CVE-2021-21956

A php unserialize vulnerability exists in the Ai-Bolit functionality of CloudLinux Inc Imunify360 5.10.2. A specially-crafted malformed file can lead to potential arbitrary command execution. An attacker can provide a malicious file to trigger this vulnerability...

CVE-2020-25150: Relative Path Traversal

A relative path traversal attack in the B. Braun Melsungen AG SpaceCom Version L81/U61 and earlier, and the Data module compactplus Versions A10 and A11 allows attackers with service user privileges to upload arbitrary files. By uploading a specially crafted tar file an attacker can execute...

CVE-2021-21956: Deserialization of Untrusted Data

A php unserialize vulnerability exists in the Ai-Bolit functionality of CloudLinux Inc Imunify360 5.10.2. A specially-crafted malformed file can lead to potential arbitrary command execution. An attacker can provide a malicious file to trigger this vulnerability...

ThoughtWorks GoCD command injection vulnerability

ThoughtWorks GoCD is a free and open source CI/CD server from ThoughtWorks, Inc. A command injection vulnerability exists in versions of ThoughtWorks GoCD prior to 21.3.0, which can be exploited by attackers to cause arbitrary command execution...

CVE-2022-20677

Multiple vulnerabilities in the Cisco IOx application hosting environment on multiple Cisco platforms could allow an attacker to inject arbitrary commands into the underlying host operating system, execute arbitrary code on the underlying host operating system, install applications without being...

PT-2022-2850 · Cisco · Cisco Iox +1

Name of the Vulnerable Software and Affected Versions: Cisco IOx affected versions not specified Description: Multiple vulnerabilities in the Cisco IOx application hosting environment on multiple Cisco platforms could allow an attacker to inject arbitrary commands into the underlying host operati...

Cisco IOS XE Software input validation error vulnerability

Cisco IOS XE is a set of operating systems developed by Cisco for its network devices.Cisco IOS XE has an elevation of privilege vulnerability that can be exploited by attackers to execute arbitrary commands as root...

npm-dependency-versio: Operating system command injection vulnerability

npm-dependency-versions is a dependency plugin for nmap. npm-dependency-versions is vulnerable to a command injection vulnerability that can be exploited by attackers to cause arbitrary command execution...

PT-2022-2372

Name of the Vulnerable Software and Affected Versions Git for Windows versions prior to 2.35.2 Git versions prior to the fix for this issue, exact version not specified Description The issue is related to the possibility of creating a .git folder in a shared location, which could be exploited by ...

PT-2022-3217

Name of the Vulnerable Software and Affected Versions D-Link DSL-G2452DG version ME 2.00 Description The issue is related to insecure permissions in the implementation of the execute cmd.cgi script in the D-Link DSL-G2452DG router's firmware. This could allow an attacker to execute arbitrary...

ASUS RT-AC86U security vulnerabilities

The ASUS RT-AC86U is a dual-band Wi-Fi router from the Chinese company ASUS. The ASUS RT-AC86U suffers from a command injection vulnerability that can be exploited by an attacker to execute arbitrary commands and interrupt or terminate services...

[ASA-202204-7] gzip: arbitrary command execution

Arch Linux Security Advisory ASA-202204-7 ========================================= Severity: High Date : 2022-04-07 CVE-ID : CVE-2022-1271 Package : gzip Type : arbitrary command execution Remote : No Link : https://security.archlinux.org/AVG-2666 Summary ======= The package gzip before version...

CAMS Emergency Message System Arbitrary Command Execution

The vulnerability of the centralized system for managing emergency messages and events in CAMS for HIS distributed control systems CENTUM VP and CENTUM VP Entry Class, along with the OPC-server Exaopc, is related to authentication process flaws. Exploiting this vulnerability could allow attackers...

TP-Link TL-WR840N Router Command Execution

The vulnerability of the utilexecSystem function in the libcmm.so module of the TP-Link TL-WR840N ES router’s software lies in the lack of measures taken to neutralize special elements used in the operating system commands. Exploiting this vulnerability can allow an attacker to execute arbitrary...

HTTP-demon Wi-Fi Router Command Execution

The vulnerability of the HTTP daemon of the microprogrammed Wi-Fi router devices ZyXEL NBG6816 Armor Z1 and NBG6817 Armor Z2 is related to the manipulation of inter-site requests. Exploiting this vulnerability allows a perpetrator to execute arbitrary commands using specially created malware...

CVE-2021-24009: Improper Neutralization of Special Elements used in an OS Command

Multiple improper neutralization of special elements used in an OS command vulnerabilities CWE-78 in the Web GUI of FortiWAN before 4.5.9 may allow an authenticated attacker to execute arbitrary commands on the underlying system's shell via specifically crafted HTTP requests...

PT-2022-3813

Name of the Vulnerable Software and Affected Versions Fujitsu ETERNUS CentricStor CS8000 Control Center versions prior to 8.1A SP02 P04 Description The issue resides in the requestTempFile function in hw view.php, allowing an attacker to influence the unitName POST parameter and inject special...

PT-2022-8600

Name of the Vulnerable Software and Affected Versions Jeesite version 1.2.7 Description The issue is related to the use of an affected version of Apache Shiro, which contains a Java deserialization vulnerability. This vulnerability can be exploited by an attacker to execute arbitrary commands via...

CVE-2022-24803

Asciidoctor-include-ext is Asciidoctor’s standard include processor reimplemented as an extension. Versions prior to 0.4.0, when used to render user-supplied input in AsciiDoc markup, may allow an attacker to execute arbitrary system commands on the host operating system. This attack is possible...

CVE-2022-22986

Netcommunity OG410X and OG810X series Netcommunity OG410Xa, OG410Xi, OG810Xa, and OG810Xi firmware Ver.2.28 and earlier allow an attacker on the adjacent network to execute an arbitrary OS command via a specially crafted config file...