CVE-2022-44019

In Total.js 4 before 0e5ace7, /api/common/ping can achieve remote command execution via shell metacharacters in the host parameter...

total.js 操作系统命令注入漏洞

total.js is open source a framework developed using JavaScript for the Node.js platform. It can be used to develop web, desktop, service and IoT platforms. An operating system command injection vulnerability exists in versions of total.js prior to 0e5ace7, which stems from /api/common/ping can be...

PT-2022-27081 · Total.Js · Total.Js

Name of the Vulnerable Software and Affected Versions: Total.js versions prior to 0e5ace7 Description: The issue allows remote command execution via shell metacharacters in the host parameter of the "/api/common/ping" API endpoint. Recommendations: For versions prior to 0e5ace7, update to a versi...

CVE-2022-44019: Improper Neutralization of Special Elements used in an OS Command

In Total.js 4 before 0e5ace7, /api/common/ping can achieve remote command execution via shell metacharacters in the host parameter...

CVE-2022-42055

Multiple command injection vulnerabilities in GL.iNet GoodCloud IoT Device Management System Version 1.00.220412.00 via the ping and traceroute tools allow attackers to read arbitrary files on the system...

CVE-2022-42055

Multiple command injection vulnerabilities in GL.iNet GoodCloud IoT Device Management System Version 1.00.220412.00 via the ping and traceroute tools allow attackers to read arbitrary files on the system...

Command injection

Multiple command injection vulnerabilities in GL.iNet GoodCloud IoT Device Management System Version 1.00.220412.00 via the ping and traceroute tools allow attackers to read arbitrary files on the system...

Design/Logic Flaw

An unauthenticated attacker with network access to a victim's Rockwell Automation FactoryTalk Alarm and Events service could open a connection, causing the service to fault and become unavailable. The affected port could be used as a server ping port and uses messages structured with XML...

PT-2022-26225 · Gl.Inet · Gl.Inet Goodcloud Iot Device Management System

Name of the Vulnerable Software and Affected Versions: GL.iNet GoodCloud IoT Device Management System version 1.00.220412.00 Description: The issue concerns command injection vulnerabilities in the ping and traceroute tools of the system, allowing attackers to read arbitrary files on the system...

CVE-2022-42055

Multiple command injection vulnerabilities in GL.iNet GoodCloud IoT Device Management System Version 1.00.220412.00 via the ping and traceroute tools allow attackers to read arbitrary files on the system...

GL.iNet GoodCloud 操作系统命令注入漏洞

GL.iNet GoodCloud is an IoT device management system from China's Guanglian Zhitong GL.iNet. An operating system command injection vulnerability exists in GL.iNet GoodCloud version 1.00.220412.00, which stems from the presence of multiple command injection vulnerabilities that allow an attacker t...

PT-2022-24549 · Rockwell Automation · Rockwell Automation Factorytalk Alarm/Events Service

Name of the Vulnerable Software and Affected Versions: Rockwell Automation FactoryTalk Alarm and Events service affected versions not specified Description: The issue allows an unauthenticated attacker with network access to cause the Rockwell Automation FactoryTalk Alarm and Events service to...

CVE-2022-42055: Improper Neutralization of Special Elements used in an OS Command

Multiple command injection vulnerabilities in GL.iNet GoodCloud IoT Device Management System Version 1.00.220412.00 via the ping and traceroute tools allow attackers to read arbitrary files on the system...

CVE-2022-42055

GL.iNet GoodCloud IoT Device Management System v1.00.220412.00 is affected by multiple command-injection vulnerabilities in its ping and traceroute tools that allow an attacker to read arbitrary files. Exploitation requires network access with low privileges, and the issues are classified with a ...

PT-2022-20978 · Gl.Inet · Gl-Inet Gl-Ax1800 Flint +1

Name of the Vulnerable Software and Affected Versions: gl-inet GL-MT300N-V2 Mango version 3.212 gl-inet GL-AX1800 Flint version 3.214 Description: The issue concerns command injection vulnerabilities. These vulnerabilities can be exploited via the ping addr and trace addr function parameters...

PT-2022-5278 · D Link · D-Link Covr

Name of the Vulnerable Software and Affected Versions: D-Link COVR versions 1200, 1202, 1203 v1.08 Description: The issue is related to a command injection vulnerability in the SetNetworkTomographySettings function. This vulnerability can be exploited via the tomography ping number parameter,...

D-Link COVR 命令注入漏洞

D-Link COVR is a series of routers from China-based AUO D-Link. A security vulnerability exists in the D-Link COVR 1200, 1203 v1.08 versions, which originates from a command injection vulnerability contained via the tomographypingnumber parameter in the function SetNetworkTomographySettings...

Security Bulletin: Multiple vulnerabilities in HTTP/2 implementation used by Liberty for Java for IBM Cloud

Summary There are multiple vulnerabilities in the HTTP/2 implementation that is used by WebSphere Application Server Liberty. This affects the servlet-4.0 and servlet-3.1 features. These vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2019-9515 DESCRIPTION: Some HTTP/2...

CVE-2022-1591

The WordPress Ping Optimizer WordPress plugin before 2.35.1.3.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2022-1591

The WordPress Ping Optimizer WordPress plugin before 2.35.1.3.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...