CVE-2022-37890

CVE-2022-37890 describes unauthenticated buffer overflow vulnerabilities in Aruba InstantOS and ArubaOS 10 web management interfaces. Exploitation can execute arbitrary commands on the underlying Aruba InstantOS/OS, with affected versions including InstantOS 6.4.x (6.4.4.8-4.2.4.20 and below), 6....

Generex UPS Adapter CS141 has a security vulnerability

Generex UPS Adapter CS141 is a UPS Uninterruptible Power System adapter from Generex, a German company.A command execution vulnerability exists in Generex UPS Adapter CS141 versions prior to 2.08, which originates from the web of runupdate in /usr/bin/gxservice -update.sh interface fails to...

TOTOLINK NR1800X: Operating System Command Injection Vulnerability

TOTOLINK NR1800X is a 5G NR indoor Wi-Fi and SIP CPE broadband access device from China's Gion Electronics TOTOLINK, which is mainly used for the deployment of NR fixed data services in homes and offices to support 5G NR network connectivity. The TOTOLINK NR1800X suffers from a command injection...

CVE-2022-40764

Snyk CLI before 1.996.0 allows arbitrary command execution, affecting Snyk IDE plugins and the snyk npm package. Exploitation could follow from the common practice of viewing untrusted files in the Visual Studio Code editor, for example. The original demonstration was with shell metacharacters in...

CVE-2022-40764

Snyk CLI before 1.996.0 allows arbitrary command execution, affecting Snyk IDE plugins and the snyk npm package. Exploitation could follow from the common practice of viewing untrusted files in the Visual Studio Code editor, for example. The original demonstration was with shell metacharacters in...

CVE-2022-40764

CVE-2022-40764 affects Snyk CLI and related IDE plugins; before 1.996.0, it allowed arbitrary command execution, potentially via viewing untrusted files in VS Code. The original demonstration involved shell metacharacters in the vendor.json ignore field, affecting snyk-go-plugin before 1.19.1 and...

CVE-2022-40764

Snyk CLI before 1.996.0 allows arbitrary command execution, affecting Snyk IDE plugins and the snyk npm package. Exploitation could follow from the common practice of viewing untrusted files in the Visual Studio Code editor, for example. The original demonstration was with shell metacharacters in...

CVE-2022-40764

Snyk CLI before 1.996.0 allows arbitrary command execution, affecting Snyk IDE plugins and the snyk npm package. Exploitation could follow from the common practice of viewing untrusted files in the Visual Studio Code editor, for example. The original demonstration was with shell metacharacters in...

PT-2022-25524 · Snyk +1 · Snyk-Go-Plugin +5

Name of the Vulnerable Software and Affected Versions: Snyk CLI versions prior to 1.996.0 snyk-go-plugin versions prior to 1.19.1 Snyk TeamCity plugin versions prior to 20220930.142957 Description: The issue allows for arbitrary command execution, affecting Snyk IDE plugins and the snyk npm...

Puppet security vulnerabilities

Puppet is a client/server C/S architecture-based configuration management tool from Puppet Labs that can be used to manage configuration files, users, cron tasks, packages, system services, etc. A command injection vulnerability exists in versions of Puppet Puppetlabs-apt module prior to 9.0.0. T...

CVE-2022-20855: Incorrect Privilege Assignment

A vulnerability in the self-healing functionality of Cisco IOS XE Software for Embedded Wireless Controllers on Catalyst Access Points could allow an authenticated, local attacker to escape the restricted controller shell and execute arbitrary commands on the underlying operating system of the...

Lenovo Quectel EM05-CE Wireless Network Adapter Heap Buffer Overflow

The vulnerability of the microprogrammed wireless network adapter Quectel EM05-CE for Lenovo laptops is related to the lack of measures taken to neutralize special elements used in the operating system. Exploiting this vulnerability allows an attacker to execute arbitrary commands by sending...

CVE-2022-20818: Path Traversal: '/../filedir'

Multiple vulnerabilities in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges. These vulnerabilities are due to improper access controls on commands within the application CLI. An attacker could exploit these vulnerabilities by running a...

CVE-2022-20775: Path Traversal: '/../filedir'

A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges. This vulnerability is due to improper access controls on commands within the application CLI. An attacker could exploit this vulnerability by running a maliciously crafted...

TOTOLINK A860R: Operating System Command Injection Vulnerability

TOTOLINK A860R is a wireless router from China Gion Electronics TOTOLINK.TOTOLINK A860R version V4.1.2cu.5182B20201027 is vulnerable to command injection, which stems from the component /cgi-bin/downloadFile.cgi failing to properly filter the construct command special characters, commands, etc. A...

CVE-2022-40126: Files or Directories Accessible to External Parties

A misconfiguration in the Service Mode profile directory of Clash for Windows v0.19.9 allows attackers to escalate privileges and execute arbitrary commands when Service Mode is activated...

PT-2022-25228 · Unknown · Clash For Windows

Name of the Vulnerable Software and Affected Versions: Clash for Windows version 0.19.9 Description: A misconfiguration in the Service Mode profile directory allows attackers to escalate privileges and execute arbitrary commands when Service Mode is activated. Recommendations: For Clash for Windo...

PT-2022-6015

Name of the Vulnerable Software and Affected Versions Cisco SD-WAN Software affected versions not specified Cisco SD-WAN vBond Orchestrator Cisco SD-WAN vEdge Cloud Routers Cisco SD-WAN vEdge Routers Cisco SD-WAN vSmart Controller Cisco SD-WAN vManage Description A flaw exists in the Command Line...

Cisco SD-WAN path traversal vulnerability

Cisco SD-WAN is a highly secure cloud-scale architecture from Cisco that is open, programmable, and scalable.Cisco SD-WAN has an access control error vulnerability that stems from improper access control of commands in the application CLI, which could be exploited by an attacker to elevate...

HPESBUX04368 rev.1 - HP-UX Using OpenSSL, Multiple Local and Remote Vulnerabilities

Potential Security Impact: Local: Arbitrary Command Execution, Denial of Service DoS, script injection; Remote: Arbitrary Command Execution, Denial of Service DoS, script injection SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HP-UX OpenSSL Software prior to A.01.01.01p.001 CVSS...