Security Updates for Microsoft Visio Products (February 2024)

The Microsoft Visio Products are missing a security update. They are, therefore, affected by a remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands. Note that Nessus has not tested for this issue but has instead...

TP-Link ER7206 Omada Gigabit VPN Router uhttpd web group command injection vulnerability

Talos Vulnerability Report TALOS-2023-1858 TP-Link ER7206 Omada Gigabit VPN Router uhttpd web group command injection vulnerability February 6, 2024 CVE Number CVE-2023-47617 SUMMARY A post authentication command injection vulnerability exists when configuring the web group member of Tp-Link ER72...

CVE-2023-46892

The radio frequency communication protocol being used by Meross MSH30Q 4.5.23 is vulnerable to replay attacks, allowing attackers to record and replay previously captured communication to execute unauthorized commands or actions e.g., thermostat's temperature...

CVE-2023-46892

The radio frequency communication protocol being used by Meross MSH30Q 4.5.23 is vulnerable to replay attacks, allowing attackers to record and replay previously captured communication to execute unauthorized commands or actions e.g., thermostat's temperature...

Design/Logic Flaw

The radio frequency communication protocol being used by Meross MSH30Q 4.5.23 is vulnerable to replay attacks, allowing attackers to record and replay previously captured communication to execute unauthorized commands or actions e.g., thermostat's temperature...

PT-2024-13387 · Meross · Meross Msh30Q

Name of the Vulnerable Software and Affected Versions: Meross MSH30Q version 4.5.23 Description: The radio frequency communication protocol used by the device is susceptible to replay attacks. This allows attackers to record and replay previously captured communication, enabling them to execute...

CVE-2023-46892

The radio frequency communication protocol being used by Meross MSH30Q 4.5.23 is vulnerable to replay attacks, allowing attackers to record and replay previously captured communication to execute unauthorized commands or actions e.g., thermostat's temperature...

CVE-2023-46892

CVE-2023-46892 concerns the Meross MSH30Q (version 4.5.23) RF communication protocol. The issue is a replay attack vulnerability that allows recording and replay of previously captured RF commands to trigger unauthorized actions (e.g., thermostat temperature). Affected component is the device’s R...

CVE-2023-46892

The radio frequency communication protocol being used by Meross MSH30Q 4.5.23 is vulnerable to replay attacks, allowing attackers to record and replay previously captured communication to execute unauthorized commands or actions e.g., thermostat's temperature...

TOTOLINK EX1800T 安全漏洞

TOTOLINK EX1800T is a Wi-Fi range extender from China's TOTOLINK, which supports Wi-Fi 6 technology and enhances signal coverage by connecting wirelessly to a router, making it suitable for home and small office environments. The TOTOLINK EX1800T suffers from a command execution vulnerability tha...

Fortinet FortiPortal Command Injection Vulnerability

Fortinet FortiPortal is an advanced, feature-rich hosted security analysis and management support tool for Fortinet's FortiGate, FortiWiFi and FortiAP product lines, available as a virtual machine for MSPs. A command injection vulnerability exists in Fortinet FortiPortal, which can be exploited b...

OS Command Injection

tts-api is vulnerable to OS Command Injection. The vulnerability is due to a lack of validation in the onSpeechDone function within app.js. This could allow an attacker to gain unauthorized access by executing unauthorized commands...

Command injection

An improper neutralization of special elements used in an OS command vulnerability CWE-78 in the command line interpreter of FortiTester 2.3.0 through 7.2.3 may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments when running execute restore/backup...

Command injection

An improper neutralization of special elements used in a command 'Command Injection' vulnerability CWE-77 in FortiPortal version 7.2.0, version 7.0.6 and below may allow a remote authenticated attacker with at least R/W permission to execute unauthorized commands via specifically crafted argument...

CVE-2023-48791

An improper neutralization of special elements used in a command 'Command Injection' vulnerability CWE-77 in FortiPortal version 7.2.0, version 7.0.6 and below may allow a remote authenticated attacker with at least R/W permission to execute unauthorized commands via specifically crafted argument...

Security Updates for Microsoft Excel Products (November 2023)

The Microsoft Excel Products are missing security updates. It is, therefore, affected by multiple vulnerabilities: - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands. CVE-2023-36041 - A security feature bypass...

CVE-2023-20048

A vulnerability in the web services interface of Cisco Firepower Management Center FMC Software could allow an authenticated, remote attacker to execute certain unauthorized configuration commands on a Firepower Threat Defense FTD device that is managed by the FMC Software. This vulnerability is...

Authorization

A vulnerability in the web services interface of Cisco Firepower Management Center FMC Software could allow an authenticated, remote attacker to execute certain unauthorized configuration commands on a Firepower Threat Defense FTD device that is managed by the FMC Software. This vulnerability is...

Cisco Firepower Management Center Security Vulnerability

Cisco Firepower Management Center FMC is the next-generation firewall management center software from Cisco. A security vulnerability exists in Cisco Firepower Management Center, which stems from insufficient authorization of configuration commands sent through the Web services interface, and can...

PT-2023-6705 · Cisco · Cisco Firepower Management Center +1

Name of the Vulnerable Software and Affected Versions: Cisco Firepower Management Center FMC Software affected versions not specified Description: A vulnerability in the web services interface of Cisco Firepower Management Center FMC Software could allow an authenticated, remote attacker to execu...