JVN#72801744: UNIVERGE WA Series vulnerable to OS command injection

Remote system maintenance feature of UNIVERGE WA series "Local maintenance console/Remote maintenance console/Web based remote console maintenance" contains an OS command injection vulnerability CWE-78. Impact If an attacker who can access the product sends specific character strings or a special...

NETGEAR Router Command Injection

The vulnerability of NETGEAR’s integrated routing software devices such as R7850, R7900P, R7960P, R8000, R8000P, RAX200, RAX75, RAX80, RBK752, RBK852, RBR750, RBR850, RBS750, and RBS850 lies in the lack of measures to sanitize input data. Exploiting this vulnerability allows a remote attacker to...

NETGEAR Router Command Injection

The vulnerability of NETGEAR R7900P, R7960P, R8000, R8000P, MR60, RAX20, RAX45, RAX80, MS60, RAX15, RAX50, and RAX75 router software lies in the lack of measures for cleaning input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

Arbitrary Command Injection

Overview @acrontum/filesystem-template is a Filesystem templating engine and project scaffolding tool Affected versions of this package are vulnerable to Arbitrary Command Injection due to the fetchRepo API missing sanitization of the href field of external input. PoC: js const filesys =...

Arbitrary Command Execution

Overview mc-kill-port is a package allowing termination of ports. Affected versions of this package are vulnerable to Arbitrary Command Execution via the kill function, due to missing sanitization of the port argument. PoC js const kill = require"mc-kill-port"; kill"abc|echo rce newFile.txt"...

VulnCheck KEV: CVE-2022-20700

A vulnerability in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code elevate privileges, execute arbitrary commands, bypass authentication and authorization protections, fetch and run unsigned software, or...

Remote Code Execution (RCE)

Overview ungit is a version control library. Affected versions of this package are vulnerable to Remote Code Execution RCE via argument injection. The issue occurs when calling the /api/fetch endpoint. User controlled values remote and ref are passed to the git fetch command. By injecting some gi...

Zyxel NWA-1100-NH command injection vulnerability

The Zyxel NWA-1100-NH is a remote Poe access point from China's Heqin Technology Zyxel. The Zyxel NWA-1100-NH suffers from a command injection vulnerability that originates in the web interface of the Zyxel NWA-1100-NH firmware that could allow an attacker to execute arbitrary operating system...

rubygem-rdoc: Command injection vulnerability in RDoc

An operating system command injection flaw was found in RDoc. Using the rdoc command to generate documentation for a malicious Ruby source code could lead to execution of arbitrary commands with the privileges of the user running rdoc...

CVE-2022-0764

Arbitrary Command Injection in GitHub repository strapi/strapi prior to 4.1.0...

CVE-2022-0764

Arbitrary Command Injection in GitHub repository strapi/strapi prior to 4.1.0...

CVE-2022-0764 Arbitrary Command Injection in strapi/strapi

Arbitrary Command Injection in GitHub repository strapi/strapi prior to 4.1.0...

CVE-2022-0764 Arbitrary Command Injection in strapi/strapi

Arbitrary Command Injection in GitHub repository strapi/strapi prior to 4.1.0...

CVE-2022-0764

Strapi (strapi/strapi) is affected by CVE-2022-0764: an OS command injection vulnerability in versions prior to 4.1.0 due to improper sanitization of user input when creating an app via the template CLI argument. Impact is arbitrary command execution with local access. Mitigation: update to 4.1.0...

Strapi security vulnerabilities

Strapi is an open source headless content management system CMS. Strapi is vulnerable to an operating system command injection vulnerability that originates from arbitrary command injection in the GitHub repository. No detailed vulnerability details are currently available...

CVE-2022-0764: Improper Neutralization of Special Elements used in an OS Command

Arbitrary Command Injection in GitHub repository strapi/strapi prior to 4.1.0...

PT-2022-12001

Name of the Vulnerable Software and Affected Versions C-DATA ONU4FERW version 2.1.13 X139 Description A command injection issue in the function formImportOMCIShell allows attackers to execute arbitrary commands via a crafted file. Recommendations For version 2.1.13 X139, consider disabling the...

DIR846 Firmware Arbitrary Command Execution

The vulnerability of the DIR846A1FW100A43.bin and DIR846enFW100A53DLA-Retail.bin microprogramming systems of D-Link DIR-846 routers is related to insufficient checking of arguments passed in commands. Exploiting this vulnerability can allow a malicious actor to execute arbitrary commands using a...

DIR846 Firmware Arbitrary Command Execution

The vulnerability of the DIR846A1FW100A43.bin and DIR846enFW100A53DLA-Retail.bin microprogramming systems of D-Link DIR-846 routers is related to insufficient checking of arguments passed in commands. Exploiting this vulnerability can allow a malicious actor to execute arbitrary commands using a...

TotoLink A800R: Operating System Command Injection Vulnerability

TOTOLink A860R is a wireless router from TotoLink, China.TOTOLink A860R V4.1.2cu.5182B20201027 is vulnerable to command injection, which can be exploited by attackers to execute arbitrary commands via the QUERYSTRING parameter...