CVE-2023-6201

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Univera Computer System Panorama allows Command Injection.

This issue affects Panorama: before 8.0.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
Univera Computer System	Panorama	< 8.0
univera	panorama	< 8.0

References

https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-23-0665
https://www.usom.gov.tr/bildirim/tr-23-0665Third Party Advisory
https://www.usom.gov.tr/bildirim/tr-23-0665Third Party Advisory

Timeline

Published: Nov 28, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-62024.3Mattermost fails to perform proper authorization in the /plugins/focalboard/api/v2/users endpoint allowing an attacker who is a guest user a CVE-2023-62037.5The Events Calendar WordPress plugin before 6.2.8.1 discloses the content of password protected posts to unauthenticated users via a crafted CVE-2023-62046.5On some systems—depending on the graphics settings and drivers—it was possible to force an out-of-bounds read and leak memory data into the CVE-2023-62056.5It was possible to cause the use of a MessagePort after it had already been freed, which could potentially have led to an exploitable crash.CVE-2023-62065.4The black fade animation when exiting fullscreen is roughly the length of the anti-clickjacking delay on permission prompts. It was possible CVE-2023-62078.8Ownership mismanagement led to a use-after-free in ReadableByteStreams This vulnerability affects Firefox < 120, Firefox ESR < 115.5.0, and CVE-2023-62088.8When using X11, text selected by the page using the Selection API was erroneously copied into the primary selection, a temporary storage not CVE-2023-62096.5Relative URLs starting with three slashes were incorrectly parsed, and a path-traversal "/../" part in the path could be used to override th CVE-2023-62106.5When an https: web page created a pop-up from a "javascript:" URL, that pop-up was incorrectly allowed to load blockable content such as ifr CVE-2023-62116.5If an attacker needed a user to load an insecure http: page and knew that user had enabled HTTPS-only mode, the attacker could have tricked CVE-2023-62128.8Memory safety bugs present in Firefox 119, Firefox ESR 115.4, and Thunderbird 115.4. Some of these bugs showed evidence of memory corruption CVE-2023-62138.8Memory safety bugs present in Firefox 119. Some of these bugs showed evidence of memory corruption and we presume that with enough effort so