225 matches found
Command injection
Atos Unify OpenScape 4000 Assistant V10 R1 before V10 R1.42.0 and V10 R1.34.8 and Manager V10 R1 before V10 R1.42.0 and V10 R1.34.8 allow command injection by authenticated users, aka OSFOURK-23554...
CVE-2023-35033
CVE-2023-35033 affects Atos Unify OpenScape 4000: specifically Assistant V10 R1 before R1.42.0 and R1.34.8, Assistant V10 R0, Manager V10 R1 before R1.42.0 and R1.34.8, and Manager V10 R0. The description indicates a command injection vulnerability that can be exploited by authenticated users. Th...
CVE-2023-35034
The CVE-2023-35034 entry affects Atos Unify OpenScape 4000 Assistant and Manager. Vulnerable components are OpenScape 4000 Assistant (versions prior to V10 R1.42.0 and prior to V10 R1.34.8) and OpenScape 4000 Manager (same version ranges). The issue enables remote code execution by unauthenticate...
CVE-2023-35031
CVE-2023-35031 affects Atos Unify OpenScape 4000 components: Assistant and Manager in V10 R0 or V10 R1 with prior builds to V10 R1.42.0/V10 R1.34.8. The issue allows command injection by authenticated users, per the CVE entry. CVSS v3.1 base score 8.8 (HIGH); attack vector NETWORK; require LOW pr...
TP-Link wireless router 命令注入漏洞
The TP-LINK TL-WR940N is a wireless router from China P&L TP-LINK. A security vulnerability exists in the TP-Link wireless router, which stems from a discovery via the /userRpm/WlanNetworkRpm component that contains a command injection vulnerability. Affected products and versions: TP-Link...
CVE-2023-33538
The CVE-2023-33538 issue affects TP-Link TL-WR940N (V2/V4), TL-WR841N (V8/V10), and TL-WR740N (V1/V2) routers. Root cause: command injection in the WlanNetworkRpm.htm endpoint under /userRpm/WlanNetworkRpm, exploitably via the ssid1 parameter; authenticated access is required for exploitation (pe...
CVE-2023-28522
IBM API Connect V10 could allow an authenticated user to perform actions that they should not have access to. IBM X-Force ID: 250585...
CVE-2023-28522
CVE-2023-28522 affects IBM API Connect V10 and is an improper access control vulnerability that could allow an authenticated user to perform actions they should not have access to. The IBM Security Bulletin (and related entries) confirm the issue in API Connect V10.x and provide remediation paths...
CVE-2022-37130
In D-Link DIR-816 A2v1.10CNB04, DIR-878 DIR878FW1.30B08.img a command injection vulnerability occurs in /goform/Diagnosis, after the condition is met, setnum will be spliced into v10 by snprintf, and the system will be executed, resulting in a command injection vulnerability...
Buffer overflow
A buffer overflow in the httpd daemon on TP-Link TL-WR841N V12 firmware version 3.16.9 devices allows an authenticated remote attacker to execute arbitrary code via a GET request to the page for the System Tools of the Wi-Fi network. This affects TL-WR841 V12 TL-WR841NEUV12160624 and TL-WR841 V11...
Security Bulletin: API Connect V10 is vulnerable to a remote code execution in Spring Framework (CVE-2022-22965)
Summary IBM API Connect V10 is vulnerable to a remote code execution in Spring Framework CVE-2022-22965 as it meets all of the following criteria: 1. JDK 9 or higher, 2. Apache Tomcat as the Servlet container, 3. Packaged as WAR in contrast to a Spring Boot executable jar, 4. Spring-webmvc or...
Sql injection
The Magic CMS MSVOD v10 video system has a SQL injection vulnerability. Attackers can use vulnerabilities to obtain sensitive information in the database...
CVE-2021-41942
CVE-2021-41942 affects the Magic CMS MSVOD v10 video system. The connected documents consistently describe an SQL injection vulnerability in this product, enabling attackers to obtain sensitive information from the database. The sources do not provide exploitation details, affected subsystems bey...
Siemens PROFINET Stack Integrated on Interniche Stack Uncontrolled Resource Consumption (CVE-2022-25622)
A vulnerability has been identified in SIMATIC CFU DIQ All versions, SIMATIC CFU PA All versions, SIMATIC S7-1500 CPU family incl. related ET200 CPUs and SIPLUS variants All versions V2.0.0, SIMATIC S7-300 CPU family incl. related ET200 CPUs and SIPLUS variants All versions, SIMATIC S7-400 H V6 C...
CVE-2021-43707
Cross Site Scripting XSS vulnerability exists in Maccms v10 via linkName parameter...
Cross site scripting
Cross Site Scripting XSS vulnerability exists in Maccms v10 via linkName parameter...
CVE-2021-43707
Cross Site Scripting XSS vulnerability exists in Maccms v10 via linkName parameter...
CVE-2021-43707
The provided connected documents confirm a Cross Site Scripting (XSS) vulnerability in Maccms v10, exploitable via the link_Name parameter. Affected component: Maccms v10 (CMS). Root cause as stated: input handling for link_Name allows script injection, leading to XSS. The CVE entry summarizes im...