CVE-2023-28400

CVE-2023-28400 affects mySCADA myPRO, versions 8.26.0 and earlier. The vulnerability arises from parameters that an authenticated user can abuse to inject arbitrary operating system commands (OS Command Injection, CWE-78). Exploitation is described as possible remotely with low attack complexity ...

CVE-2023-28716 CVE-2023-28716

mySCADA myPRO versions 8.26.0 and prior has parameters which an authenticated user could exploit to inject arbitrary operating system commands...

CVE-2023-28384

CVE-2023-28384 affects mySCADA myPRO (versions 8.26.0 and earlier). An authenticated user can exploit parameters to inject arbitrary operating system commands, with the commands executed under NT AUTHORITY\SYSTEM. Public sources (including CISA ICS advisory) confirm remote exploitable OS command ...

CVE-2023-29169 CVE-2023-29169

mySCADA myPRO versions 8.26.0 and prior has parameters which an authenticated user could exploit to inject arbitrary operating system commands...

CVE-2023-29169

Summary (CVE-2023-29169) mySCADA myPRO versions 8.26.0 and prior are affected by an OS command injection vulnerability. An authenticated user can exploit parameters with insufficient validation to inject arbitrary operating system commands. This is documented in multiple sources (including Red Ha...

CVE-2023-29150

CVE-2023-29150 affects mySCADA myPRO up to version 8.26.0 and earlier, due to parameters that authenticated users can abuse to inject OS commands. Public sources (NVD/Red Hat CNVD/ICS advisories) confirm OS command injection with high impact (C/H, I/H, A/H) and note remote exposure in advisories,...

PT-2023-23010

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 12.4 Description An OS Command Injection issue in the authenticated endpoint /plugin/CloneSite/cloneClient.json.php allows attackers to achieve Remote Code Execution. The vulnerable code executes a command that include...

CVE-2023-28771

Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions 4.60 through 5.35, USG FLEX series firmware versions 4.60 through 5.35, and ATP series firmware versions 4.60 through 5.35, which could allow an unauthenticated attacker to...

Command injection

The post-authentication command injection vulnerability in the CLI command of Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEX series firmware versions 4.50 through 5.35, USG FLEX 50W firmware versions 4.16 through 5.35, USG20W-VPN firmware versions 4.16 through 5.35, and VPN series...

CVE-2023-25132

Unrestricted upload of file with dangerous type vulnerability in default.cmd file in PowerPanel Business Local/Remote for Windows v4.8.6 and earlier, PowerPanel Business Management for Windows v4.8.6 and earlier, PowerPanel Business Local/Remote for Linux 32bit v4.8.6 and earlier, PowerPanel...

Design/Logic Flaw

Unrestricted upload of file with dangerous type vulnerability in default.cmd file in PowerPanel Business Local/Remote for Windows v4.8.6 and earlier, PowerPanel Business Management for Windows v4.8.6 and earlier, PowerPanel Business Local/Remote for Linux 32bit v4.8.6 and earlier, PowerPanel...

CVE-2023-25132 Unrestricted upload of file with dangerous type vulnerability in CyberPower PowerPanel Business

Unrestricted upload of file with dangerous type vulnerability in default.cmd file in PowerPanel Business Local/Remote for Windows v4.8.6 and earlier, PowerPanel Business Management for Windows v4.8.6 and earlier, PowerPanel Business Local/Remote for Linux 32bit v4.8.6 and earlier, PowerPanel...

CVE-2023-27991

Zyxel vulnerability CVE-2023-27991 is a post-authentication command injection in the CLI of Zyxel firewall devices (ATP, USG FLEX, USG FLEX 50(W), USG20(W)-VPN, VPN, ZyWALL/USG) that could let an authenticated attacker execute OS commands remotely. Affected firmware ranges include ATP 4.32–5.35, ...

CVE-2023-25133

The CVE CVE-2023-25133 describes an improper privilege management flaw in the default.cmd file used by CyberPower PowerPanel Business products. Affected versions include Windows, Linux (32/64-bit), and macOS platforms up to and including v4.8.6. The issue allows remote attackers to execute operat...

CVE-2023-25132

The CVE-2023-25132 vulnerability affects CyberPower PowerPanel Business family (Windows/Linux/macOS) with Local/Remote deployments prior to version 4.8.6. The issue is described as an unrestricted upload of a file with a dangerous type in the default.cmd file, enabling remote attackers to execute...

IBM Corporation AIX errlog() Log Injection Vulnerability

Talos Vulnerability Report TALOS-2023-1690 IBM Corporation AIX errlog Log Injection Vulnerability April 24, 2023 CVE Number None,CVE-2023-26286 SUMMARY An OS command injection vulnerability exists in the errlog syscall functionality of IBM Corporation AIX 7.2. A specially crafted syscall can lead...

CVE-2023-22914

CVE-2023-22914 affects Zyxel USG FLEX (firmware 4.50–5.35) and VPN series (4.30–5.35). The root cause is a path traversal in account_print.cgi that can let a remote authenticated administrator execute OS commands in the tmp directory by uploading a crafted file when the hotspot function is enable...

OS Command Injection via Type Confusion in Scan and Preview Parameters

Description Scanservjs has a RESTful API that provides endpoints for interacting with scanners using the SANE library. There are two APIs for scanning an image and generating a preview image that call out to Process.spawn, invoking a scanimage command as a subprocess of the server, and passing...

CVE-2023-2131

Versions of INEA ME RTU firmware prior to 3.36 are vulnerable to OS command injection, which could allow an attacker to remotely execute arbitrary code...

Command injection

Versions of INEA ME RTU firmware prior to 3.36 are vulnerable to OS command injection, which could allow an attacker to remotely execute arbitrary code...