PT-2023-7781 · Siemens · Scalance M826-2 Shdsl-Router +11

Name of the Vulnerable Software and Affected Versions: RUGGEDCOM RM1224 LTE4G EU versions prior to V8.0 RUGGEDCOM RM1224 LTE4G NAM versions prior to V8.0 SCALANCE M804PB versions prior to V8.0 SCALANCE M812-1 ADSL-Router versions prior to V8.0 SCALANCE M816-1 ADSL-Router versions prior to V8.0...

The software for Zoho ManageEngine RecoveryManager Plus is vulnerable because measures taken to eliminate special elements used in the operating system commands have not been implemented. This vulnerability allows attackers to execute arbitrary commands.

The software for Zoho ManageEngine RecoveryManager Plus has vulnerabilities because measures to neutralize specific elements have not been taken. Exploiting these vulnerabilities allows a malicious actor to execute arbitrary commands remotely...

The vulnerability in the web interface of Cisco Firepower Management Center’s software management interface allows a perpetrator to execute arbitrary code.

The vulnerability of the web-based software interface of the Cisco Firepower Management Center exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using specially crafted commands from a remote location...

webkitgtk: Arbitrary Remote Code Execution

A flaw was found in WebKitGTK. Processing malicious web content may lead to remote code execution. This vulnerability is known to be actively exploited in the wild and was included in the CISA's KEV catalog...

Ubuntu 23.04 / 23.10 : LibreOffice vulnerabilities (USN-6546-1)

The remote Ubuntu 23.04 / 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6546-1 advisory. Reginaldo Silva discovered that LibreOffice incorrectly handled filenames when passing embedded videos to GStreamer. If a user were tricked into...

The vulnerability of the command-line interface (CLI) of the Ericsson Evolved Packet Gateway (EPG) allows a attacker to execute arbitrary commands.

The vulnerability of the command-line interface CLI of the Ericsson Evolved Packet Gateway EPG is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to execute arbitrary commands remotely...

GL.iNet Unauthenticated Remote Command Execution via the logread module.

A command injection vulnerability exists in multiple GL.iNet network products, allowing an attacker to inject and execute arbitrary shell commands via JSON parameters at the glsystemlog and glcrashlog interface in the logread module. This exploit requires post-authentication using the Admin-Token...

CVE-2023-47254

An OS Command Injection in the CLI interface on DrayTek Vigor167 version 5.2.2, allows remote attackers to execute arbitrary system commands and escalate privileges via any account created within the web interface...

CVE-2023-48410

In cdParseMsg of cdcodec.c, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2023-48397

CVE-2023-48397: Out-of-bounds read in Init of protocolcalladapter.cpp allows information disclosure with potential for System-level impact. The issue requires no user interaction. Documented in multiple sources (NVD entry and Android Pixel bulletin) with Pixel subcomponent exynos-ril and a CVSS v...

QNAP Systems QVR Operating System Command Injection Vulnerability

The QNAP Systems QVR is a QNAP monitoring system control center from China Weilian Technology QNAP Systems. An operating system command injection vulnerability exists in the QNAP Systems QVR version 4.x. An attacker could exploit this vulnerability to execute commands over the network...

The vulnerability of the Apache Airflow Hive Provider, a network software tool, arises from improper code generation management. This allows an attacker to execute arbitrary code.

The vulnerability of the Apache Airflow Hive Provider network software is related to incorrect code generation management. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Design/Logic Flaw

The configuration functionality in the Intelligent Platform Management Interface IPMI baseboard management controller BMC implementation on Supermicro X11 and M11 based devices, with firmware versions through 3.17.02, allows remote authenticated users to execute arbitrary commands...

Design/Logic Flaw

The web interface in the Intelligent Platform Management Interface IPMI baseboard management controller BMC implementation on Supermicro X11 and M11 based devices, with firmware versions before 3.17.02, allows remote authenticated users to execute arbitrary commands via a crafted request targetin...

USN-6522-2: FreeRDP vulnerabilities

USN-6522-1 fixed several vulnerabilities in FreeRDP. This update provides the corresponding update for Ubuntu 18.04 LTS. Original advisory details: It was discovered that FreeRDP incorrectly handled drive redirection. If a user were tricked into connection to a malicious server, a remote attacker...

CVE-2023-33412

The CVE-2023-33412 issue affects Supermicro X11 and M11-based devices with IPMI BMC. Firmware versions before 3.17.02 expose a vulnerability where remote authenticated users can execute arbitrary commands by sending crafted requests to vulnerable CGI endpoints. Impact is described as high for con...

CVE-2023-33413

The configuration functionality in the Intelligent Platform Management Interface IPMI baseboard management controller BMC implementation on Supermicro X11 and M11 based devices, with firmware versions through 3.17.02, allows remote authenticated users to execute arbitrary commands...

CVE-2023-33412

The web interface in the Intelligent Platform Management Interface IPMI baseboard management controller BMC implementation on Supermicro X11 and M11 based devices, with firmware versions before 3.17.02, allows remote authenticated users to execute arbitrary commands via a crafted request targetin...

Tenda AX9 安全漏洞

Tenda AX9 is a Wi-Fi 6 router from Tenda China. A buffer overflow vulnerability exists in Tenda AX9 version V22.03.01.46, which is caused by the "list" parameter of /goform/SetStaticRouteCfg failing to correctly validate the length of the input data, and can be exploited by a remote attacker to...

Tenda W30E 安全漏洞

The Tenda W30E is a router from the Chinese company Tenda. A buffer overflow vulnerability exists in Tenda W30E version V16.01.0.124843, which originates from a failure of the formDeleteMeshNode function to correctly validate the length of the input data, and can be exploited by a remote attacker...