilities including an incorrect permission assignment for critical resource CWE-732 vulnerability and a time-of-check time-of-use TOCTOU race condition CWE-367 vulnerability in Fortinet FortiClientWindows before 7.0.7 allows attackers on the same file sharing network to execute...
Code injection
Uvdesk version 1.1.1 allows an authenticated remote attacker to execute commands on the server. This is possible because the application does not properly validate profile pictures uploaded by customers...