XXL-Job 安全漏洞

XXL-JOB is a distributed task scheduling platform based on the java language from the Xu Xueli XXL-JOB community. A security vulnerability exists in XXL-Job version v2.4.1 that originates from allowing a user to execute arbitrary commands on another user's account by using a crafted POST request ...

Exploit for Code Injection in Vmware Spring_Cloud_Function

Exploit for RCE in Spring Cloud CVE 2022-22963 Exploit for...

VulnCheck KEV: CVE-2023-28771

Zyxel ATP, USG FLEX, VPN, and ZyWALL/USG firewalls allow for improper error message handling which could allow an unauthenticated attacker to execute OS commands remotely by sending crafted packets to an affected device...

PT-2023-3100 · D Link · D-Link Dir-842

Name of the Vulnerable Software and Affected Versions: D-Link DIR-842V2 version 1.0.3 Description: The issue allows attackers to execute arbitrary commands via importing a crafted file. This is related to the lack of data cleaning measures at the management level, which can be exploited by a remo...

Seagate Central Storage 2015.0916 - Unauthenticated Remote Command Execution (Metasploit)

Exploit Title: Seagate Central Storage 2015.0916 - Unauthenticated Remote Command Execution Metasploit Date: Dec 9 2019 Exploit Author: Ege Balci Vendor Homepage: https://www.seagate.com/de/de/support/external-hard-drives/network-storage/seagate-central/ Version: 2015.0916 CVE : 2020-6627 This...

CVE-2023-33246

For RocketMQ versions 5.1.0 and below, under certain conditions, there is a risk of remote command execution. Several components of RocketMQ, including NameServer, Broker, and Controller, are leaked on the extranet and lack permission verification, an attacker can exploit this vulnerability by...

Design/Logic Flaw

For RocketMQ versions 5.1.0 and below, under certain conditions, there is a risk of remote command execution. Several components of RocketMQ, including NameServer, Broker, and Controller, are leaked on the extranet and lack permission verification, an attacker can exploit this vulnerability by...

CVE-2023-33246

CVE-2023-33246 affects Apache RocketMQ 5.1.0 and earlier. The vulnerability arises from leakage of NameServer, Broker, and Controller on the extranet with insufficient permission verification, allowing an attacker to trigger remote code execution by using the update configuration function or by f...

CVE-2023-33246 Apache RocketMQ: Possible remote code execution vulnerability when using the update configuration function

For RocketMQ versions 5.1.0 and below, under certain conditions, there is a risk of remote command execution. Several components of RocketMQ, including NameServer, Broker, and Controller, are leaked on the extranet and lack permission verification, an attacker can exploit this vulnerability by...

Barracuda Email Security Gateway 命令注入漏洞

Barracuda Email Security Gateway is an email security gateway from Barracuda that manages and filters all inbound and outbound email traffic to protect organizations from email threats and data breaches. A security vulnerability exists in Barracuda Email Security Gateway versions 5.1.3.001 throug...

Roxy WI 6.1.0.0 Remote Command Execution

Exploit Title: Roxy WI v6.1.0.0 - Unauthenticated Remote Code Execution RCE via subprocessexecute Exploit Author: Iyaad Luqman K Application: Roxy WI = v6.1.0.0 Vendor Homepage: https://roxy-wi.org Software Link: https://github.com/hap-wi/roxy-wi.git Tested on: Ubuntu 22.04 CVE : CVE-2022-31137 P...

The vulnerability of the beh component (Backend Error Handler) of the cups-filters printing package allows a hacker to execute arbitrary commands on the printing server.

The vulnerability of the beh component Backend Error Handler of the cups-filters printing package exists because measures to neutralize special elements used in the operating system commands are not taken. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands on the...

The vulnerability of the SolarWinds Orion Platform’s network monitoring software, related to improper code generation management, allows a intruder to execute arbitrary commands.

The vulnerability of the SolarWinds Orion Platform’s network monitoring software lies in improper code generation management. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

The vulnerability of the NTPSyncWithHost function in D-Link DIR-816 A2 router microprogramming software allows a hacker to execute arbitrary commands.

The vulnerability of the NTPSyncWithHost function in D-Link DIR-816 A2 router microprogramming software exists due to the failure to take measures to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary...

CVE-2023-33246

For RocketMQ versions 5.1.0 and below, under certain conditions, there is a risk of remote command execution. Several components of RocketMQ, including NameServer, Broker, and Controller, are leaked on the extranet and lack permission verification, an attacker can exploit this vulnerability by...

PT-2023-5402 · Apache · Apache Rocketmq

Name of the Vulnerable Software and Affected Versions: Apache RocketMQ versions 5.1.0 and below Apache RocketMQ versions prior to 4.9.6 Description: The vulnerability is related to a permission verification issue in Apache RocketMQ, allowing attackers to perform remote command execution under...

PT-2023-2983 · D Link · D-Link Dir-846

Name of the Vulnerable Software and Affected Versions: D-Link DIR-846 version 1.00A52 Description: The issue is related to the implementation of the HNAP1 protocol in the D-Link DIR-846 router's firmware, specifically concerning the handling of the tomography ping address parameter. This can be...

The vulnerability of the application programming interface of the Cisco DNA Center allows a attacker to execute arbitrary commands with root privileges.

The vulnerability of the application programming interface of the Cisco DNA Center relates to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor, operating remotely, to execute arbitrary commands with root privileges using a specially created API...

VulnCheck KEV: CVE-2023-2868

Barracuda Email Security Gateway ESG appliance contains an improper input validation vulnerability of a user-supplied .tar file, leading to remote command injection...

The vulnerability of the SetQoSSettings.php script in D-Link DIR-822 router software allows a hacker to execute arbitrary commands.

The vulnerability of the SetQoSSettings.php script in D-Link DIR-822 router microprogramming software is related to insufficient checking of regular expressions during the processing of the uplink parameter. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...