We are a Singapore company providing cyber security services. Our aim is to enable organizations to better prepare and protect themselves against the ever-evolving threat of cyber attacks.
(CVE-2024-1837) Singtel RT5703W Unauthenticated Command Injection RCE via Login Vulnerability
Summary Product Singtel WI-FI 6 ROUTER RT5703W Vendor Singtel/Askey Severity Critical - Adversaries may exploit software vulnerabilities to execute arbitrary commands on the underlying OS with root privileges. Affected Versions V1.6.4-5194 (latest version as of writing) Tested Versions V1.6.4-5194 (latest version as of writing) Internal Identifier STAR-2023-0097 CVE Identifier TBD CVE Description OS command injection vulnerability in net....
(CVE-2024-1838) Singtel RT5703W Authenticated Command Injection RCE via SetLoginPwd Vulnerability
Summary Product Singtel WI-FI 6 ROUTER RT5703W Vendor Singtel/Askey Severity High - Adversaries may exploit software vulnerabilities to execute arbitrary commands on the underlying OS with root privileges. Affected Versions V1.6.4-5194 (latest version as of writing) Tested Versions V1.6.4-5194 (latest version as of writing) Internal Identifier STAR-2023-0098 CVE Identifier TBD CVE Description OS command injection vulnerability in net....
(CVE-2023-3368) Chamilo LMS Unauthenticated Command Injection
Summary Product Chamilo Vendor Chamilo Severity High - Adversaries may exploit software vulnerabilities to obtain unauthenticated remote code execution. Affected Versions <= v1.11.20 Tested Versions v1.11.20 (latest version as of writing) CVE Identifier CVE-2023-3368 CVE Description Command injection in /main/webservices/additional_webservices.php in Chamilo LMS <= v1.11.20 allows unauthenticated attackers to obtain remote code execution via improper neutralisation of special characters....
(CVE-2023-3533) Chamilo LMS Unauthenticated Remote Code Execution via Arbitrary File Write
Summary Product Chamilo Vendor Chamilo Severity High - Adversaries may exploit software vulnerabilities to obtain unauthenticated remote code execution. Affected Versions <= v1.11.20 Tested Versions v1.11.20 (latest version as of writing) CVE Identifier CVE-2023-3533 CVE Description Path traversal in file upload functionality in /main/webservices/additional_webservices.php in Chamilo LMS <= v1.11.20 allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via arbitrary file write....
(CVE-2023-3545) Chamilo LMS Htaccess File Upload Security Bypass
Summary Product Chamilo Vendor Chamilo Severity High - Adversaries may exploit software vulnerabilities to obtain unauthenticated remote code execution. Affected Versions <= v1.11.20 Tested Versions v1.11.20 (latest version as of writing) CVE Identifier CVE-2023-3545 CVE Description Improper sanitisation in main/inc/lib/fileUpload.lib.php in Chamilo LMS <= v1.11.20 on Windows and Apache installations allows unauthenticated attackers to bypass file upload security protections and obtain remote code execution via uploading of ....
(CVE-2023-4220) Chamilo LMS Unauthenticated Big Upload File Remote Code Execution
Summary Product Chamilo Vendor Chamilo Severity High - Adversaries may exploit software vulnerabilities to obtain unauthenticated remote code execution. Affected Versions <= v1.11.24 Tested Versions v1.11.24 (latest version as of writing) CVE Identifier CVE-2023-4220 CVE Description Unrestricted file upload in big file upload functionality in /main/inc/lib/javascript/bigupload/inc/bigUpload.php in Chamilo LMS <= v1.11.24 allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via uploading of web shell....
(CVE-2023-4221) Chamilo LMS Learning Path PPT2LP OpenofficePresentation Command Injection
Summary Product Chamilo Vendor Chamilo Severity High - Adversaries may exploit software vulnerabilities to obtain unauthenticated remote code execution. Affected Versions <= v1.11.24 Tested Versions v1.11.24 (latest version as of writing) CVE Identifier CVE-2023-4221 CVE Description Command injection in main/lp/openoffice_presentation.class.php in Chamilo LMS <= v1.11.24 allows users permitted to upload Learning Paths to obtain remote code execution via improper neutralisation of special characters....