CVE-2021-21867: Deserialization of Untrusted Data

An unsafe deserialization vulnerability exists in the ObjectManager.plugin ObjectStream.ProfileByteArray functionality of CODESYS GmbH CODESYS Development System 3.5.16 and 3.5.17. A specially crafted file can lead to arbitrary command execution. An attacker can provide a malicious file to trigge...

Github Diez command injection vulnerability

Github diez is an open source developer toolkit for building and maintaining design tokens at scale. Github diez suffers from a command injection vulnerability that arises from a networked system or product that does not properly filter special characters, commands, etc. from external input data...

CVE-2021-32826

Proxyee-Down is open source proxy software. An attacker being able to provide an extension script eg: through a MiTM attack or by hosting a malicious extension may be able to run arbitrary commands on the system running Proxyee-Down. For more details including a PoC see the referenced...

CVE-2021-35395

Realtek Jungle SDK version v2.x up to v3.4.14B provides an HTTP web server exposing a management interface that can be used to configure the access point. Two versions of this management interface exists: one based on Go-Ahead named webs and another based on Boa named boa. Both of them are affect...

Stack overflow

Realtek Jungle SDK version v2.x up to v3.4.14B provides an HTTP web server exposing a management interface that can be used to configure the access point. Two versions of this management interface exists: one based on Go-Ahead named webs and another based on Boa named boa. Both of them are affect...

Command injection

Realtek Jungle SDK version v2.x up to v3.4.14B provides a diagnostic tool called 'MP Daemon' that is usually compiled as 'UDPServer' binary. The binary is affected by multiple memory corruption vulnerabilities and an arbitrary command injection vulnerability that can be exploited by remote...

CVE-2021-35395

Realtek Jungle SDK version v2.x up to v3.4.14B provides an HTTP web server exposing a management interface that can be used to configure the access point. Two versions of this management interface exists: one based on Go-Ahead named webs and another based on Boa named boa. Both of them are affect...

CVE-2021-35395

Realtek Jungle SDK (Realtek AP-Router/IoT SDK) CVE-2021-35395 enables multiple stack-buffer overflows and command-injection flaws in the HTTP web server management interface (Go-Ahead webs and Boa-based). Affected forms include reboot, WSC/auth, WLANMultiAP, SiteSurvey, StaticDHCP, and peerPin-ba...

UBUNTU-CVE-2021-23422

This affects the package bikeshed before 3.0.0. This can occur when an untrusted source file containing Inline Tag Command metadata is processed. When an arbitrary OS command is executed, the command output would be included in the HTML output...

D-Link DSL-2750U: Operating System Command Injection Vulnerability

The D-Link DSL-2750U is a wireless N 300 ADSL2 modem router. an OS command injection vulnerability exists in the D-Link DSL-2750U ME1.16 and earlier versions. An attacker could exploit this vulnerability in combination with other vulnerabilities to execute arbitrary OS commands...

CVE-2021-35395

Realtek Jungle SDK version v2.x up to v3.4.14B provides an HTTP web server exposing a management interface that can be used to configure the access point. Two versions of this management interface exists: one based on Go-Ahead named webs and another based on Boa named boa. Both of them are affect...

PT-2021-14008

Name of the Vulnerable Software and Affected Versions: IBM Maximo Asset Management versions 7.6.0 through 7.6.1 Description: The issue is caused by improper validation of csv file contents, allowing a remote attacker to execute arbitrary commands on the system. This is a result of a CSV Injection...

CVE-2021-20509: Improper Neutralization of Special Elements in Output Used by a Downstream Component

IBM Maximo Asset Management 7.6.0 and 7.6.1 is potentially vulnerable to CSV Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 198243...

CVE-2021-23420

CVE-2021-23420 affects codeception/codeception (versions 4.0.0–4.1.21 and 3.0.x–3.1.2 are implied by the version bounds) where the RunProcess class can be used as a gadget to execute arbitrary commands during deserialization of unvalidated user input. This is a deserialization vulnerability in th...

PT-2021-15508

Name of the Vulnerable Software and Affected Versions codeception/codeception versions 4.0.0 through 4.1.21 codeception/codeception versions prior to 3.1.3 Description The issue affects systems that deserialize user input without validation, allowing the RunProcess class to be leveraged as a gadg...

PT-2021-10702

Name of the Vulnerable Software and Affected Versions: NewsOne CMS version 1.1.0 Description: The issue allows attackers to upload arbitrary files, potentially leading to webshell uploads and the execution of arbitrary commands. This is due to a vulnerability in the file upload component,...

CTparental path traversal vulnerability

CTparental is a tool for filtering web content. Inappropriate content can be filtered using blacklists or whitelists, the time spent browsing the Internet can be controlled and the active time of the control device can be controlled. CTparental suffers from a path traversal vulnerability that ste...

CVE-2021-37214

CVE-2021-37214 affects Flygo's employee management page. It is an Insecure Direct Object Reference (IDOR ) vulnerability allowing an authenticated general user to alter the employee ID parameter to access/modify other employees’ data, escalate to administrator privileges, and execute arbitrary co...

CVE-2021-37214 Larvata Digital Technology Co. Ltd. FLYGO - Use of Incorrectly-Resolved Name or Reference-3

The employee management page of Flygo contains Insecure Direct Object Reference IDOR vulnerability. After being authenticated as a general user, remote attackers can manipulate the employee ID in specific parameters to arbitrary access employee's data, modify it, and then obtain administrator...

CVE-2021-37214: Use of Incorrectly-Resolved Name or Reference

The employee management page of Flygo contains Insecure Direct Object Reference IDOR vulnerability. After being authenticated as a general user, remote attackers can manipulate the employee ID in specific parameters to arbitrary access employee's data, modify it, and then obtain administrator...