Archive
10 July 2023
Vulnerabilities first published on this day (UTC), newest first.
10 results · Clear filters · Feed
-
Critical 9.8
A vulnerability has been discovered in the customer-managed ShareFile storage zones controller which, if exploited, cou…
KEV Aug 16, 2023 -
Critical 9.8
Delta Electronics InfraSuite Device Master Deserialization of Untrusted Data
Delta Electronics InfraSuite Device Master versions prior to 1.0.7 contains classes that cannot be deserialized, which could allow an attack to remotely execute arbitrary code.
-
Critical 9.7
XWiki Platform vulnerable to cross-site request forgery (CSRF) via the REST API
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The REST API allows executing all actions via POST requests and accepts `text/plain`, `multipart/form-data` or `application/www-form-urlencoded` as conten…
-
Critical 9.8
Tree connection race condition remote code execution vulnerability
A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the processing of SMB2_TREE_DISCONNECT commands. The issue results from the lack of proper locking when performing operations on an object. …
-
Critical 9.0
Session race condition remote code execution vulnerability
A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the processing of SMB2_SESSION_SETUP commands. The issue results from the lack of proper locking when performing operations on an object. An…
-
Critical 9.1
Authenticated Remote COmmand Execution as root in OSNEXUS QuantaStor version 6.0.0.355 and others
An authenticated attacker is able to create alerts that trigger a stored XSS attack. POC * go to the alert manager * open the ITSM tab * add a webhook with the URL/service token value ' -h && id | tee /tmp/ttttttddddssss #' (whitespaces are tab characters) * …
-
Critical 9.1
Authenticated Remote Command Execution vulnerability in OSNEXUS QuantaStor before 6.0.0.355
An authenticated administrator is allowed to remotely execute arbitrary shell commands via the API. POC http://<IP_ADDRESS>/qstorapi/storageSystemModify?storageSystem=&newName=quantastor&newDescription=;ls${IFS}-al&newLocation=4&newEnclosureLayoutId=5&newDnsS…
-
Critical 9.8
Tenda AC1206 V15.03.06.23, F1202 V1.2.0.20(408), and FH1202 V1.2.0.20(408) were discovered to contain a stack overflow …
-
Critical 9.1
SmartBPM.NET - Use of Hard-Coded Credentials - 2
SmartBPM.NET has a vulnerability of using hard-coded authentication key. An unauthenticated remote attacker can exploit this vulnerability to access system with regular user privilege to read application data, and execute submission and approval processes.
-
Critical 9.8
SmartBPM.NET - Use of Hard-Coded Credentials - 1
SmartSoft SmartBPM.NET has a vulnerability of using hard-coded machine key. An unauthenticated remote attacker can use the machine key to send serialized payload to the server to execute arbitrary code and disrupt service.