Barracuda Email Security Gateway command injection vulnerability

Barracuda Email Security Gateway is an email security gateway from Barracuda that manages and filters all inbound and outbound email traffic to protect organizations from email threats and data breaches. A security vulnerability exists in Barracuda Email Security Gateway versions 5.1.3.001 throug...

CVE-2023-33246: Improper Control of Generation of Code

For RocketMQ versions 5.1.0 and below, under certain conditions, there is a risk of remote command execution. Several components of RocketMQ, including NameServer, Broker, and Controller, are leaked on the extranet and lack permission verification, an attacker can exploit this vulnerability by...

CVE-2023-33246

For RocketMQ versions 5.1.0 and below, under certain conditions, there is a risk of remote command execution. Several components of RocketMQ, including NameServer, Broker, and Controller, are leaked on the extranet and lack permission verification, an attacker can exploit this vulnerability by...

Exploit for Use of Hard-coded Credentials in Freeswitch

FreeSWITCH Exploit CVE-2019-19492 This is an exploit script...

PT-2023-5402 · Apache · Apache Rocketmq

Name of the Vulnerable Software and Affected Versions: Apache RocketMQ versions 5.1.0 and below Apache RocketMQ versions prior to 4.9.6 Description: The vulnerability is related to a permission verification issue in Apache RocketMQ, allowing attackers to perform remote command execution under...

PT-2023-2983 · D Link · D-Link Dir-846

Name of the Vulnerable Software and Affected Versions: D-Link DIR-846 version 1.00A52 Description: The issue is related to the implementation of the HNAP1 protocol in the D-Link DIR-846 router's firmware, specifically concerning the handling of the tomography ping address parameter. This can be...

Cisco DNA Center Command Execution

The vulnerability of the application programming interface of the Cisco DNA Center relates to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor, operating remotely, to execute arbitrary commands with root privileges using a specially created API...

VulnCheck KEV: CVE-2023-2868

Barracuda Email Security Gateway ESG appliance contains an improper input validation vulnerability of a user-supplied .tar file, leading to remote command injection...

PT-2023-2840

Name of the Vulnerable Software and Affected Versions cups-filters affected versions not specified Description The issue is related to the Backend Error Handler beh component of the cups-filters package, which does not properly sanitize special elements used in operating system commands. This can...

D-Link Administrator Console Command Execution

The vulnerability of the administrator consoles of microprogrammed software for D-Link DCH-M225 wireless signal amplifiers is related to the lack of measures taken to neutralize special elements used in the operating system’s command processing when handling the “media renderer” parameter in the...

D-Link wireless signal amplifiers Command Execution

The vulnerability in the spotifyConnect.php microprogramming of D-Link DCH-M225 wireless signal amplifiers is related to the failure to eliminate special elements used in the operating system’s processing of the parameter userName. Exploiting this vulnerability allows a remote attacker to execute...

D-Link DIR-822 Router Arbitrary Command Execution

The vulnerability of the SetQoSSettings.php script in D-Link DIR-822 router microprogramming software is related to insufficient checking of regular expressions during the processing of the uplink parameter. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

CVE-2023-30501

Vulnerabilities exist in the Aruba EdgeConnect Enterprise command line interface that allow remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as root on the...

PT-2023-8735 · Aruba · Aruba Edgeconnect Enterprise

Name of the Vulnerable Software and Affected Versions: Aruba EdgeConnect Enterprise affected versions not specified Description: The issue exists due to the lack of neutralization of special elements used in the operating system command. This allows remote authenticated users to run arbitrary...

PT-2023-8296 · Aruba · Aruba Edgeconnect Enterprise

Name of the Vulnerable Software and Affected Versions: Aruba EdgeConnect Enterprise affected versions not specified Description: The issue exists due to the lack of neutralization of special elements used in the operating system command. This allows a remote attacker to execute arbitrary commands...

Lack of security consideration leads to multiple critical weaknesses

Introduction This report serves more as a suggestion to improve security, rather than fixing any single "vulnerability". I've given examples to demonstrate the impact that neglecting security may have, but these are not the root cause of the issue. Due to the nature of a package, being able to...

PT-2023-2994 · Vmware · Vmware Aria Operations

Name of the Vulnerable Software and Affected Versions: VMware Aria Operations affected versions not specified Description: The issue is related to a deserialization vulnerability in VMware Aria Operations. A malicious actor with administrative privileges can exploit this vulnerability to execute...

FileZen Web Administration Command Execution

The vulnerability in the FileZen file-sharing server’s administrative web interface relates to the failure to take measures to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

CVE-2023-22790 Authenticated Remote Command Execution in Aruba InstantOS or ArubaOS 10 Command Line Interface

Multiple authenticated command injection vulnerabilities exist in the Aruba InstantOS and ArubaOS 10 command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system...

CVE-2023-22790 Authenticated Remote Command Execution in Aruba InstantOS or ArubaOS 10 Command Line Interface

Multiple authenticated command injection vulnerabilities exist in the Aruba InstantOS and ArubaOS 10 command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system...