PT-2023-8508 · Qnap · Quts Hero +2

Name of the Vulnerable Software and Affected Versions: QTS versions prior to 5.1.4.2596 build 20231128 QuTS hero versions prior to h5.1.4.2596 build 20231128 QuTScloud versions prior to c5.1.5.2651 Description: The issue is related to a lack of measures to neutralize special elements used in the...

CVE-2023-41109

The SmartNode SN200 Analog Telephone Adapter / VoIP Gateway (firmware 3.21.2-23021 and earlier) is affected by an unauthenticated OS command injection (CWE-78). Public advisories (SySS SYSS-2023-019) and PT-2023-8337 indicate the vulnerability stems from improper handling in the Network Diagnosti...

PT-2023-17399 · Dassault Systèmes · Simulia 3Dorchestrate

Name of the Vulnerable Software and Affected Versions: SIMULIA 3DOrchestrate versions 3DEXPERIENCE R2021x through 3DEXPERIENCE R2023x Description: An OS Command Injection issue exists, allowing arbitrary command execution through a specially crafted HTTP request. Recommendations: For SIMULIA...

CVE-2023-41109

SmartNode SN200 aka SN200 3.21.2-23021 allows unauthenticated OS Command Injection...

CVE-2023-4542

A vulnerability was found in D-Link DAR-8000-10 up to 20230809. It has been classified as critical. This affects an unknown part of the file /app/sys1.php. The manipulation of the argument cmd with the input id leads to os command injection. It is possible to initiate the attack remotely. The...

Command injection

A vulnerability was found in D-Link DAR-8000-10 up to 20230809. It has been classified as critical. This affects an unknown part of the file /app/sys1.php. The manipulation of the argument cmd with the input id leads to os command injection. It is possible to initiate the attack remotely. The...

CVE-2023-4542 D-Link DAR-8000-10 sys1.php os command injection

A vulnerability was found in D-Link DAR-8000-10 up to 20230809. It has been classified as critical. This affects an unknown part of the file /app/sys1.php. The manipulation of the argument cmd with the input id leads to os command injection. It is possible to initiate the attack remotely. The...

CVE-2023-4542

CVE-2023-4542 affects D-Link DAR-8000-10 (up to 20230809). The vulnerability arises from the id parameter in /app/sys1.php, enabling remote OS command injection via cmd, potentially allowing unauthenticated arbitrary command execution. Public exploit/poc exists (e.g., GitHub). Remediation: update...

CVE-2023-40144

OS command injection vulnerability in the CBC products allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter its settings. As for the affected products/versions, see the detailed information provided by the vendor. Note that NR4H, NR8H, NR16H series and...

CVE-2023-38585

Improper authentication vulnerability in the CBC products allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter its settings. As for the affected products/versions, see the detailed information provided by the vendor. Note that NR4H, NR8H, NR16H series a...

CVE-2023-40158

Hidden functionality vulnerability in the CBC products allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter its settings. As for the affected products/versions, see the detailed information provided by the vendor. Note that NR4H, NR8H, NR16H series and...

Authentication flaw

Improper authentication vulnerability in the CBC products allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter its settings. As for the affected products/versions, see the detailed information provided by the vendor. Note that NR4H, NR8H, NR16H series a...

CVE-2023-40144

The CVE-2023-40144 entry concerns an OS command injection in CBC CBC products. The vulnerability allows a remote authenticated attacker to execute arbitrary OS commands on the device or alter its settings. Affected models include CBC AMERICA NR-4M/NR-8M/NR-16M/NR-4F/NR-8F/NR-16F series and DR-16M...

CVE-2023-40144

OS command injection vulnerability in the CBC products allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter its settings. As for the affected products/versions, see the detailed information provided by the vendor. Note that NR4H, NR8H, NR16H series and...

CVE-2023-40158

Hidden functionality vulnerability in the CBC products allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter its settings. As for the affected products/versions, see the detailed information provided by the vendor. Note that NR4H, NR8H, NR16H series and...

CVE-2023-38585

CVE-2023-38585 affects CBC America DVRs (NR-4H/8H/16H and DR-16F/8F/4F/16H/8H/4H/4M41 etc.). Root cause: improper authentication allowing a remote authenticated attacker to execute arbitrary OS commands or alter settings. Many affected NR/DR series are no longer supported and updates are not prov...

CVE-2023-38585

Improper authentication vulnerability in the CBC products allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter its settings. As for the affected products/versions, see the detailed information provided by the vendor. Note that NR4H, NR8H, NR16H series a...

Ivanti Warns of Critical Zero-Day Flaw Being Actively Exploited in Sentry Software

Software services provider Ivanti is warning of a new critical zero-day flaw impacting Ivanti Sentry formerly MobileIron Sentry that it said is being actively exploited in the wild, marking an escalation of its security woes. Tracked as CVE-2023-38035 CVSS score: 9.8, the issue has been described...

CVE-2023-4412 TOTOLINK EX1200L setWanCfg os command injection

A vulnerability was found in TOTOLINK EX1200L ENV9.3.5u.6146B20201023 and classified as critical. This issue affects the function setWanCfg. The manipulation leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The...

CVE-2023-4412

TOTOLINK EX1200L EN_V9.3.5u.6146_B20201023 is affected by a vulnerability in the setWanCfg function that enables operating system command injection. The issue can be triggered remotely and has been publicly disclosed. Multiple sources (NVD, Red Hat, CVE lists, CNNVD) describe the vulnerability an...