15847 matches found
CVE-2021-4406
An authenticated attacker is able to create alerts that trigger a stored XSS attack. POC go to the alert manager open the ITSM tab add a webhook with the URL/service token value ' -h && id | tee /tmp/ttttttddddssss ' whitespaces are tab characters click add click apply create a test alert The tes...
Design/Logic Flaw
An administrator is able to execute commands as root via the alerts management dialog...
CVE-2021-4406
CVE-2021-4406 affects OSNEXUS QuantaStor. Reports in multiple connected documents (including CVE lists and vendor CSAs) describe an authenticated attacker who can create alerts in the alerts management dialog that trigger a stored XSS, with the test alert running a command as root via a webhook/U...
CVE-2021-4406: Improper Neutralization of Special Elements used in a Command
An authenticated attacker is able to create alerts that trigger a stored XSS attack. POC go to the alert manager open the ITSM tab add a webhook with the URL/service token value ' -h && id | tee /tmp/ttttttddddssss ' whitespaces are tab characters click add click apply create a test alert The tes...
PT-2023-12518
Name of the Vulnerable Software and Affected Versions No specific software or versions mentioned. Description An issue allows an administrator to execute commands as root via the alerts management dialog. Recommendations At the moment, there is no information about a newer version that contains a...
OSNEXUS QuantaStor 命令注入漏洞
OSNEXUS QuantaStor is a unified software-defined storage platform from OSNEXUS Corporation. A command injection vulnerability exists in OSNEXUS QuantaStor versions prior to 6.0.0.355. An attacker can exploit this vulnerability to execute commands as root...
PT-2023-8147 · D Link · D-Link G416
Name of the Vulnerable Software and Affected Versions: D-Link G416 affected versions not specified Description: The issue is related to a command injection vulnerability in the HTTP service of D-Link G416 routers, which allows network-adjacent attackers to execute arbitrary code on affected...
PT-2023-8215 · D Link · D-Link G416
Name of the Vulnerable Software and Affected Versions: D-Link G416 affected versions not specified Description: This issue allows network-adjacent attackers to disclose sensitive information on affected installations of D-Link G416 routers. The specific flaw exists within the HTTP service listeni...
PT-2023-8217 · D Link · D-Link G416
Name of the Vulnerable Software and Affected Versions: D-Link G416 affected versions not specified Description: This issue allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link G416 routers. The specific flaw exists within the HTTP service listening on TC...
Cisco BroadWorks 安全漏洞
Cisco BroadWorks is a carrier-grade unified communications software platform from Cisco. It is used to deploy cloud calls from public network platforms on any type of wired or wireless network architecture. A security vulnerability exists in Cisco BroadWorks that stems from insufficient input...
PT-2023-8305 · D Link · D-Link Dir-X3260
Name of the Vulnerable Software and Affected Versions: D-Link DIR-X3260 affected versions not specified Description: This issue allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-X3260 routers. Authentication is required to exploit this issue. The...
ROS-2-1165
2.1165 Vulnerability in sudo CVE-2021-3156 1. Vulnerability Description: The vulnerability allows root access without authentication and without having the necessary credentials. The issue can be exploited by any user, regardless of their presence in system groups or the presence of an entry in...
CVE-2023-27197
PAX A930 device with PayDroid7.1.1VirgoV04.5.0220220722 can allow an attacker to gain root access by running a crafted binary leveraging an exported function from a shared library. The attacker must have shell access to the device in order to exploit this vulnerability...
CVE-2023-27197
PAX A930 device with PayDroid7.1.1VirgoV04.5.0220220722 can allow an attacker to gain root access by running a crafted binary leveraging an exported function from a shared library. The attacker must have shell access to the device in order to exploit this vulnerability...
CVE-2023-27197
PAX A930 device with PayDroid7.1.1VirgoV04.5.0220220722 can allow an attacker to gain root access by running a crafted binary leveraging an exported function from a shared library. The attacker must have shell access to the device in order to exploit this vulnerability...
Design/Logic Flaw
PAX A930 device with PayDroid7.1.1VirgoV04.5.0220220722 can allow an attacker to gain root access by running a crafted binary leveraging an exported function from a shared library. The attacker must have shell access to the device in order to exploit this vulnerability...
CVE-2023-27197
PAX A930 device with PayDroid7.1.1VirgoV04.5.0220220722 can allow an attacker to gain root access by running a crafted binary leveraging an exported function from a shared library. The attacker must have shell access to the device in order to exploit this vulnerability...
PAX Technology A930 安全漏洞
The PAX Technology A930 is an Android mobile payment terminal from China-based PAX Technology. A security vulnerability exists in the PAX Technology A930 PayDroid7.1.1VirgoV04.5.0220220722 version, which originated from a vulnerability that allows an attacker to gain root access by running a...
PT-2023-3997 · Cisco · Cisco Broadworks
Name of the Vulnerable Software and Affected Versions: Cisco BroadWorks affected versions not specified Description: The issue exists due to insufficient input validation by the operating system CLI, allowing an attacker to elevate privileges to the root user on an affected device. An attacker...
PT-2023-20998 · Pax · Pax A930 +1
Name of the Vulnerable Software and Affected Versions: PAX A930 device with PayDroid version 7.1.1 Virgo V04.5.02 20220722 Description: The issue allows an attacker to gain root access by running a crafted binary leveraging an exported function from a shared library. The attacker must have shell...