Vulnerabilities fixed in Trend Micro Apex One

Trend Micro has fixed vulnerabilities in the Apex One management console. The vulnerability in the management console allows a remote attacker without authentication to arbitrarily upload code and execute commands on affected installations. Both CVEs are similar, it just affects different CPU...

CVE-2025-23310

NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability where an attacker could cause stack buffer overflow by specially crafted inputs. A successful exploit of this vulnerability might lead to remote code execution, denial of service, information disclosure, and data...

ROS-20250806-13

Golang programming language vulnerability is related to improper input validation. Exploitation exploitation of the vulnerability could allow an attacker acting remotely to execute arbitrary code A vulnerability in the crypto-elliptic component of the Golang programming language is related to the...

xorg-x11-server: XTestSwapFakeInput stack overflow

A vulnerability was found in X.Org. The issue occurs due to the swap handler for the XTestFakeInput request of the XTest extension, possibly corrupting the stack if GenericEvents with lengths larger than 32 bytes are sent through the XTestFakeInput request. This flaw can lead to local privilege...

Exploit for Out-of-bounds Write in Squid-Cache Squid

🛑 CVE-2025-54574 — Heap Buffer Overflow in Squid ≤ 6.3 🛑...

WeGIA web manager SQL Injection

The vulnerability of the WeGIA web manager is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL code remotely...

CVE-2013-10049 Raidsonic NAS Devices Unauthenticated Remote Command Execution

An OS command injection vulnerability exists in multiple Raidsonic NAS devices—specifically tested on IB-NAS5220 and IB-NAS4220—via the unauthenticated timeHandler.cgi endpoint exposed through the web interface. The CGI script fails to properly sanitize user-supplied input in the timeZone paramet...

CVE-2013-10048

The CVE-2013-10048 entry describes an OS command injection in legacy D-Link routers (DIR-300 rev B and DIR-600) due to unauthenticated input handling in the command.php endpoint. A remote attacker can send specially crafted POST requests to execute arbitrary shell commands with root privileges, e...

Synactis PDF In-The-Box security vulnerability

Synactis PDF In-The-Box is a PDF generation and manipulation component from the French company Synactis. A security vulnerability exists in Synactis PDF In-The-Box that stems from a buffer overflow in the ConnectToSynactis method, which could lead to remote code execution...

SUSE Manager Auth Bypass Privilege Escalation

The vulnerability of the SUSE Manager, a tool for centralized management of IT infrastructure, is related to the lack of authentication for critical functions. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands with root privileges remotely...

HPESBNW04907 rev.1 - HPE Telco Service Orchestrator Software, Remote Command Execution Vulnerability

Potential Security Impact: Remote: Arbitrary Command Execution SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Telco Service Orchestrator - Prior to v5.3.4 CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- | --- | | CVE-2025-7783 |...

CVE-2014-125124 Pandora FMS <= 5.0RC1 Anyterm Unauthenticated Command Injection

An unauthenticated remote command execution vulnerability exists in Pandora FMS versions up to and including 5.0RC1 via the Anyterm web interface, which listens on TCP port 8023. The anyterm-module endpoint accepts unsanitized user input via the p parameter and directly injects it into a shell...

CVE-2014-125124

Summary: CVE-2014-125124 affects Pandora FMS

CVE-2014-125124 Pandora FMS <= 5.0RC1 Anyterm Unauthenticated Command Injection

An unauthenticated remote command execution vulnerability exists in Pandora FMS versions up to and including 5.0RC1 via the Anyterm web interface, which listens on TCP port 8023. The anyterm-module endpoint accepts unsanitized user input via the p parameter and directly injects it into a shell...

D-Link DI-7300G+ ASP File Command Execution

The vulnerability of D-Link DI-7300G+ router microprogramming software is related to the lack of measures taken to neutralize special elements during the processing of the asp-file httpddebug.asp. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

CVE-2025-45346

SQL Injection vulnerability in Bacula-web before v.9.7.1 allows a remote attacker to execute arbitrary code via a crafted HTTP GET request...

gix-transport crate operating system command injection vulnerability

gix-transport crate is a Rust library open-sourced by GitoxideLabs. An operating system command injection vulnerability exists in gix-transport crate versions prior to 0.36.1, which stems from the fact that ssh command injection may lead to remote command execution...

Exploit for Path Traversal in Mikrotik Routeros

Ladon Scanner For Golang Wiki http://k8gege.org/Ladon/LadonGo.html Introduction LadonGo is an open source intranet penetration scanner framework, which can be used to easily detect segment C, B, A live hosts, fingerprint identification, port scanning, password explosion, remote execution, high-ri...

Exploit for CVE-2024-2961

sectoolset -- Github安全相关工具集合 主要内容： 0x00 漏洞利用实战练习&CTF安全竞赛 0x01 安全扫描器 0x02 安全防守 0x03 渗透测试 0x04 漏洞库及利用工具（POC，EXP 0x05 二进制及代码分析工具 0x06 威胁情报&蜜罐 0x07 安全文档资料 0x10 AI&大模型安全 0x11 所有内容 乌云镜像 乌云镜像，已挂 乌云镜像,已挂 近期安全热点 CVE-2025-48384: Git子模块回车符CR解析注入可致RCE GitHub MCP漏洞：劫持MCP服务访问私有仓库数据 glibc iconv中的缓冲区溢出导致PHP...

CVE-2025-54379 eKuiper API endpoints handling SQL queries with user-controlled table names.

LF Edge eKuiper is a lightweight IoT data analytics and stream processing engine running on resource-constraint edge devices. In versions before 2.2.1, there is a critical SQL Injection vulnerability in the getLast API functionality of the eKuiper project. This flaw allows unauthenticated remote...