CVE-2023-49898 Apache StreamPark (incubating): Authenticated system users could trigger remote command execution

In streampark, there is a project module that integrates Maven's compilation capability. However, there is no check on the compilation parameters of Maven. allowing attackers to insert commands for remote command execution, The prerequisite for a successful attack is that the user needs to log in...

CVE-2023-48380

Softnext Mail SQR Expert is an email management platform, it has insufficient filtering for a special character within a spcific function. A remote attacker authenticated as a localhost can exploit this vulnerability to perform command injection attacks, to execute arbitrary system command,...

CVE-2023-48376

SmartStar Software CWS is a web-based integration platform, its file uploading function does not restrict upload of file with dangerous type. An unauthenticated remote attacker can exploit this vulnerability to upload arbitrary files to perform arbitrary command or disrupt service...

web2py Command Injection

The vulnerability of the web2py web application development framework exists due to the lack of measures taken to neutralize special elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

IBM DB2 Access Control Command Execution

The vulnerability of the IBM DB2 database management system is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to execute arbitrary commands remotely...

Fortinet FortiWLM Command Injection

The vulnerability of Fortinet FortiWLM, a centralized management system for WLAN access points and LAN switches, exists due to the failure to take measures to neutralize special elements used in the operating system’s commands. Exploiting this vulnerability allows a malicious actor to execute...

SmartStar Software CWS Code Issue Vulnerability

SmartStar Software CWS is a Web-based integration platform from China-based SmartStar Software. A code issue vulnerability exists in SmartStar Software CWS v10.25, which stems from the file upload feature not restricting the upload of dangerous types of files, which can be exploited by remote...

PT-2023-31406 · Apache · Maven

Name of the Vulnerable Software and Affected Versions: streampark versions prior to 2.1.2 Description: The issue is related to the project module in streampark that integrates Maven's compilation capability. There is no check on the compilation parameters of Maven, allowing attackers to insert...

CVE-2023-48663

Dell vApp Manager, versions prior to 9.2.4.x contain a command injection vulnerability. A remote malicious user with high privileges could potentially exploit this vulnerability leading to the execution of arbitrary OS commands on the affected system...

CVE-2023-50011

PopojiCMS version 2.0.1 is vulnerable to remote command execution in the Meta Social field...

CVE-2023-50011

PopojiCMS version 2.0.1 is vulnerable to remote command execution in the Meta Social field...

CVE-2023-50011: Undefined Security Weakness

PopojiCMS version 2.0.1 is vulnerable to remote command execution in the Meta Social field...

PT-2023-31455

Name of the Vulnerable Software and Affected Versions PopojiCMS version 2.0.1 Description The issue concerns remote command execution in the Meta Social field. Recommendations For PopojiCMS version 2.0.1, as a temporary workaround, consider restricting access to the Meta Social field until a patc...

CVE-2023-50011

PopojiCMS version 2.0.1 is vulnerable to remote command execution in the Meta Social field...

ZTE MC801A command injection vulnerability

The ZTE MC801A is a 5g indoor WiFi router from China's ZTE ZTE. The ZTE MC801A suffers from an input validation vulnerability in the handling of multiple network parameters, which can be exploited by a remote attacker to submit a special request that can be used in the application context to...

TOTOLINK X6000R Sub Function Code Execution

The vulnerability of the sub4119A0 function shttpd in the TOTOLINK X6000R router microprogramming system exists due to the lack of measures to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

TOTOLINK X6000R Sub Function Code Execution

The vulnerability of the sub4119A0 function shttpd in the TOTOLINK X6000R router microprogramming system exists due to the lack of measures to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

TOTOLINK X6000R Sub Function Code Execution

The vulnerability of the sub4119A0 function shttpd in the TOTOLINK X6000R router microprogramming system exists due to the lack of measures to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

FXC AE1021 Command Injection

The vulnerability of the microprogrammed routing devices FXC AE1021 and FXC AE1021PE lies in the lack of measures to neutralize the special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

ASMB8 iKVM SNMPv2 Command Execution

The vulnerability of the SNMPv2 protocol implementation in ASUS’ ASMB8 iKVM remote control device is related to the lack of measures taken to neutralize specific elements. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...