CVE-2023-51707

CVE-2023-51707 affects MotionPro in Array ArrayOS AG prior to 9.4.0.505, where remote command execution is possible via specially crafted packets. Affected: AG and vxAG before 9.4.0.505; unaffected: AG/vxAG 9.3.0.259.x. Impact is remote code execution with network attack vector and no user intera...

CVE-2023-51707

MotionPro in Array ArrayOS AG before 9.4.0.505 on AG and vxAG allows remote command execution via crafted packets. AG and vxAG 9.3.0.259.x are unaffected...

D-Link DIR-850L Router Command Injection

The vulnerability of D-Link DIR-850L B1 router microprogramming software is related to the lack of measures taken to neutralize special elements used in the operating system’s command processing when dealing with the en parameter. Exploiting this vulnerability allows a remote attacker to execute...

Netgear N300 wireless router software soapauth() Arbitrary Command Execution

The vulnerability of the soapauth function in Netgear N300 wireless router microprogramming software WNR2000v4 is related to the lack of data cleaning measures at the management level. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands by sending specially crafte...

EasyLog Web+ BRS-5003 Code Generation Command Execution

The vulnerability of the microprogrammed software of the multi-channel voice recorder EasyLog Web+ BRS-5003 and EasyLog Web+ BRS-800 is related to incorrect code generation control. Exploiting this vulnerability could allow an attacker operating remotely to execute arbitrary commands...

Stormshield Network Security Security Vulnerabilities

Stormshield Network Security is a next-generation UTM Unified Threat Management firewall from the French company Stormshield. A security vulnerability exists in Stormshield Network Security that originates from a remote access command that can be used to learn if a specific user account exists on...

DisconnectVPN Function Arbitrary Command Execution

The vulnerability of the DisconnectVPN function in the TOTOLINK X18 router microprogramming system is related to insufficient checking of arguments passed in commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely using the pid parameter...

SCALANCE M-800/S615 Command Injection

The vulnerability of the SCALANCE M-800/S615 family of industrial switches lies in insufficient verification of the arguments passed in the commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

Nagios XI Arbitrary Command Execution

The vulnerability of the Nagios XI monitoring tool is related to the lack of measures taken to protect the structure of the web page during the processing of input fields $ARG1$ and $ARG2$. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

CVE-2023-4724 WP All Export (Free < 1.4.0, Pro < 1.8.6) - Admin+ RCE

The Export any WordPress data to XML/CSV WordPress plugin before 1.4.0, WP All Export Pro WordPress plugin before 1.8.6 does not validate and sanitise the wpquery parameter which allows an attacker to run arbitrary command on the remote server...

Command injection

A vulnerability was found in kalcaddle kodbox up to 1.48. It has been declared as critical. Affected by this vulnerability is the function check of the file plugins/officeViewer/controller/libreOffice/index.class.php. The manipulation of the argument soffice leads to command injection. The attack...

CVE-2023-6848

The CVE-2023-6848 issue affects kalcaddle kodbox up to 1.48. The vulnerable component is plugins/officeViewer/controller/libreOffice/index.class.php (check function). Manipulating the soffice argument leads to remote command injection. Exploitation has been disclosed publicly. A fix is available ...

PT-2023-32789 · Kodbox · Kodbox

Name of the Vulnerable Software and Affected Versions: kalcaddle kodbox versions up to 1.48 Description: A critical issue has been found, affecting the function check of the file plugins/officeViewer/controller/libreOffice/index.class.php. The manipulation of the soffice argument leads to command...

Apache StreamPark: Authenticated system users could trigger remote command execution

In streampark, there is a project module that integrates Maven's compilation capability. However, there is no check on the compilation parameters of Maven. allowing attackers to insert commands for remote command execution, The prerequisite for a successful attack is that the user needs to log in...

GHSA-QG44-XQWJ-WC28 Apache StreamPark: Authenticated system users could trigger remote command execution

In streampark, there is a project module that integrates Maven's compilation capability. However, there is no check on the compilation parameters of Maven. allowing attackers to insert commands for remote command execution, The prerequisite for a successful attack is that the user needs to log in...

CVE-2023-49898

In streampark, there is a project module that integrates Maven's compilation capability. However, there is no check on the compilation parameters of Maven. allowing attackers to insert commands for remote command execution, The prerequisite for a successful attack is that the user needs to log in...

Input validation

In streampark, there is a project module that integrates Maven's compilation capability. However, there is no check on the compilation parameters of Maven. allowing attackers to insert commands for remote command execution, The prerequisite for a successful attack is that the user needs to log in...

CVE-2023-49898

CVE-2023-49898 concerns Apache StreamPark: a project module that integrates Maven compilation lacks validation of Maven parameters, allowing remote command execution. The advisory notes that an attacker must be an authenticated system user with high privileges, limiting exposure, and that the ove...

CVE-2023-49898 Apache StreamPark (incubating): Authenticated system users could trigger remote command execution

In streampark, there is a project module that integrates Maven's compilation capability. However, there is no check on the compilation parameters of Maven. allowing attackers to insert commands for remote command execution, The prerequisite for a successful attack is that the user needs to log in...

CVE-2023-49898 Apache StreamPark (incubating): Authenticated system users could trigger remote command execution

In streampark, there is a project module that integrates Maven's compilation capability. However, there is no check on the compilation parameters of Maven. allowing attackers to insert commands for remote command execution, The prerequisite for a successful attack is that the user needs to log in...