Threat database

OS Command injection vulnerability in D-Link DIR820LA1_FW105B03 allows attackers to escalate privileges to root via a crafted payload with the ping_addr parameter to ping.ccp.

Array Networks Array AG Series and vxAG (9.4.0.481 and earlier) allow remote code execution. An attacker can browse the filesystem on the SSL VPN gateway using a flags attribute in an HTTP header without authentication. The product could then be exploited through a vulnerable URL. The 2023-03-09 vendor advisory stated "a new Array AG release with the fix will be available soon."

TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 contained a command injection vulnerability in the country form of the /cgi-bin/luci;stok=/locale endpoint on the web management interface. Specifically, the country parameter of the write operation was not sanitized before being used in a call to popen(), allowing an unauthenticated attacker to inject commands, which would be run as root, with a simple POST request.

Windows SmartScreen Security Feature Bypass Vulnerability

CVE-2022-41328 is a path traversal vulnerability in Fortinet FortiOS that allows a local privileged attacker to read and write arbitrary files using crafted CLI commands. This vulnerability has been exploited in the wild. No specific affected versions or patch information are provided in the available data.

CVE-2023-23397 is a critical privilege escalation vulnerability in Microsoft Office Outlook that enables an NTLM Relay attack, allowing an attacker to authenticate as the user to another service without user interaction. This vulnerability has been exploited in the wild and carries a high impact on confidentiality, integrity, and availability.

CVE-2023-27532 is a high severity vulnerability in Veeam Backup & Replication versions prior to 12.0.0.1420. It involves missing authentication for a critical function, allowing attackers to obtain encrypted credentials stored in the configuration database. This exposure can lead to unauthorized access to backup infrastructure hosts. The vulnerability has a CVSS score of 7.5 and is known to be exploited in the wild, including use in ransomware campaigns.

CVE-2021-39144 is a remote code execution vulnerability in XStream that allows attackers to manipulate input streams to inject or replace objects, leading to execution of local commands on the server. This flaw affects multiple products, including VMware Cloud Foundation. It has been exploited in the wild, indicating active threat usage. No specific affected versions or patch information is provided in the available data.

CVE-2020-5741 is a remote code execution vulnerability in Plex Media Server. It allows an attacker who has access to the server administrator's Plex account to upload a malicious file through the Camera Upload feature, which the media server then executes. This vulnerability has been exploited in the wild.

CVE-2022-28810 is a high-severity vulnerability in Zoho ManageEngine ADSelfService Plus that allows remote code execution during password change or reset operations. The vulnerability is known to be exploited in the wild. No specific affected versions or patch information is provided in the available data.

Apache Spark contains a command injection vulnerability in its User Interface (UI) when Access Control Lists (ACLs) are enabled. This vulnerability has been exploited in the wild and is considered high severity. No specific affected versions or patch information are provided in the available data.

Teclib GLPI contains a remote code execution vulnerability due to a flaw in the third-party library htmlawed. This vulnerability has been exploited in the wild and is considered high severity. No specific affected versions or patch information is provided in the available data.

A type confusion issue was addressed with improved checks. This issue is fixed in iOS 15.7.4 and iPadOS 15.7.4, iOS 16.3.1 and iPadOS 16.3.1, macOS Ventura 13.2.1, Safari 16.3. Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.

CVE-2022-36537 is a high-severity vulnerability in the ZK Framework AuUploader servlets that allows an attacker to retrieve the content of files located within the web context. This unspecified vulnerability affects multiple products using the ZK Framework, including ConnectWise R1Soft Server Backup Manager. The vulnerability has been exploited in the wild and is known to have been used in ransomware campaigns.

IBM Aspera Faspex contains a high-severity vulnerability (CVE-2022-47986) due to a YAML deserialization flaw that allows remote code execution. This vulnerability has been exploited in the wild and is known to be used in ransomware campaigns. No specific affected versions or patch information are provided in the available data.

CVE-2022-41223 is a code injection vulnerability in the Director component of Mitel MiVoice Connect. It allows an authenticated attacker with internal network access to execute arbitrary code within the application context. This vulnerability has been exploited in the wild and is associated with known ransomware campaigns.

CVE-2022-40765 is a command injection vulnerability in the Mitel Edge Gateway component of MiVoice Connect. It allows an authenticated attacker with internal network access to execute arbitrary commands on the system. The vulnerability has been exploited in the wild and is associated with known ransomware campaigns. No specific affected versions or patch information is provided.

An issue was discovered in Joomla! 4.0.0 through 4.2.7. An improper access check allows unauthorized access to webservice endpoints.

Cacti contains a command injection vulnerability (CVE-2022-46169) that allows an unauthenticated attacker to execute arbitrary code on the affected system. This vulnerability has been exploited in the wild. No specific affected versions or patch information are provided.

Windows Graphics Component Remote Code Execution Vulnerability