18749 matches found
CVE-2021-40344
CVE-2021-40344 affects Nagios XI 5.8.5. In the Admin panel’s Custom Includes, an administrator can upload files with arbitrary extensions if the MIME type matches an image, enabling a crafted PHP script upload and remote code execution. The root cause is inadequate validation of uploaded content/...
CVE-2021-20837
Movable Type 7 r.5002 and earlier Movable Type 7 Series, Movable Type 6.8.2 and earlier Movable Type 6 Series, Movable Type Advanced 7 r.5002 and earlier Movable Type Advanced 7 Series, Movable Type Advanced 6.8.2 and earlier Movable Type Advanced 6 Series, Movable Type Premium 1.46 and earlier,...
PT-2021-23635
Ни дня без ransomware: клиентов BQE Software вдоль и поперек шифруют вымогатели, эксплуатирующие критическую ошибку SQL-инъекции в биллинговом решений BillQuick Web Suite. Потенциальных жертв - 400 000 пользователей по всему миру. В массе своей атаки вымогателей нацелены на непропатченные сервера...
Nagios XI code-related vulnerabilities
Nagios XI is a suite of IT infrastructure monitoring solutions from the US-based Nagios. The solution supports monitoring and alerting of applications, services, operating systems, and more. A security vulnerability exists in Nagios XI version 5.8.5, which stems from the software's lack of...
PT-2021-23637
Ни дня без ransomware: клиентов BQE Software вдоль и поперек шифруют вымогатели, эксплуатирующие критическую ошибку SQL-инъекции в биллинговом решений BillQuick Web Suite. Потенциальных жертв - 400 000 пользователей по всему миру. В массе своей атаки вымогателей нацелены на непропатченные сервера...
CVE-2021-26607: Improper Input Validation
An Improper input validation in execDefaultBrowser method of NEXACRO17 allows a remote attacker to execute arbitrary command on affected systems...
PT-2021-22865
Name of the Vulnerable Software and Affected Versions Nagios XI version 5.8.5 Description An issue was discovered in the Custom Includes section of the Admin panel, where an administrator can upload files with arbitrary extensions as long as the MIME type corresponds to an image. This allows the...
CVE-2021-40344: Unrestricted Upload of File with Dangerous Type
An issue was discovered in Nagios XI 5.8.5. In the Custom Includes section of the Admin panel, an administrator can upload files with arbitrary extensions as long as the MIME type corresponds to an image. Therefore it is possible to upload a crafted PHP script to achieve remote command execution...
Restund Server Command Execution
The vulnerability of the Restund server is related to the exposure of resources to an erroneous area. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands by setting the XOR-PEER-ADDRESS parameter to 127.0.0.1:restundudpstatusport...
CVE-2021-34362: Improper Neutralization of Special Elements used in an OS Command
A command injection vulnerability has been reported to affect QNAP device running Media Streaming add-on. If exploited, this vulnerability allow remote attackers to run arbitrary commands. We have already fixed this vulnerability in the following versions of Media Streaming add-on: QTS 5.0.0: Med...
CVE-2021-34362
A command injection vulnerability has been reported to affect QNAP device running Media Streaming add-on. If exploited, this vulnerability allow remote attackers to run arbitrary commands. We have already fixed this vulnerability in the following versions of Media Streaming add-on: QTS 5.0.0: Med...
CVE-2021-38470
InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 are vulnerable to an attacker using a ping tool to inject commands into the device. This may allow the attacker to remotely run commands on behalf of the device...
Command injection
InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 are vulnerable to an attacker using a ping tool to inject commands into the device. This may allow the attacker to remotely run commands on behalf of the device...
PT-2021-22144
Name of the Vulnerable Software and Affected Versions InHand Networks IR615 Router versions 2.3.0.r4724 through 2.3.0.r4870 Description The issue allows an attacker to inject commands into the device using a ping tool, potentially enabling the attacker to remotely run commands on behalf of the...
Node.js Multiple Vulnerabilities (August 2021 Security Releases)
The version of Node.js installed on the remote host is prior to 12.22.5 or 14.17.5 or 16.6.2. It is, therefore, affected by multiple vulnerabilities including the following: - A remote command execution vulnerability exists in Node.js due to insufficient validation of untypical characters in doma...
PT-2021-22152
Name of the Vulnerable Software and Affected Versions InHand Networks IR615 Router versions 2.3.0.r4724 through 2.3.0.r4870 Description The issue allows an attacker to use a traceroute tool to inject commands into the device, potentially enabling remote command execution on behalf of the device...
CVE-2021-38478: Improper Neutralization of Special Elements used in an OS Command
InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 are vulnerable to an attacker using a traceroute tool to inject commands into the device. This may allow the attacker to remotely run commands on behalf of the device...
CVE-2021-38470: Improper Neutralization of Special Elements used in an OS Command
InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 are vulnerable to an attacker using a ping tool to inject commands into the device. This may allow the attacker to remotely run commands on behalf of the device...
128 Technology Session Smart Router vulnerable to authentication bypass
Overview 128 Technology Session Smart Router provided by 128 Technology contains an authentication bypass vulnerability CWE-287. Genta Kataoka of IERAE SECURITY INC. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership...
Backdoor.Win32.LanFiltrator.11.b Code Execution
Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/9f87546e667e5af59a8580ddf7fd43c7.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.LanFiltrator.11.b Vulnerability: Unauthenticated Remote Command Execution Description...