The exploit allows an authenticated attacker to execute arbitrary code on the target system by uploading a malicious PHP file via the 'upload.php' component. By leveraging this vulnerability, an attacker can gain remote access to the system.
The CommScope Ruckus IoT Controller version 1.7.1.0 and earlier contains an upgrade account that provides undocumented access via Secure Copy (SCP), allowing unauthorized individuals to access the virtual appliance.
The K7 Ultimate Security version less than 17.0.2019, specifically the driver file K7RKScan.sys version 15.1.0.7, allows local users to perform a Denial of Service (DoS) attack by triggering a null pointer dereference from IOCtl 0x222010 and 0x222014. The driver is accessible to all users in the 'Everyone' group, potentially leading to a system crash (BSOD) or other unspecified impacts.
A vulnerability was found in ASUS ASMB8 iKVM Firmware version 1.14.51 and potentially in other versions. By leveraging SNMP arbitrary extensions, an attacker can execute commands on the system with root privileges and bypass SSH restrictions to introduce a new user.
The vulnerability in WooCommerce Customers Manager plugin version 29.4 allows attackers with the Subscriber+ role to perform SQL injection by manipulating transaction amount parameters like 'max_amount', 'max_amount_total', 'min_amount', and 'min_amount_total' in the admin AJAX endpoint.
The exploit allows an attacker to write/overwrite arbitrary files on the system using the tar-fs 3.0.0 package. By running a specific command, two tar files are generated which can be uploaded sequentially to create a symlink and then write/overwrite the target file.
The ABB Cylon FLXeon BACnet controller is vulnerable to authenticated remote root code execution via the /api/users/password endpoint. An attacker with valid credentials can inject arbitrary system commands by manipulating the newPassword PUT parameter. This vulnerability allows for out-of-band (blind) command injection due to improper hashing and escaping of the new password in the users.js file, which is then passed to ChildProcess.exec() within a usermod command.
The vulnerability exists in GeoVision GV-ASManager web application version 6.1.0.0 or below. An attacker with network access and a low privilege account can perform unauthorized actions like enabling/disabling accounts, creating new accounts, modifying privileges, and accessing resources. After privilege escalation, the attacker can access monitoring cameras, employee information, change configurations, disrupt services, clone access control data, and retrieve cleartext passwords for further attacks.
By tricking a user into visiting a malicious website, an attacker could exploit this vulnerability in IBM Security Verify Access 10.0.0 - 10.0.8 to redirect the user to a different site that appears legitimate, potentially leading to the disclosure of sensitive information or enabling further attacks.
WebFileSys 2.31.0 is prone to a directory traversal vulnerability in the 'relPath' parameter. An attacker can exploit this issue by sending a crafted HTTP request to the affected server, allowing them to traverse directories and access sensitive files outside the intended directory structure. This vulnerability has been assigned CVE-2024-53586.
Services By CQR