CVE-2023-28725

CRITICAL Year: 2023
CVSS v3 Score
9.1
Critical
Weakness Type
CWE-434
View all →

Vulnerability Description

General Bytes Crypto Application Server (CAS) 20230120, as distributed with General Bytes BATM devices, allows remote attackers to execute arbitrary Java code by uploading a Java application to the /batm/app/admin/standalone/deployments directory, aka BATM-4780, as exploited in the wild in March 2023. This is fixed in 20221118.48 and 20230120.44.

Related Vulnerabilities

CVE-2017-7357

CRITICAL
CVSS:9.1(Critical)

Hipchat Server before 2.2.3 allows remote authenticated users with Server Administrator level privileges to execute arbitrary code by importing a file.

CWE-4342017

CVE-2019-17058

CRITICAL
CVSS:9.1(Critical)

Footy Tipping Software AFL Web Edition 2019 allows arbitrary file upload and resultant remote code execution because a whitelist can be bypassed by an Administrator who uploads a crafted upload.dat fi...

CWE-4342019

CVE-2020-24195

CRITICAL
CVSS:9.1(Critical)

An Arbitrary File Upload in the Upload Image component in Sourcecodester Online Bike Rental v1.0 allows authenticated administrator to conduct remote code execution.

CWE-4342020

CVE-2020-24407

CRITICAL
CVSS:9.1(Critical)

Magento versions 2.4.0 and 2.3.5p1 (and earlier) are affected by an unsafe file upload vulnerability that could result in arbitrary code execution. This vulnerability could be abused by authenticated ...

CWE-4342020

CVE-2020-26255

CRITICAL
CVSS:9.1(Critical)

Kirby is a CMS. In Kirby CMS (getkirby/cms) before version 3.4.5, and Kirby Panel before version 2.5.14 , an editor with full access to the Kirby Panel can upload a PHP .phar file and execute it on th...

CWE-4342020

CVE-2020-26820

CRITICAL
CVSS:9.1(Critical)

SAP NetWeaver AS JAVA, versions - 7.20, 7.30, 7.31, 7.40, 7.50, allows an attacker who is authenticated as an administrator to use the administrator console, to expose unauthenticated access to the fi...

CWE-4342020