12672 matches found
GHSA-5WW9-9QP2-X524 Improper handling of double quotes in file name in Diffy in Windows environment
The function that calls the diff tool in versions of Diffy prior to 3.4.1 does not properly handle double quotes in a filename when run in a Windows environment. This allows attackers to execute arbitrary commands via a crafted string...
com.github.lkqm:spring-data-mongodb-extends (>=0.0.1, <=0.0.3), com.github.paulcwarren:content-mongo-spring-boot-starter (>=0, <=0.8.0) +43 more potentially affected by CVE-2022-22980 via org.springframework.data:spring-data-mongodb (2.1.5.release)
org.springframework.data:spring-data-mongodb MAVEN version 2.1.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.data:spring-data-mongodb and may be impacted: - com.github.lkqm:spring-data-mongodb-extends =0.0.1, =0, =0, =0,...
CVE-2022-20828: Improper Handling of Undefined Parameters
A vulnerability in the CLI parser of Cisco FirePOWER Software for Adaptive Security Appliance ASA FirePOWER module could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected ASA FirePOWER module as the root user. This vulnerabilit...
CVE-2021-42056: Improper Link Resolution Before File Access
Thales Safenet Authentication Client SAC for Linux and Windows through 10.7.7 creates insecure temporary hid and lock files allowing a local attacker, through a symlink attack, to overwrite arbitrary files, and potentially achieve arbitrary command execution with high privileges...
PAM auth Remote Execution Command Injection
The vulnerability of the PAM auth function in configuration management and remote execution of Salt operations is related to the absence of effective blocking for “locked accounts”. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...
CVE-2022-31767: Improper Neutralization of Special Elements used in an OS Command
IBM CICS TX Standard and Advanced 11.1 could allow a remote attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-Force ID: 227980...
CVE-2022-33127
The function that calls the diff tool in Diffy 3.4.1 does not properly handle double quotes in a filename when run in a windows environment. This allows attackers to execute arbitrary commands via a crafted string...
CVE-2022-33127
CVE-2022-33127 concerns the Diffy library. The issue arises in the function that calls the diff tool in Diffy 3.4.1, which does not properly handle double quotes in a filename when run on Windows. This insufficient input handling can allow an attacker to execute arbitrary commands via a crafted s...
CVE-2022-33127
The function that calls the diff tool in Diffy 3.4.1 does not properly handle double quotes in a filename when run in a windows environment. This allows attackers to execute arbitrary commands via a crafted string...
TOTOLINK A3000RU Main Command Execution
The vulnerability of the “Main” function in TOTOLINK A3000RU router microprogramming systems is related to insufficient checking of arguments passed in commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands through the QUERYSTRING parameter...
CVE-2022-31767
IBM CICS TX Standard and Advanced 11.1 could allow a remote attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-Force ID: 227980...
CVE-2022-2068
In addition to the crehash shell command injection identified in CVE-2022-1292, further circumstances where the crehash script does not properly sanitise shell metacharacters to prevent command injection were found by code review. When the CVE-2022-1292 was fixed it was not discovered that there...
CVE-2022-31794
An issue was discovered on Fujitsu ETERNUS CentricStor CS8000 Control Center devices before 8.1A SP02 P04. The vulnerability resides in the requestTempFile function in hwview.php. An attacker is able to influence the unitName POST parameter and inject special characters such as semicolons,...
CVE-2022-31795
An issue was discovered on Fujitsu ETERNUS CentricStor CS8000 Control Center devices before 8.1A SP02 P04. The vulnerability resides in the grelfinfo function in grel.php. An attacker is able to influence the username user, password pw, and file-name file parameters and inject special characters...
CVE-2022-31795
An issue was discovered on Fujitsu ETERNUS CentricStor CS8000 Control Center devices before 8.1A SP02 P04. The vulnerability resides in the grelfinfo function in grel.php. An attacker is able to influence the username user, password pw, and file-name file parameters and inject special characters...
CVE-2022-31794
CVE-2022-31794 affects Fujitsu ETERNUS CentricStor CS8000 Control Center prior to 8.1A SP02 P04. The issue is in hw_view.php: the function requestTempFile can be influenced via the unitName POST parameter, allowing an attacker to inject special characters (e.g., semicolons, backticks, command-sub...
WAVLINK AERIAL X 1200M Command Injection Vulnerability
WAVLINK AERIAL X 1200M, a WiFi extender from WAVLINK China, is vulnerable to a command injection vulnerability in version M79X3.V5030.180719, which stems from the execution of a POST received in adm.cgi spliced directly into a system function, which can be exploited by an attacker to exploit this...
CVE-2022-31795: Improper Neutralization of Special Elements used in an OS Command
An issue was discovered on Fujitsu ETERNUS CentricStor CS8000 Control Center devices before 8.1A SP02 P04. The vulnerability resides in the grelfinfo function in grel.php. An attacker is able to influence the username user, password pw, and file-name file parameters and inject special characters...
PT-2022-21861
Name of the Vulnerable Software and Affected Versions CA Automic Automation versions 12.2 through 12.3 Description The issue is related to an authentication error in the Automic agent, which could allow a remote attacker to potentially execute arbitrary commands. Recommendations For CA Automic...