CVE-2023-1097

Baicells EG7035-M11 devices with firmware through BCE-ODU-1.0.8 are vulnerable to improper code exploitation via HTTP GET command injections. Commands are executed using pre-login execution and executed with root permissions. The following methods have been tested and validated by a 3rd party...

CVE-2023-1097 Unauthenticated Command Injection EG7035-M11 Series

Baicells EG7035-M11 devices with firmware through BCE-ODU-1.0.8 are vulnerable to improper code exploitation via HTTP GET command injections. Commands are executed using pre-login execution and executed with root permissions. The following methods have been tested and validated by a 3rd party...

CVE-2023-20009

A vulnerability in the Web UI and administrative CLI of the Cisco Secure Email Gateway ESA and Cisco Secure Email and Web Manager SMA could allow an authenticated remote attacker and or authenticated local attacker to escalate their privilege level and gain root access. The attacker has to have a...

CVE-2023-20009

A vulnerability in the Web UI and administrative CLI of the Cisco Secure Email Gateway ESA and Cisco Secure Email and Web Manager SMA could allow an authenticated remote attacker and or authenticated local attacker to escalate their privilege level and gain root access. The attacker has to have a...

Privilege escalation

A vulnerability in the Web UI and administrative CLI of the Cisco Secure Email Gateway ESA and Cisco Secure Email and Web Manager SMA could allow an authenticated remote attacker and or authenticated local attacker to escalate their privilege level and gain root access. The attacker has to have a...

Cisco Secure Email 代码问题漏洞

Cisco Secure Email is the Cisco Secure Email formerly known as Email Security from Cisco USA provides the best protection for your email from network threats. A security vulnerability exists in Cisco Secure Email Gateway ESA, Cisco Secure Email and Web Manager SMA, which stems from a security iss...

Ceph: ceph-crash.service allows local ceph user to root exploit

A privilege escalation flaw was found in Ceph. Ceph-crash.service allows a local attacker to escalate privileges to root in the form of a crash dump, and dump privileged information. This issue can lead to loss of confidentiality, integrity, and availability...

ForgeRock Access Management 路径遍历漏洞

ForgeRock Access Management is a comprehensive, unified solution from ForgeRock USA designed to quickly enable superior experiences tailored to the unique needs of users and employees. A security vulnerability exists in ForgeRock Access Management Java Policy Agent version 5.10.1 and prior...

ForgeRock Access Management 路径遍历漏洞

ForgeRock Access Management is a comprehensive, unified solution from ForgeRock USA designed to quickly enable a superior experience tailored to the unique needs of users and employees. A security vulnerability exists in ForgeRock Access Management Web Policy Agent version 5.10.1 and prior...

CVE-2023-23520

A race condition was addressed with additional validation. This issue is fixed in watchOS 9.3, tvOS 16.3, macOS Ventura 13.2, iOS 16.3 and iPadOS 16.3. A user may be able to read arbitrary files as root...

CVE-2022-42797

An injection issue was addressed with improved input validation. This issue is fixed in Xcode 14.1. An app may be able to gain root privileges...

ABUS Security Camera TVIP 20000-21150 LFI / Remote Code Execution Vulnerability

ABUS Security Camera version TVIP 20000-21150 suffers from local file inclusion, hardcoded credential, and command injection vulnerabilities. When coupled together, they can be leveraged to achieve remote access as root via ssh...

Apple macOS Ventura 安全漏洞

Apple macOS Ventura is a desktop operating system from Apple Inc. in the United States. A security vulnerability exists in Apple macOS Ventura versions prior to 13.2, iOS versions prior to 16.3, and iPadOS versions prior to 16.3, which stems from the presence of a race condition, and which could ...

ASUS ASMB8 iKVM 1.14.51 SNMP Remote Root Vulnerability

ASUS ASMB8 iKVM firmware versions 1.14.51 and below suffers from a flaw where SNMPv2 can be used with write access to introduce arbitrary extensions to achieve remote code execution as root. The researchers also discovered a hardcoded administrative account...

SuiteCRM 安全漏洞

SuiteCRM is a customer relationship management system from the SuiteCRM team. A security vulnerability exists in SuiteCRM versions prior to 7.12.9. An attacker could exploit the vulnerability to access files and directories stored outside of the web root folder...

CVE-2023-23295

Korenix Jetwave 4200 Series 1.3.0 and JetWave 3000 Series 1.6.0 are vulnerable to Command Injection via /goform/formSysCmd. An attacker an modify the sysCmd parameter in order to execute commands as root...

CVE-2023-23294

Korenix JetWave 4200 Series 1.3.0 and JetWave 3000 Series 1.6.0 are vulnerable to Command Injection. An attacker can modify the filename parameter to execute commands as root...

CVE-2023-23295

Korenix Jetwave 4200 Series 1.3.0 and JetWave 3000 Series 1.6.0 are vulnerable to Command Injection via /goform/formSysCmd. An attacker an modify the sysCmd parameter in order to execute commands as root...

CVE-2023-23295

Korenix Jetwave 4200 Series 1.3.0 and JetWave 3000 Series 1.6.0 are vulnerable to Command Injection via /goform/formSysCmd. An attacker an modify the sysCmd parameter in order to execute commands as root...

PT-2023-18889 · Korenix · Korenix Jetwave 3000 Series +1

Name of the Vulnerable Software and Affected Versions: Korenix JetWave 4200 Series version 1.3.0 Korenix JetWave 3000 Series version 1.6.0 Description: The issue allows an attacker to execute commands as root by modifying the file name parameter, which is vulnerable to Command Injection...