EasyPHP Webserver 14.1 - Multiple Vulnerabilities (RCE and Path Traversal) Exploit

Exploit Title: EasyPHP Webserver 14.1 - Multiple Vulnerabilities RCE and Path Traversal Discovery by: Rafael Pedrero Discovery Date: 2022-02-06 Vendor Homepage: https://www.easyphp.org/ Software Link : https://www.easyphp.org/ Tested Version: 14.1 Tested on: Windows 7 and 10 Vulnerability Type:...

TOTOLINK Wireless Routers unauthenticated remote command execution vulnerability.

Multiple TOTOLINK network products contain a command insertion vulnerability in setting/setTracerouteCfg. This vulnerability allows an attacker to execute arbitrary commands through the "command" parameter. After exploitation, an attacker will have full access with the same user privileges under...

EasyPHP Webserver 14.1 - Multiple Vulnerabilities (RCE and Path Traversal)

Exploit Title: EasyPHP Webserver 14.1 - Multiple Vulnerabilities RCE and Path Traversal Discovery by: Rafael Pedrero Discovery Date: 2022-02-06 Vendor Homepage: https://www.easyphp.org/ Software Link : https://www.easyphp.org/ Tested Version: 14.1 Tested on: Windows 7 and 10 Vulnerability Type:...

The vulnerability of the Virtual Delivery Agent (VDA) software, used for virtualizing and delivering Citrix Virtual Apps and Desktops (formerly XenApp and XenDesktop), on Windows operating systems, allows a malicious individual to escalate their privileges and execute arbitrary commands.

The vulnerability of the Virtual Delivery Agent VDA software for virtualizing and delivering Citrix Virtual Apps and Desktops formerly XenApp and XenDesktop on Windows operating systems is related to deficiencies in access control when using a multi-user mode. Exploiting this vulnerability can...

CVE-2023-28742

When DNS is provisioned, an authenticated remote command execution vulnerability exists in DNS iQuery mesh. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

Design/Logic Flaw

When DNS is provisioned, an authenticated remote command execution vulnerability exists in DNS iQuery mesh. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

CVE-2023-28742

CVE-2023-28742 describes an authenticated remote command execution vulnerability in the BIG-IP DNS iQuery mesh when DNS is provisioned. The issue allows an attacker with network access to the DNS iQuery mesh (via the BIG-IP management port and/or self IPs) to execute arbitrary system commands thr...

CVE-2023-28742 BIG-IP iQuery mesh vulnerability

When DNS is provisioned, an authenticated remote command execution vulnerability exists in DNS iQuery mesh. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

K000132972: BIG-IP iQuery mesh vulnerability CVE-2023-28742

Security Advisory Description When DNS is provisioned, an authenticated remote command execution vulnerability exists in DNS iQuery mesh. CVE-2023-28742 Impact This vulnerability may allow an authenticated attacker with network access to the DNS iQuery mesh through the BIG-IP management port and/...

The vulnerability of the zhttpd component in the libclinkc.so library of the ZyXEL DX5401-B0 router’s software allows a malicious actor to execute certain operating system commands remotely.

The vulnerability of the zhttpd component in the libclinkc.so library of the ZyXEL DX5401-B0 router microprogramming system is related to the possibility of buffer overflow in memory. Exploiting this vulnerability could allow a remote attacker to execute certain commands on the operating system...

PT-2023-21932 · Unknown · Dns Iquery Mesh

Name of the Vulnerable Software and Affected Versions: DNS iQuery mesh affected versions not specified Description: A remote command execution issue exists when DNS is provisioned, allowing authenticated attackers to execute commands. The issue is related to the DNS iQuery mesh. Recommendations: ...

CVE-2023-30944

The vulnerability was found Moodle which exists due to insufficient sanitization of user-supplied data in external Wiki method for listing pages. A remote attacker can send a specially crafted request to the affected application and execute limited SQL commands within the application database...

The vulnerability of the warn-proceed handler component of the Sophos Web Appliance (SWA) security and management device allows a perpetrator to execute arbitrary commands.

The vulnerability of the warn-proceed handler component of the Sophos Web Appliance SWA security and management device for web devices is related to the lack of measures to sanitize input data. Exploiting this vulnerability could allow a malicious actor to execute arbitrary commands remotely...

The vulnerability of the command-line interface (CLI) of Cisco Aironet Access Point software allows a attacker to execute arbitrary commands or cause service interruptions.

The vulnerability of the command-line interface CLI of Cisco Aironet Access Point microprogramming software exists because measures to neutralize the special elements used in the operating system command are not taken. Exploiting this vulnerability can allow an attacker to execute arbitrary...

CVE-2023-30856 eDEX-UI cross-site websocket hijacking vulnerability enables remote command execution

eDEX-UI is a science fiction terminal emulator. Versions 2.2.8 and prior are vulnerable to cross-site websocket hijacking. When running eDEX-UI and browsing the web, a malicious website can connect to eDEX's internal terminal control websocket, and send arbitrary commands to the shell. The projec...

Aigital Wireless-N Repeater Mini_Router.0.131229 Remote Command Execution

Exploit Title: Aigital Wireless-N Repeater - Command Injection Exploit Author: Matteo Mandolini Date : 13/04/2023 Vendor Homepage: https://web.archive.org/web/20220625053314/https://www.aigital.com/ Version: MiniRouter.0.131229 Command Injection POST /boafrm/formSysCmd HTTP/1.1 Host: 192.168.10.2...

PT-2023-17677 · Microsoft +1 · Msmq +1

Name of the Vulnerable Software and Affected Versions: aEnrich Technology a+HRD affected versions not specified Description: The issue is related to Deserialization of Untrusted Data within the MSMQ interpreter. An unauthenticated remote attacker can exploit this to execute arbitrary system...

Zyxel DX5401-B0 安全漏洞

The Zyxel DX5401-B0 is a wireless enhancement device from China's Hopkins Zyxel. A security vulnerability exists in the Zyxel DX5401-B0 V5.17ABYO.1C0 firmware version, which originates from a buffer overflow in the zhttpd library libclinkc.so. An attacker can exploit this vulnerability to execute...

CVE-2023-28771

Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions 4.60 through 5.35, USG FLEX series firmware versions 4.60 through 5.35, and ATP series firmware versions 4.60 through 5.35, which could allow an unauthenticated attacker to...

CVE-2023-28771

Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions 4.60 through 5.35, USG FLEX series firmware versions 4.60 through 5.35, and ATP series firmware versions 4.60 through 5.35, which could allow an unauthenticated attacker to...