CVE-2013-3384
HighSummary
Framework webowy w IronPort AsyncOS na urządzeniach Cisco Web Security Appliance przed wersją 7.1.3-013, 7.5 przed 7.5.0-838 oraz 7.7 przed 7.7.0-550, a także na urządzeniach Email Security Appliance przed wersją 7.1.5-104, 7.3 przed 7.3.2-026, 7.5 przed 7.5.2-203 i 7.6 przed 7.6.3-019 oraz na urządzeniach Content Security Management Appliance przed wersją 7.2.2-110, 7.7 przed 7.7.0-213 oraz 7.8 i 7.9 przed 7.9.1-102, pozwala zdalnie uwierzytelnionym użytkownikom na wykonywanie dowolnych poleceń za pomocą spreparowanego wejścia w linii poleceń w URL.
Risk Assessment
Podatność ta może prowadzić do nieautoryzowanego dostępu i wykonania dowolnych poleceń na urządzeniach, co stwarza poważne zagrożenie dla bezpieczeństwa organizacji.
Recommendation
Zaleca się aktualizację urządzeń do najnowszych wersji oprogramowania, aby usunąć tę podatność oraz przeprowadzenie audytu bezpieczeństwa w celu zidentyfikowania potencjalnych zagrożeń.
Related vulnerabilities
- CVE-2026-86106Critical
An unauthenticated actor with network access to the private HA interconnect may trigger sensitive HA peer functions without verification. This could result in elevated command execution on Edge units where HA is enabled.
- CVE-2026-73453Critical
An unauthenticated P4Runtime client can achieve arbitrary code execution under certain conditions on affected platforms running Arista EOS configured with P4Runtime. By crafting a malicious packet during session initiation, an attacker can obtain complete administrative control over the switch.
- CVE-2026-81642Critical
In NLnet Labs Unbound up to and including 1.26.0, a vulnerability in the DNSSEC validator enables denial of service and possible remote code execution via DNSKEY processing. A crafted DNSKEY can overflow the digest buffer.
- CVE-2026-27565Critical
An unauthenticated remote attacker can upload a malicious IODD file that places and executes a shell script with root privileges. The script remains active even after a reboot.
- CVE-2026-27546Critical
An unauthenticated remote attacker can exploit an authentication bypass in the _account_log function to log in as an admin, even when accounts are properly configured.
- CVE-2026-73447Critical
A privileged attacker can exploit gNSI Certz service on Arista EOS-based products to escalate privileges and execute arbitrary OS commands via a crafted Certz Rotate request. The Bootz service is also affected.
- CVE-2026-14349Critical
The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress in all versions up to and including 1.2.3 is vulnerable to authorization bypass. This is due to the plugin not properly verifying that a user is authorized to perform an action. This allows unauthenticated attackers to modify the email address of arbitrary user accounts, including administrators, which can be leveraged to reset the account password and gain access.
- CVE-2026-12793Critical
The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress in all versions up to and including 3.6.2 is vulnerable to Privilege Escalation. This is due to the plugin not validating that a submitted form ID belongs to a JetFormBuilder form before parsing the referenced post's content as form schema and executing an Advanced Validation server-side callback. This allows unauthenticated attackers to create a new administrator-level user account.
- CVE-2026-15640Critical
Under certain conditions a valid SAML IdP response may be used to impersonate another Secret Server user. The vulnerability affects the SAML authentication mechanism.
- CVE-2026-15639Critical
An attacker can craft a malicious link that, if used by a legitimate user, may cause the user's browser to run JavaScript supplied by the attacker. The vulnerability affects the link processing mechanism.
Original NVD description (English source)
The web framework in IronPort AsyncOS on Cisco Web Security Appliance devices before 7.1.3-013, 7.5 before 7.5.0-838, and 7.7 before 7.7.0-550; Email Security Appliance devices before 7.1.5-104, 7.3 before 7.3.2-026, 7.5 before 7.5.2-203, and 7.6 before 7.6.3-019; and Content Security Management Appliance devices before 7.2.2-110, 7.7 before 7.7.0-213, and 7.8 and 7.9 before 7.9.1-102 allows remote authenticated users to execute arbitrary commands via crafted command-line input in a URL, aka Bug IDs CSCzv85726, CSCzv44633, and CSCzv24579.