Dell PowerProtect Data Domain Access Control Vulnerability

Dell PowerProtect Data Domain is a data protection storage appliance from Dell Technologies, built on the Data Domain platform and designed for building a resilient foundation for networks and enabling rapid data recovery. An access control vulnerability exists in Dell PowerProtect Data Domain,...

Checkmk 安全漏洞

Checkmk is an IT monitoring platform from Checkmk, Inc. Checkmk has a security vulnerability that stems from improper neutralization of the livestatus command separator, which could lead to arbitrary command execution. The following versions are affected: versions prior to 2.2.0p39, versions prio...

PT-2025-16001 · Palo Alto Networks · Palo Alto Networks Cortex Xdr Broker Vm

Name of the Vulnerable Software and Affected Versions: Palo Alto Networks Cortex XDR Broker VM affected versions not specified Description: A command injection issue in the Palo Alto Networks Cortex XDR Broker VM allows an authenticated user to execute arbitrary OS commands with root privileges o...

The vulnerability of the implementation of the AWS4-HMAC-SHA256 algorithm in the cross-platform FTP server CrushFTP allows a hacker to bypass security restrictions, gain access to the administrator account, and execute arbitrary commands.

The vulnerability of the AWS4-HMAC-SHA256 algorithm implementation in the cross-platform FTP server CrushFTP relates to the bypassing of authentication by using the default crushadmin account. Exploiting this vulnerability allows a malicious actor to circumvent security restrictions, gain access ...

CVE-2025-27797

OS command injection vulnerability in the specific service exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If exploited, an arbitrary OS command may be executed by a remote attacker who can log in to the product...

CVE-2025-25053

OS command injection vulnerability in the WEB UI the setting page exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If exploited, an arbitrary OS command may be executed by a remote attacker who can log in to the product...

CVE-2025-25053

OS command injection vulnerability in the WEB UI the setting page exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If exploited, an arbitrary OS command may be executed by a remote attacker who can log in to the product...

CVE-2025-25053

OS command injection vulnerability in the WEB UI the setting page exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If exploited, an arbitrary OS command may be executed by a remote attacker who can log in to the product...

CVE-2025-25053

CVE-2025-25053 describes an OS command injection in the WEB UI (settings page) of Inaba Denki Sangyo Wi‑Fi AP UNIT AC-WPS-11ac series. A remote attacker who can log in may execute arbitrary OS commands due to this input handling flaw. Affected are pre‑patch firmware versions; vendor‑provided fixe...

PT-2025-30559

Уязвимость режима «киоск» пакета redos-kiosk-utils операционной системы РЕД ОС связана с недостатками ограничений загрузки файлов опасного типа. Эксплуатация уязвимости может позволить нарушителю выполнить произвольные команды...

CVE-2025-27082

Arbitrary File Write vulnerabilities exist in the web-based management interface of both the AOS-10 GW and AOS-8 Controller/Mobility Conductor operating systems. Successful exploitation could allow an Authenticated attacker to upload arbitrary files and execute arbitrary commands on the underlyin...

CVE-2025-2244 Insecure PHP deserialization issue in GravityZone Console (VA-12634)

A vulnerability in the sendMailFromRemoteSource method in Emails.php as used in Bitdefender GravityZone Console unsafely uses php unserialize on user-supplied input without validation. By crafting a malicious serialized payload, an attacker can trigger PHP object injection, perform a file write,...

CVE-2025-2244: Deserialization of Untrusted Data

A vulnerability in the sendMailFromRemoteSource method in Emails.php as used in Bitdefender GravityZone Console unsafely uses php unserialize on user-supplied input without validation. By crafting a malicious serialized payload, an attacker can trigger PHP object injection, perform a file write,...

CVE-2025-26056

A command injection vulnerability exists in the Infinxt iEdge 100 2.1.32 in the Troubleshoot module "MTR" functionality. The vulnerability is due to improper validation of user-supplied input in the mtrIp parameter. An attacker can exploit this flaw to execute arbitrary operating system commands ...

CVE-2025-29987: Insufficient Granularity of Access Control

Dell PowerProtect Data Domain with Data Domain Operating System DD OS versions prior to 8.3.0.15 contain an Insufficient Granularity of Access Control vulnerability. An authenticated user from a trusted remote client could exploit this vulnerability to execute arbitrary commands with root...

Dell Unity OS Command Injection Vulnerability (CNVD-2025-06613)

Dell Unity is a set of virtual Unity storage environments from Dell USA. An OS command injection vulnerability exists in Dell Unity 5.4 and earlier versions, which can be exploited by an attacker to execute arbitrary operating system commands on the system...

Dell Unity OS Command Injection Vulnerability (CNVD-2025-06618)

Dell Unity is a set of virtual Unity storage environments from Dell USA. Dell Unity suffers from an OS command injection vulnerability that can be exploited by an attacker to execute arbitrary operating system commands on the system...

Dell Unity OS Command Injection Vulnerability (CNVD-2025-06617)

Dell Unity is a set of virtual Unity storage environments from Dell USA. An OS command injection vulnerability exists in Dell Unity 5.4 and earlier versions, which can be exploited by an attacker to execute arbitrary operating system commands on the system...

PT-2025-18661 · Totolink · Totolink Ca600-Poe

Name of the Vulnerable Software and Affected Versions: TOTOLINK CA600-PoE version 5.3c.6665 B20180820 Description: A command injection issue was discovered in the CloudSrvUserdataVersionCheck function via the svn parameter. This issue allows attackers to execute arbitrary commands through a...

The vulnerability in the web interface of the Cisco Identity Services Engine (ISE) management platform allows a perpetrator to upload arbitrary files, increase their privileges, and execute arbitrary commands.

The vulnerability in the web interface of the Cisco Identity Services Engine ISE management platform relates to the unlimited loading of dangerous files. Exploiting this vulnerability allows a malicious actor to load arbitrary files, increase their privileges, and execute arbitrary commands...