Siemens SICAM TOOLBOX II 安全漏洞

SICAM TOOLBOX II is an engineering solution for plants and systems of all sizes. It allows data collection, data modeling, configuration and parameterization. It is used for process information engineering of automation and central control room systems. Siemens SICAM TOOLBOX II has an Execute wit...

CVE-2023-40042

TOTOLINK T10v2 5.9c.5061B20200511 has a stack-based buffer overflow in setStaticDhcpConfig in /lib/cstemodules/lan.so. Attackers can send crafted data in an MQTT packet, via the comment parameter, to control the return address and execute code...

CVE-2023-36344

An issue in Diebold Nixdorf Vynamic View Console v.5.3.1 and before allows a local attacker to execute arbitrary code via not restricting the search path for required DLLs and not verifying the signature...

Security Bulletin: A vulnerability has been identified in the IBM Storage Scale GUI where a remote authenticated user can execute commands (CVE-2023-33201)

Summary A security vulnerability has been identified in all levels of IBM Storage Scale GUI that could allow a remote authenticated user to execute commands. A fix for this vulnerability is available. Vulnerability Details CVEID:CVE-2023-33201 DESCRIPTION: The Bouncy Castle Crypto Package For Jav...

CVE-2023-36220

Directory Traversal vulnerability in Textpattern CMS v4.8.8 allows a remote authenticated attacker to execute arbitrary code and gain access to sensitive information via the plugin Upload function...

Cross-site Scripting (XSS)

gitlab is vulnerable to Cross-site Scripting XSS. The vulnerability exists due to the improper validation in the ipynb files of the library, which allows an attacker to inject and execute malicious javascript...

GHSA-W3QM-93VF-5HRW Cockpit Cross-site Scripting vulnerability

Cross-site Scripting XSS - Stored in GitHub repository cockpit-hq/cockpit prior to 2.6.3. For any role that has permission to execute function assets, an attacker can upload a html file and that leads to XSS...

CVE-2023-36095

An issue in Harrison Chase langchain v.0.0.194 allows an attacker to execute arbitrary code via the python exec calls in the PALChain, affected functions include frommathprompt and fromcoloredobjectprompt...

CVE-2022-46782

An issue was discovered in Stormshield SSL VPN Client before 3.2.0. A logged-in user, able to only launch the VPNSSL Client, can use the OpenVPN instance to execute malicious code as administrator on the local machine...

Malicious code in my-fallen-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e7c1f73f0c85f62e81e5bb2b99f08089c34ecaa76487bac79f482b75c131ef13 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-38948

An arbitrary file download vulnerability in the /c/PluginsController.php component of jizhi CMS 1.9.5 allows attackers to execute arbitrary code via downloading a crafted plugin...

USN-5064-3: GNU cpio vulnerability

USN-5064-1 fixed a vulnerability in GNU. This update provides the corresponding update for Ubuntu 14.04 LTS. Original advisory details: Maverick Chung and Qiaoyi Fang discovered that cpio incorrectly handled certain pattern files. A remote attacker could use this issue to cause cpio to crash,...

Suprema BioStar 2 SQL Injection Vulnerability

Suprema BioStar 2 is a web-based biometric security smart locking platform from Suprema Korea. A security vulnerability exists in Suprema BioStar 2 versions prior to V2.9.1 that originates from allowing an authenticated user to inject arbitrary SQL commands and execute arbitrary SQL commands...

CVE-2023-38948

An arbitrary file download vulnerability in the /c/PluginsController.php component of jizhi CMS 1.9.5 allows attackers to execute arbitrary code via downloading a crafted plugin...

CSV Injection

phpmyfaq is vulnerable to CSV injection attacks. The vulnerability exists due to lack of sanitization in formula elements in a csv file which allows attackers to inject a csv payload and execute it when administer opens the CSV file...

Moxa AWK-3121 Improper Restriction of Operations Within the Bounds of a Memory Buffer (CVE-2018-10703)

An issue was discovered on Moxa AWK-3121 1.14 devices. It provides functionality so that an administrator can run scripts on the device to troubleshoot any issues. However, the same functionality allows an attacker to execute commands on the device. The POST parameter iwserverip is susceptible to...

Moxa NPort IAW5000A-I/O Series Serial Device Server Improper Neutralization of Special Elements Used in an OS Command (CVE-2021-32974)

Improper input validation in the built-in web server in Moxa NPort IAW5000A-I/O series firmware version 2.2 or earlier may allow a remote attacker to execute commands. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information...

CVE-2023-39147

An arbitrary file upload vulnerability in Uvdesk 1.1.3 allows attackers to execute arbitrary code via uploading a crafted image file...

Design/Logic Flaw

An arbitrary file upload vulnerability in Uvdesk 1.1.3 allows attackers to execute arbitrary code via uploading a crafted image file...

RaspAP Command Injection vulnerability

A Command injection vulnerability in RaspAP 2.8.0 thru 2.9.2 allows an authenticated attacker to execute arbitrary OS commands as root via the entity POST parameters in /ajax/networking/getwgkey.php...