17412 matches found
PT-2023-32349 · WordPress · The News & Blog Designer Pack
Name of the Vulnerable Software and Affected Versions: The News & Blog Designer Pack – WordPress Blog Plugin versions up to, and including, 3.4.1 Description: The issue is related to Remote Code Execution via Local File Inclusion. This is due to the bdp get more post function utilizing an unsafe...
RiteCMS Cross-Site Scripting Vulnerability (CNVD-2023-86334)
RiteCMS is a website CMS. A cross-site scripting vulnerability exists in RiteCMS v3.0, which stems from the application's lack of effective validation of uploaded files. The vulnerability can be exploited to remotely execute arbitrary code by uploading malicious files...
CVE-2023-45869
ILIAS 7.25 2023-09-12 allows any authenticated user to execute arbitrary operating system commands remotely, when a highly privileged account accesses an XSS payload. The injected commands are executed via the exec function in the execQuoted method of the ilUtil class...
F5 BIG-IP Configuration utility 访问控制错误漏洞
F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, and remote access policy management. F5 BIG-IP suffers from a remote code execution vulnerability caused by a configuration utility authentication bypass flaw. An...
Fedora 38 : xen (2023-a4c606585e)
The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-a4c606585e advisory. xenstored: A transaction conflict can crash C Xenstored XSA-440, CVE-2023-34323 x86/AMD: missing IOMMU TLB flushing XSA-442, CVE-2023-34326 Multiple...
CVE-2023-45869
ILIAS 7.25 2023-09-12 allows any authenticated user to execute arbitrary operating system commands remotely, when a highly privileged account accesses an XSS payload. The injected commands are executed via the exec function in the execQuoted method of the ilUtil class...
CVE-2023-46424
TOTOLINK X6000R v9.4.0cu.652B20230116 was discovered to contain a remote command execution RCE vulnerability via the sub422BD4 function...
Remote Code Execution (RCE)
github.com/jumpserver/kokoi is vulnerable to Remote Code Execution. This vulnerability exists due to the lack of sanitized mongodb sessions, allowing an attacker to inject and execute arbitrary code in the system and gain root privileges...
The vulnerability of the SolarWinds Access Rights Manager software lies in the incorrect restriction of the path name to the restricted directory. This allows a violator to execute arbitrary code.
The vulnerability of the SolarWinds Access Rights Manager software relates to incorrect restrictions on the path to the restricted directory. Exploiting this vulnerability could allow a malicious actor, operating remotely, to execute arbitrary code...
The vulnerability of the /log/mailrecvview.php file in the D-Link DAR-7000 router microprogramming system allows a hacker to execute arbitrary SQL code.
The vulnerability of the /log/mailrecvview.php file in the D-Link DAR-7000 router microprogramming system is related to the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL code remotely...
The vulnerability of the `parse_user_filters` function in the SupportCandy plugin of the WordPress content management system allows a hacker to execute arbitrary SQL queries.
The vulnerability of the parseuserfilters function in the SupportCandy plugin of the WordPress content management system is related to the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries remotely...
PT-2023-30022 · Totolink · Totolink X6000R
Name of the Vulnerable Software and Affected Versions: TOTOLINK X6000R version 9.4.0cu.652 B20230116 Description: A remote command execution issue was discovered, allowing for potential exploitation via the sub 417094 function. This issue affects the specified version of the TOTOLINK X6000R route...
The vulnerability of the /importexport.php file in the D-Link DAR-7000 router microprogramming system allows a hacker to execute arbitrary SQL code.
The vulnerability of the /importexport.php file in the D-Link DAR-7000 router microprogramming system is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL code remotely...
TOTOLINK X6000R Command Injection Vulnerability
The TOTOLINK X6000R is a wireless router from China's Gion Electronics TOTOLINK. A security vulnerability exists in the TOTOLINK X6000R v9.4.0cu.652B20230116 version that stems from a remote command execution vulnerability in the method in the sub41E588 location...
XWiki Rendering Security Vulnerability
XWiki Rendering is a general-purpose rendering system from the XWiki Foundation that converts text input from a given syntax wiki syntax, HTML, etc. to another syntax XHTML, etc.. A security vulnerability exists in XWiki Rendering that stems from a footnote macro executing its contents in possibl...
The vulnerability of the SolarWinds Access Rights Manager software lies in the incorrect restriction of the path name to the restricted directory. This allows a violator to execute arbitrary code.
The vulnerability of the SolarWinds Access Rights Manager software relates to incorrect restrictions on the path to the restricted directory. Exploiting this vulnerability could allow a malicious actor, operating remotely, to execute arbitrary code...
CVE-2023-5698
A vulnerability classified as problematic was found in CodeAstro Internet Banking System 1.0. This vulnerability affects unknown code of the file pagesdepositmoney.php. The manipulation of the argument accountnumber with the input 421873905--alert9523!-- leads to cross site scripting. The attack...
CVE-2023-42295
An issue in OpenImageIO oiio v.2.4.12.0 allows a remote attacker to execute arbitrary code and cause a denial of service via the readrleimage function of file bifs/unquantize.c...
The vulnerability in the web interface of the Cisco IOS XE operating system allows a perpetrator to execute arbitrary commands on a device with root privileges.
The vulnerability of the Cisco IOS XE operating system’s web interface is related to errors in privilege management. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands on a device with root privileges remotely...
