The vulnerability of microprogrammed software in network video recorders like SystemK NVR 504/508/516 arises from the lack of measures taken to clean data at the control level. This allows intruders to execute arbitrary commands.

The vulnerability of microprogrammed network video recorders like SystemK NVR 504/508/516 lies in the lack of measures taken to clean data at the control level. Exploiting this vulnerability can allow an intruder operating remotely to execute arbitrary commands...

Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

...

PT-2024-4418 · Clang +2 · Clang +2

Name of the Vulnerable Software and Affected Versions: LLVM versions prior to 18.1.3 Description: The issue is related to a buffer overflow in memory when handling the LR register connection due to incorrect code generation management. This can lead to an exploitable error in the flow of control,...

The vulnerability of the Energy Communication Unit (ECU-C) software, related to deficiencies in access control to the password reset code, allows a intruder to execute arbitrary codes.

The vulnerability of the Energy Communication Unit ECU-C control software is related to deficiencies in access control for password reset code. Exploiting this vulnerability allows a remote attacker to execute arbitrary codes...

xorg-x11-server: heap buffer overflow in XISendDeviceHierarchyEvent

A flaw was found in X.Org server. In the XISendDeviceHierarchyEvent function, it is possible to exceed the allocated array length when certain new device IDs are added to the xXIHierarchyInfo struct. This can trigger a heap buffer overflow condition, which may lead to an application crash or remo...

vantage6 Security Vulnerabilities

vantage6 is a vantage6 open source priVAcy preserviNg federalTed leArningG infrastructure for Secure Insight eXchange. A security vulnerability previously existed in vantage6 version 4.2.0 that stemmed from an authenticated user being able to inject code into an algorithmic environment variable...

GHSA-QCJQ-7F7V-PVC8 Nginx-UI vulnerable to authenticated RCE through injecting into the application config via CRLF

Summary Fix bypass to the following bugs - https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-pxmr-q2x3-9x9m - https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-8r25-68wm-jw35 Allowing to inject directly in the app.ini via CRLF to change the value of testconfigcmd and startcm...

Nginx-UI vulnerable to authenticated RCE through injecting into the application config via CRLF

Summary Fix bypass to the following bugs - https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-pxmr-q2x3-9x9m - https://github.com/0xJacky/nginx-ui/security/advisories/GHSA-8r25-68wm-jw35 Allowing to inject directly in the app.ini via CRLF to change the value of testconfigcmd and startcm...

CVE-2024-23741

An issue in Hyper on macOS version 3.4.1 and before, allows remote attackers to execute arbitrary code via the RunAsNode and enableNodeClilnspectArguments settings...

CVE-2024-22862

Integer overflow vulnerability in FFmpeg before n6.1, allows remote attackers to execute arbitrary code via the JJPEG XL Parser...

Metasploit Weekly Wrap-Up 01/26/24

Direct Syscalls Support for Windows Meterpreter Direct system calls are a well-known technique that is often used to bypass EDR/AV detection. This technique is particularly useful when dynamic analysis is performed, where the security software monitors every process on the system to detect any...

CVE-2024-20253

CVE-2024-20253 affects Cisco Unified Communications Manager and related UC/Contact Center products. The root cause is improper processing of user-supplied data read into memory, enabling an unauthenticated, remote attacker to send a crafted message to a listening port and execute arbitrary comman...

CVE-2024-23616

A buffer overflow vulnerability exists in Symantec Server Management Suite version 7.9 and before. A remote, anonymous attacker can exploit this vulnerability to achieve remote code execution as SYSTEM...

CVE-2024-23624 D-Link DAP-1650 gena.cgi SUBSCRIBE Command Injection Vulnerability

A command injection vulnerability exists in the gena.cgi module of D-Link DAP-1650 devices. An unauthenticated attacker can exploit this vulnerability to gain command execution on the device as root...

UBUNTU-CVE-2023-52076

Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A path traversal and arbitrary file write vulnerability exists in versions of Atril prior to 1.26.2. This vulnerability is capable of writing arbitrary files anywhere on the filesystem to which the use...

Remote code execution

A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious HTTP request, leading to a completely controlled out-of-bounds write primitive and complete...

PT-2024-19980 · Motorola · Motorola Mr2600

Name of the Vulnerable Software and Affected Versions: Motorola MR2600 affected versions not specified Description: A command injection vulnerability exists in the SaveStaticRouteIPv4Params parameter. A remote attacker can exploit this vulnerability to achieve command execution. Authentication is...

PT-2024-19979 · Motorola · Motorola Mr2600

Name of the Vulnerable Software and Affected Versions: Motorola MR2600 affected versions not specified Description: A command injection vulnerability exists in the SaveSysLogParams parameter of the Motorola MR2600. A remote attacker can exploit this issue to achieve command execution...

PT-2024-19981 · Motorola · Motorola Mr2600

Name of the Vulnerable Software and Affected Versions: Motorola MR2600 affected versions not specified Description: A command injection vulnerability exists in the SaveStaticRouteIPv6Params parameter. A remote attacker can exploit this vulnerability to achieve command execution. Authentication is...

PT-2024-19971 · Symantec · Symantec Server Management Suite

Name of the Vulnerable Software and Affected Versions: Symantec Server Management Suite versions prior to 7.9 Description: A buffer overflow vulnerability exists, allowing a remote, anonymous attacker to achieve remote code execution as SYSTEM. Recommendations: For Symantec Server Management Suit...