Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

h00die-gr3y vulnerabilities and exploits

(subscribe to this query)
7.5
CVSSv3
CVE-2023-32315
Openfire is an XMPP server licensed under the Open Source Apache License. Openfire's administrative console, a web-based application, was found to be vulnerable to a path traversal attack via the setup environment. This permitted an unauthenticated user to use the unauthenti...
Igniterealtime Openfire
9.8
CVSSv3
CVE-2023-30013
TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a command insertion vulnerability in setting/setTracerouteCfg. This vulnerability allows an malicious user to execute arbitrary commands through the "command" parameter.
Totolink X5000r Firmware 9.1.0u.6118 B20201102Totolink X5000r Firmware 9.1.0u.6369 B20230113
7.8
CVSSv3
CVE-2023-50445
Shell Injection vulnerability GL.iNet A1300 v4.4.6, AX1800 v4.4.6, AXT1800 v4.4.6, MT3000 v4.4.6, MT2500 v4.4.6, MT6000 v4.5.0, MT1300 v4.3.7, MT300N-V2 v4.3.7, AR750S v4.3.7, AR750 v4.3.7, AR300M v4.3.7, and B1300 v4.3.7., allows local malicious users to execute arbitrary code v...
Gl-inet Gl-mt1300 Firmware 4.3.7Gl-inet Gl-mt300n-v2 Firmware 4.3.7Gl-inet Gl-ar750s Firmware 4.3.7Gl-inet Gl-ar750 Firmware 4.3.7Gl-inet Gl-ar300m Firmware 4.3.7Gl-inet Gl-b1300 Firmware 4.3.7Gl-inet Gl-mt6000 Firmware 4.5.0Gl-inet Gl-a1300 Firmware 4.4.6Gl-inet Gl-ax1800 Firmware 4.4.6Gl-inet Gl-axt1800 Firmware 4.4.6Gl-inet Gl-mt3000 Firmware 4.4.6Gl-inet Gl-mt2500 Firmware 4.4.6
9.8
CVSSv3
CVE-2023-23333
There is a command injection vulnerability in SolarView Compact up to and including 6.00, attackers can execute commands by bypassing internal restrictions through downloader.php.
Contec Solarview Compact Firmware
9.8
CVSSv3
CVE-2023-30258
Command Injection vulnerability in MagnusSolution magnusbilling 6.x and 7.x allows remote malicious users to run arbitrary commands via unauthenticated HTTP request.
Magnussolution Magnusbilling
NA
CVE-2021-458439
This Metasploit module is a Terramaster chained exploit that performs session crafting to achieve escalated privileges that allows an attacker to access vulnerable code execution flaws. TOS versions 4.2.15 and below are affected.
9.8
CVSSv3
CVE-2020-35665
An unauthenticated command-execution vulnerability exists in TerraMaster TOS up to and including 4.2.06 via shell metacharacters in the Event parameter in include/makecvs.php during CSV creation.
Terra-master Terramaster Operating System
8.8
CVSSv3
CVE-2022-33891
The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilter can...
Apache Spark
8.8
CVSSv3
CVE-2023-52251
An issue discovered in provectus kafka-ui 0.4.0 up to and including 0.7.1 allows remote malicious users to execute arbitrary code via the q parameter of /api/clusters/local/topics/{topic}/messages.
Provectus Ui
9.8
CVSSv3
CVE-2024-23759
Deserialization of Untrusted Data in Gambio up to and including 4.9.2.0 allows malicious users to run arbitrary code via "search" parameter of the Parcelshopfinder/AddAddressBookEntry" function.
Gambio Gambio 4.9.2.0
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-34377CVE-2024-20859CVE-2023-49606injectarbitrary CVE-2024-33788CVE-2024-30973IDORCVE-2024-33907
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook