Super Store Finder 3.7 Remote Command Execution Vulnerability

Vulnerability : Authenticated Arbitrary PHP Code Injection lead to Remote Code Execution Researcher : Etharus Vendor : Joe Iz, https://www.superstorefinder.net/ Demo Url : https://superstorefinder.net/products/superstorefinder/ Version Affected : 3.7 and below Date : 18 September 2023 FOFA Dork :...

PT-2023-7787 · Nagios Xi · Nagios Xi

Name of the Vulnerable Software and Affected Versions: Nagios XI affected versions not specified Description: The issue is related to the Nagios XI monitoring tool, which fails to properly protect its web page structure when handling input fields $ARG1$ and $ARG2$. This can be exploited by a remo...

CVE-2023-33831

A remote command execution RCE vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute arbitrary commands via a crafted POST request...

CVE-2023-33831

A remote command execution RCE vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute arbitrary commands via a crafted POST request...

Design/Logic Flaw

A remote command execution RCE vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute arbitrary commands via a crafted POST request...

CVE-2023-33831

A remote command execution RCE vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute arbitrary commands via a crafted POST request...

CVE-2023-33831

A remote command execution RCE vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute arbitrary commands via a crafted POST request...

CVE-2023-33831

A remote command execution RCE vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute arbitrary commands via a crafted POST request...

FUXA Command Injection Vulnerability

FUXA is an open source web-based process visualization SCADA/HMI/Dashboard software. A security vulnerability exists in FUXA version 1.1.13, which stems from a Remote Command Execution RCE vulnerability in the /api/runscript endpoint. An attacker can exploit the vulnerability to execute arbitrary...

CVE-2023-33831: Improper Neutralization of Special Elements used in a Command

A remote command execution RCE vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute arbitrary commands via a crafted POST request...

CVE-2023-33831

CVE-2023-33831 affects FUXA 1.1.13 via the unauthenticated /api/runscript endpoint, enabling remote code execution through a crafted POST request. The underlying issue allows attackers to execute arbitrary commands, potentially compromising the SCADA/HMI system. Affected component: runscript API ...

PaperCut NG XML-RPC Arbitrary Command Execution

The vulnerability of the XML-RPC protocol implementation in the PaperCut NG network printing control software is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

CVE-2023-42362

An arbitrary file upload vulnerability in Teller Web App v.4.4.0 allows a remote attacker to execute arbitrary commands and obtain sensitive information via uploading a crafted file...

CVE-2023-42362

An arbitrary file upload vulnerability in Teller Web App v.4.4.0 allows a remote attacker to execute arbitrary commands and obtain sensitive information via uploading a crafted file...

CVE-2023-42362: Improper Neutralization of Input During Web Page Generation

An arbitrary file upload vulnerability in Teller Web App v.4.4.0 allows a remote attacker to execute arbitrary commands and obtain sensitive information via uploading a crafted file...

Zoho ManageEngine ADManager Plus Access Control Privilege Escalation

The vulnerability of the Zoho ManageEngine ADManager Plus software for managing Active Directory services is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands with superuser privileges remotely...

Traffic Analyzer Statistical Command Execution

The vulnerability of the Traffic Analyzer – Statistical function in the microprogramming software for Wi-Fi routers from ASUS’ RT-AC86U relates to the lack of measures taken to neutralize special elements used in the operating system commands. Exploiting this vulnerability can allow a remote...

PT-2023-5241 · 1с · 1С-Битрикс

Name of the Vulnerable Software and Affected Versions: 1С-Битрикс: Управление сайтом affected versions not specified Description: The issue is caused by synchronization errors when using a shared resource in the landing module of the 1С-Битрикс site management system. Exploitation of this issue m...

PT-2023-28323 · Unknown · Teller Web App

Name of the Vulnerable Software and Affected Versions: Teller Web App version 4.4.0 Description: An arbitrary file upload vulnerability allows a remote attacker to execute arbitrary commands and obtain sensitive information via uploading a crafted file. Recommendations: For Teller Web App version...

CVE-2023-41331

SOFARPC is a Java RPC framework. Versions prior to 5.11.0 are vulnerable to remote command execution. Through a carefully crafted payload, an attacker can achieve JNDI injection or system command execution. In the default configuration of the SOFARPC framework, a blacklist is used to filter out...