ZDI-23-1719: ManageEngine Recovery Manager Plus getEscapedValue Command Injection Remote Code Execution Vulnerability | allinfosecnews.com

Nov. 22, 2023, 6 a.m. |

ZDI: Published Advisories www.zerodayinitiative.com

This vulnerability allows remote attackers to execute arbitrary code on affected installations of ManageEngine Recovery Manager Plus. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.2. The following CVEs are assigned: CVE-2023-48646.

arbitrary code attackers authentication code code execution command command injection cve cves cvss exploit injection manageengine manager rating recovery remote code remote code execution vulnerability zdi

More from www.zerodayinitiative.com / ZDI: Published Advisories

ZDI-24-419: (Pwn2Own) Xiaomi Pro 13 GetApps integral-dialog-page Cross-Site Scripting Remote Code Execution Vulnerability 6 days, 4 hours ago | www.zerodayinitiative.com

arbitrary code attackers code code execution +18

ZDI-24-418: (Pwn2Own) Xiaomi Pro 13 mimarket manual-upgrade Cross-Site Scripting Remote Code Execution Vulnerability 6 days, 4 hours ago | www.zerodayinitiative.com

arbitrary code attackers code code execution +18

ZDI-24-417: Xiaomi Pro 13 isUrlMatchLevel Permissive List of Allowed Inputs Remote Code Execution Vulnerability 6 days, 4 hours ago | www.zerodayinitiative.com

arbitrary code attackers code code execution +16

ZDI-24-416: Centreon sysName Cross-Site Scripting Remote Code Execution Vulnerability 1 week, 1 day ago | www.zerodayinitiative.com

arbitrary code attackers centreon code +12

ZDI-24-407: X.Org Server ProcRenderAddGlyphs Use-After-Free Local Privilege Escalation Vulnerability 1 week, 4 days ago | www.zerodayinitiative.com

attacker attackers code cve +23

ZDI-24-406: Adobe After Effects AEP File Parsing Use-After-Free Remote Code Execution Vulnerability 1 week, 4 days ago | www.zerodayinitiative.com

adobe adobe after effects aep after effects +18

ZDI-24-405: Lexmark CX331adwe IPP Server Authorization HTTP Header Heap-Based Buffer Overflow Remote Code Execution Vulnerability 1 week, 4 days ago | www.zerodayinitiative.com

arbitrary code attackers authentication authorization +20

ZDI-24-415: (Pwn2Own) Oracle VirtualBox E1000 Uninitialized Memory Information Disclosure Vulnerability 1 week, 4 days ago | www.zerodayinitiative.com

attacker attackers code cves +22

ZDI-24-414: (Pwn2Own) Oracle VirtualBox AHCI Controller Uninitialized Memory Information Disclosure Vulnerability 1 week, 4 days ago | www.zerodayinitiative.com

attacker attackers code controller +22

Offensive Security Engineering Technical Lead, Device Security

@ Google | Amsterdam, Netherlands

View on infosec-jobs.com

Senior Security Engineering Program Manager

@ Microsoft | Redmond, Washington, United States

View on infosec-jobs.com

Information System Security Analyst

@ Resource Management Concepts, Inc. | Dahlgren, Virginia, United States

View on infosec-jobs.com

Critical Facility Security Officer - Evening Shift

@ Allied Universal | Charlotte, NC, United States

View on infosec-jobs.com

Information System Security Officer, Junior

@ Resource Management Concepts, Inc. | Patuxent River, Maryland, United States

View on infosec-jobs.com

Security Engineer

@ JPMorgan Chase & Co. | Plano, TX, United States

View on infosec-jobs.com