Rocky Linux Updates in ASCG 3.3.0

Multiple Rocky Linux updates applied to Brocade ASCG 3.3.0 RockyLinux 8:bzip2 RLSA-2025:0733 bzip2: bzip2: Data integrity error when decompressing with data integrity tests fail. CVE-2019-12900 RockyLinux 8:pam RLSA-2024:10379 pam: libpam: Libpam vulnerable to read hashed password CVE-2024-10041...

The vulnerability of the NetMRI network monitoring program, related to the failure to take measures for data cleaning at the management level, allows a perpetrator to execute arbitrary commands.

The vulnerability of the NetMRI network monitoring program lies in the lack of measures taken to clean data at the management level. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

[SECURITY] Fedora 42 Update: salt-3007.5-2.fc42

Salt is a distributed remote execution system used to execute commands and query data. It was developed in order to bring the best solutions found in the world of remote execution together and make them better, faster and more malleable. Salt accomplishes this via its ability to handle larger loa...

Metasploit Weekly Wrap-Up 06/17/2025

New Modules & Adapters, and Improvements! This week’s release brings new modules, additional adapter payloads and improvements to existing modules and features. These modules target software such as ThinManager, Remote for Mac, Roundcube and more. It also includes additional work from bcoles that...

[SECURITY] Fedora 41 Update: salt-3007.5-2.fc41

Salt is a distributed remote execution system used to execute commands and query data. It was developed in order to bring the best solutions found in the world of remote execution together and make them better, faster and more malleable. Salt accomplishes this via its ability to handle larger loa...

CVE-2025-50123

A CWE-94: Improper Control of Generation of Code 'Code Injection' vulnerability exists that could cause remote command execution by a privileged account when the server is accessed via a console and through exploitation of the hostname input...

CVE-2025-7421

A vulnerability was found in Tenda O3V2 1.0.0.123880. It has been rated as critical. This issue affects the function fromMacFilterModify of the file /goform/operateMacFilter of the component httpd. The manipulation of the argument mac leads to stack-based buffer overflow. The attack may be...

VulnCheck KEV: CVE-2025-7451

The iSherlock developed by Hgiga has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the server. This vulnerability has already been exploited. Please update immediately...

Belkin F9K1122 Command Injection Vulnerability (CNVD-2025-20839)

The Belkin F9K1122 is a WiFi signal extender from Belkin Canada. The Belkin F9K1122 suffers from a command injection vulnerability that stems from the parameter command in the file /goform/mp failing to properly filter constructed command special characters, commands, and so on. An attacker can...

CVE-2025-7415 Tenda O3V2 httpd getTraceroute fromTraceroutGet command injection

A vulnerability, which was classified as critical, has been found in Tenda O3V2 1.0.0.123880. This issue affects the function fromTraceroutGet of the file /goform/getTraceroute of the component httpd. The manipulation of the argument dest leads to command injection. The attack may be initiated...

CVE-2025-34095 Mako Server v2.5 and v2.6 OS Command Injection via examples/save.lsp

An OS command injection vulnerability exists in Mako Server versions 2.5 and 2.6, specifically within the tutorial interface provided by the examples/save.lsp endpoint. An unauthenticated attacker can send a crafted PUT request containing arbitrary Lua os.execute code, which is then persisted on...

CVE-2025-34095

An OS command injection exists in Real Time Logic Mako Server v2.5 and v2.6 via the examples/save.lsp tutorial interface. An unauthenticated attacker can send a crafted PUT request containing arbitrary Lua os.execute() code, which is persisted on disk and later executed when a GET is issued to ex...

CVE-2025-41666

A low privileged remote attacker with file access can replace a critical file used by the watchdog to get read, write and execute access to any file on the device after the watchdog has been initialized...

Important: dotnet8.0

Issue Overview: A remote code execution vulnerability in .NET 8.0 and 9.0. An attacker who can place malicious files in specific locations may trigger unintended code execution when the .NET runtime loads these files. CVE-2025-30399 Affected Packages: dotnet8.0 Issue Correction: Run dnf update...

PT-2025-29141 · Vicidial · Vicidial

Name of the Vulnerable Software and Affected Versions: VICIdial versions 2.9 RC1 through 2.13 RC1 Description: An unauthenticated command injection issue exists in the vicidial sales viewer.php component when password encryption is enabled. The application improperly passes the HTTP Basic...

PT-2025-29366 · Totolink · Totolink T6

Name of the Vulnerable Software and Affected Versions: TOTOLINK T6 version 4.1.5cu.748 B20211015 Description: A critical vulnerability exists in the TOTOLINK T6 router. The issue is a command injection vulnerability located in the setDiagnosisCfg function within the /cgi-bin/cstecgi.cgi file of t...

CVE-2025-37102 Authenticated Command Injection Vulnerability In Instant On Command Line Interface

An authenticated command injection vulnerability exists in the Command line interface of HPE Networking Instant On Access Points. A successful exploitation could allow a remote attacker with elevated privileges to execute arbitrary commands on the underlying operating system as a highly privilege...

CVE-2025-49663 Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability

...

CVE-2025-42967 Code Injection vulnerability in SAP S/4HANA and SAP SCM (Characteristic Propagation)

SAP S/4HANA and SAP SCM Characteristic Propagation has remote code execution vulnerability. This allows an attacker with user level privileges to create a new report with his own code potentially gaining full control of the affected SAP system causing high impact on confidentiality, integrity, an...

WordPress plugin Support Board 路径遍历漏洞

Support Board is an online customer service communication plugin for WordPress platform, which is mainly used to improve the user experience and customer service efficiency of the website. WordPress Support Board plugin has a path traversal vulnerability, the vulnerability stems from the...