PT-2023-5275 · Tp Link · Tp-Link Archer A10

Name of the Vulnerable Software and Affected Versions: TP-Link Archer A10 firmware versions prior to Archer A10JP V2 230504 Description: The issue exists due to the lack of measures to neutralize special elements used in the operating system command. This allows a network-adjacent unauthenticated...

CVE-2015-2201

Aruba AirWave before 7.7.14.2 and 8.x before 8.0.7 allows VisualRF remote OS command execution and file disclosure by administrative users...

CVE-2015-2201

Aruba AirWave contains a vulnerability in VisualRF that permits remote OS command execution and file disclosure by administrative users in affected releases. Affected versions are Aruba AirWave before 7.7.14.2 and 8.x before 8.0.7. The issue is triggered through VisualRF components and could lead...

CVE-2023-40158

Hidden functionality vulnerability in the CBC products allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter its settings. As for the affected products/versions, see the detailed information provided by the vendor. Note that NR4H, NR8H, NR16H series and...

Authentication flaw

Improper authentication vulnerability in the CBC products allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter its settings. As for the affected products/versions, see the detailed information provided by the vendor. Note that NR4H, NR8H, NR16H series a...

Ivanti Warns of Critical Zero-Day Flaw Being Actively Exploited in Sentry Software

Software services provider Ivanti is warning of a new critical zero-day flaw impacting Ivanti Sentry formerly MobileIron Sentry that it said is being actively exploited in the wild, marking an escalation of its security woes. Tracked as CVE-2023-38035 CVSS score: 9.8, the issue has been described...

CVE-2023-38576

Hidden functionality vulnerability in LAN-WH300N/RE all versions provided by LOGITEC CORPORATION allows an authenticated user to execute arbitrary OS commands on a certain management console...

PT-2023-23922 · Unknown · Lan-W300N/Pr5 +1

Name of the Vulnerable Software and Affected Versions: LAN-W300N/RS all versions LAN-W300N/PR5 all versions Description: A hidden functionality vulnerability allows an unauthenticated attacker to log in to the product's certain management console and execute arbitrary OS commands. Recommendations...

PT-2023-27248 · Elecom · Elecom Wireless Access Points

Name of the Vulnerable Software and Affected Versions: ELECOM wireless LAN access point devices affected versions not specified WAB-S600-PS all versions WAB-S300 all versions Description: The issue allows an authenticated user to execute an arbitrary OS command by sending a specially crafted...

CVE-2023-33376

Connected IO v2.1.0 and prior has an argument injection vulnerability in its iptables command message in its communication protocol, enabling attackers to execute arbitrary OS commands on devices...

Design/Logic Flaw

Connected IO v2.1.0 and prior has an argument injection vulnerability in its iptables command message in its communication protocol, enabling attackers to execute arbitrary OS commands on devices...

CVE-2023-33376

CVE-2023-33376 affects Connected IO ER2000 edge routers (v2.1.0 and prior). Root cause: argument injection in the iptables command message within the device’s communication protocol. Impact: attackers can remotely execute arbitrary OS commands on affected devices. CVSSv3.1 base score 9.8 (CRITICA...

Ivanti Addressed Second Zero-Day Flaw Exploited by Attackers

Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary The zero-day vulnerability CVE-2023-35081 in Ivanti EPMM enables admin-authenticated attackers to write arbitrary files, risking unauthorized access, OS command execution, and malicious web shell...

Ivanti Warns of Another Endpoint Manager Mobile Vulnerability Under Active Attack

Ivanti has disclosed yet another security flaw impacting Endpoint Manager Mobile EPMM, formerly known as MobileIron Core, that it said has been weaponized as part of an exploit chain by malicious actors in the wild. The new vulnerability, tracked as CVE-2023-35081 CVSS score: 7.8, impacts support...

CVE-2023-33011

A format string vulnerability in the Zyxel ATP series firmware versions 5.10 through 5.36 Patch 2, USG FLEX series firmware versions 5.00 through 5.36 Patch 2, USG FLEX 50W series firmware versions 5.10 through 5.36 Patch 2, USG20W-VPN series firmware versions 5.10 through 5.36 Patch 2, and VPN...

CVE-2023-33011

A format string vulnerability in the Zyxel ATP series firmware versions 5.10 through 5.36 Patch 2, USG FLEX series firmware versions 5.00 through 5.36 Patch 2, USG FLEX 50W series firmware versions 5.10 through 5.36 Patch 2, USG20W-VPN series firmware versions 5.10 through 5.36 Patch 2, and VPN...

U.S. Dept Of Defense: Blind Sql Injection in https://████████/

A blind SQL injection vulnerability was discovered in the █████████ website. This vulnerability allowed an attacker to bypass authentication and retrieve sensitive information from the database. The vulnerability was successfully exploited using SQLmap, a popular SQL injection tool...

pfSense Restore RRD Data Command Injection

class MetasploitModule 'pfSense Restore RRD Data Command Injection', 'Description' = %q This module exploits an authenticated command injection vulnerabilty in the "restorerrddata" function of pfSense prior to version 2.7.0 which allows an authenticated attacker with the "WebCfg - Diagnostics:...

CVE-2023-32621

WL-WN531AX2 firmware versions prior to 2023526 allows an attacker with an administrative privilege to upload arbitrary files and execute OS commands with the root privilege...

Design/Logic Flaw

WL-WN531AX2 firmware versions prior to 2023526 allows an attacker with an administrative privilege to upload arbitrary files and execute OS commands with the root privilege...