Week 18, 2023

Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack

Apache Software Foundation · Apache Log4j

TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 contained a command injection vulnerability in the country form of the…

TP-Link Archer AX21 (AX1800)

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0,…

Oracle Corporation · WebLogic Server

OS Command Injection in sbs20/scanservjs

sbs20 · sbs20/scanservjs

Kibana version 8.7.0 contains an arbitrary code execution flaw. An attacker with All privileges to the Uptime/Synthetics feature could send a request that will…

Elastic · Kibana

Improper Privilege Management vulnerability in SUSE Rancher allows Privilege Escalation. A failure in the update logic of Rancher's admission Webhook may lead…

SUSE · Rancher

Remote Code Execution in OpenTSDB

OpenTSDB · OpenTSDB

SupportCandy < 3.1.5 - Unauthenticated SQLi

Unknown · SupportCandy

Cisco SPA112 2-Port Phone Adapters Remote Command Execution Vulnerability

Cisco · Cisco Small Business IP Phones

TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a command insertion vulnerability in setting/setTracerouteCfg. This vulnerability…

Product not named

OS Command Injection in appium/appium-desktop

appium · appium/appium-desktop

GL.iNET MT3000 4.1.0 Release 2 is vulnerable to OS Command Injection via /usr/lib/oui-httpd/rpc/logread.

Product not named

ejs v3.1.9 is vulnerable to server-side template injection. If the ejs file is controllable, template injection can be implemented through the configuration…

Product not named