PT-2024-3191 · D Link · D-Link Dir-822

Name of the Vulnerable Software and Affected Versions: D-Link DIR-822+ version 1.0.5 Description: The issue is related to a command injection in the SetPlcNetworkpwd function of the prog.cgi script, which allows remote attackers to execute arbitrary commands via shell. This is due to the lack of...

The vulnerability of the WDAC OLE DB driver for SQL Server on the Windows operating system allows a hacker to execute arbitrary code.

The vulnerability of the WDAC OLE DB driver for SQL Server on the Windows operating system is related to buffer overflow in the queue. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2024-28717

An issue in OpenStack Storlets yoga-eom allows a remote attacker to execute arbitrary code via the gateway.py component...

PT-2024-3890

Name of the Vulnerable Software and Affected Versions: SOPlanning Simple Online Planning versions affected versions not specified Description: The issue is related to a lack of protection against SQL query structure exploitation in the projets.php script of the SOPlanning CMS system. This could...

The vulnerability of the MessagePack NodeJS/JavaScript msgpackr implementation allows a hacker to cause a service failure.

The vulnerability of the MessagePack NodeJS/JavaScript msgpackr implementation lies in the ability for users to execute suspended threads, creating messages that lock the decoder. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

CVE-2024-27976

A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM...

CVE-2024-27976

CVE-2024-27976 describes a path traversal vulnerability in the Ivanti Avalanche web component prior to version 6.4.3 . An authenticated remote attacker can abuse the vulnerable web component to execute arbitrary commands as the SYSTEM user. The issue is addressed by upgrading to Ivanti Avalanche ...

CVE-2024-23534

CVE-2024-23534 affects Ivanti Avalanche prior to 6.4.3. The vulnerability is an Unrestricted File-upload in the web component, tied to the getMasterAdhocCollectionsPath method, enabling a remote authenticated attacker to execute arbitrary commands as SYSTEM. Connected sources confirm the issue re...

CVE-2024-24992

Ivanti Avalanche pre-6.4.3 has a Path Traversal in the web component that allows an authenticated remote attacker to execute arbitrary commands as SYSTEM. Root cause stated in connected sources as improper validation of a user-supplied path (notably via getAdhocFilePath) leading to traversal into...

CVE-2024-27976

A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM...

CVE-2024-24993

A Race Condition TOCTOU vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM...

WordPress Background Image Cropper 1.2 Shell Upload

Exploit Title: Wordpress Plugin Background Image Cropper v1.2 - Remote Code Execution Date: 2024-04-16 Author: Milad Karimi Ex3ptionaL Contact: [email protected] Zone-H: www.zone-h.org/archive/notifier=Ex3ptionaL Vendor Homepage: https://wordpress.org Software Link:...

The vulnerability in the Avalanche mobile device management web component allows a hacker to execute arbitrary commands with SYSTEM privileges.

The vulnerability of the Avalanche mobile device management web component is related to an incorrect restriction on the path name to the restricted catalog. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands with SYSTEM privileges remotely...

The vulnerability of the WordPress website content management system, related to the unlimited download of dangerous files, allows a hacker to execute arbitrary commands.

The vulnerability of the WordPress website content management system is related to the unlimited loading of dangerous files. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

CVE-2024-22905

The CVE-2024-22905 entry concerns a Buffer Overflow in ARM mbed-os v6.17.0 that allows a remote attacker to execute arbitrary code by sending a crafted script to the hciTrSerialRxIncoming function. Affected product: ARM mbed-os 6.17.0; vulnerability type: buffer overflow in the HCI transport path...

CVE-2023-5403

Server hostname translation to IP address manipulation which could lead to an attacker performing remote code execution or causing a failure. See Honeywell Security Notification for recommendations on upgrading and versioning...

CVE-2024-30979

CVE-2024-30979 affects Cyber Cafe Management System 1.0. The XSS flaw is in the compname parameter of edit-computer-details.php, enabling a remote attacker to execute arbitrary code. CVSS v3.1 base score 5.9 (MEDIUM); attack vector: network, confidentiality/integrity/availability impact: LOW. Exp...

The vulnerability affects the runtime of procedure calls in Microsoft Windows operating systems, allowing an attacker to execute arbitrary code.

The vulnerability of remote procedure call runtime in Microsoft Windows operating systems is related to access to resources through incompatible types. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

CVE-2024-3788

WBSAirback 21.02.04 is affected by an improper neutralization of Server-Side Includes (SSI) via the License endpoint (/admin/CDPUsers). A remote attacker could execute arbitrary code. The PT-Security advisory for PT-2024-27806 confirms the endpoint-based SSI handling issue and notes that, as of t...

CVE-2024-3787 Improper Neutralization of Server-Side Includes (SSI) vulnerability in WBSAirback

Vulnerability in WBSAirback 21.02.04, which involves improper neutralisation of Server-Side Includes SSI, through S3 disks /admin/DeviceS3. Exploitation of this vulnerability could allow a remote user to execute arbitrary code...