A successful exploit could allow an authenticated user to execute arbitrary commands with elevated privileges. NetModule NSRW web administration interface executes an OS command constructed with unsanitized user input. Improper Restriction of Excessive Authentication Attempts in GitHub repository modoboa/modoboa-installer prior to 2.0.4. Open Redirect in GitHub repository btcpayserver/btcpayserver prior to 1.7.6. bAuh0lz/CVE-2023-0297_Pre-auth_RCE_in_pyLoadĬommand Injection in GitHub repository froxlor/froxlor prior to 2.0.8.įortra (formerly, HelpSystems) GoAnywhere MFT suffers from a pre-authentication command injection vulnerability in the License Response Servlet due to deserializing an arbitrary attacker-controlled object.A specially crafted Kroki diagram could lead to a stored XSS on the client side which allows attackers to perform arbitrary actions on behalf of victims.Ĭode Injection in GitHub repository pyload/pyload prior to 0.5.0b3.dev31.

An issue has been discovered in GitLab affecting all versions starting from 13.7 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2.

Caphyon malware