HGiga iSherlock: Operating System Command Injection Vulnerability

HGiga iSherlock is a series of software products from China Henderson HGiga. HGiga iSherlock suffers from an operating system command injection vulnerability that originates from OS command injection, which could allow a remote unauthorized attacker to execute arbitrary system commands...

GHSA-HPQF-M68J-2PFX js-object-utilities Vulnerable to Prototype Pollution

Vulnerability type: Prototype Pollution Affected Package: Product: js-object-utilities Version: 2.2.0 Remedy: Update package to version 2.2.1. Vulnerability Locations: js at module.exports /nodemodules/js-object-utilities/dist/set.js:16:29 Description: The latest version of js-object-utilities...

CVE-2021-47667

An OS command injection vulnerability in lib/NSSDropoff.php in ZendTo 5.24-3 through 6.x before 6.10-7 allows unauthenticated remote attackers to execute arbitrary commands via shell metacharacters in the tmpname parameter when dropping off a file via a POST /dropoff request...

Dell EMC Data Domain Privilege Escalation

The vulnerability of the Dell EMC Data Domain Operating System DD OS is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to enhance their privileges and execute arbitrary commands remotely...

MariaDB sys_exec Command Execution

The vulnerability of the sysexec function in the MariaDB database management system is related to improper code generation. Exploiting this vulnerability allows an attacker to execute arbitrary commands with elevated privileges...

CVE-2021-47667

The CVE-2021-47667 vulnerability affects ZendTo (versions 5.24-3 through 6.x before 6.10-7). It is an OS command injection in lib/NSSDropoff.php that allows unauthenticated remote attackers to run arbitrary commands via shell metacharacters in the tmp_name parameter during a POST /dropoff. Impact...

CVE-2025-0415

A remote attacker with web administrator privileges can exploit the device’s web interface to execute arbitrary system commands through the NTP settings. Successful exploitation may result in the device entering an infinite reboot loop, leading to a total or partial denial of connectivity for...

PT-2025-30558

Уязвимость приложения для публикации директорий в домене share directory операционной системы РЕД ОС связана с небезопасным управлением привилегиями при запуске службы D-Bus. Эксплуатация уязвимости может позволить нарушителю повысить свои привилегии и выполнить произвольные команды...

CVE-2025-29987

Dell PowerProtect Data Domain with Data Domain Operating System DD OS versions prior to 8.3.0.15 contain an Insufficient Granularity of Access Control vulnerability. An authenticated user from a trusted remote client could exploit this vulnerability to execute arbitrary commands with root...

CVE-2025-29987

Dell PowerProtect Data Domain with DD OS prior to 8.3.0.15 is affected by an Insufficient Granularity of Access Control vulnerability. An authenticated user from a trusted remote client could execute arbitrary commands with root privileges due to limited access-control granularity. The PT-2025-14...

Dell Unity OS Command Injection Vulnerability (CNVD-2025-06614)

Dell Unity is a set of virtual Unity storage environments from Dell USA. An OS command injection vulnerability exists in Dell Unity 5.4 and earlier versions, which can be exploited by an attacker to execute arbitrary operating system commands on the system...

Dell PowerProtect Data Domain security vulnerabilities

Dell PowerProtect Data Domain is a data protection storage appliance from Dell Technologies, built on the Data Domain platform and designed for building a resilient foundation for networks and enabling rapid data recovery. An access control vulnerability exists in Dell PowerProtect Data Domain,...

Dell Unity OS Command Injection Vulnerability (CNVD-2025-06612)

Dell Unity is a set of virtual Unity storage environments from Dell USA. An OS command injection vulnerability exists in Dell Unity 5.4 and earlier versions, which can be exploited by an attacker to execute arbitrary operating system commands on the system...

CVE-2025-30004

Xorcom CompletePBX is vulnerable to command injection in the administrator Task Scheduler functionality, allowing for attackers to execute arbitrary commands as the root user. This issue affects CompletePBX: all versions up to and prior to 5.2.35...

CVE-2025-2071

A critical OS Command Injection vulnerability has been identified in the FAST LTA Silent Brick WebUI, allowing remote attackers to execute arbitrary operating system commands via specially crafted input. This vulnerability arises due to improper handling of untrusted input, which is passed direct...

CVE-2025-0415

A remote attacker with web administrator privileges can exploit the device’s web interface to execute arbitrary system commands through the NTP settings. Successful exploitation may result in the device entering an infinite reboot loop, leading to a total or partial denial of connectivity for...

DEBIAN-CVE-2024-36465

A low privilege regular Zabbix user with API access can use SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL commands via the groupBy parameter...

CVE-2025-22941

A command injection vulnerability in the web interface of Adtran 411 ONT L80.00.0011.M2 allows attackers to escalate privileges to root and execute arbitrary commands...

Zabbix SQL injection vulnerability

Zabbix is an open source monitoring system from Zabbix. The system supports network monitoring, server monitoring, cloud monitoring and application monitoring. A security vulnerability exists in Zabbix that stems from SQL injection in the API service, which could lead to execution of arbitrary SQ...

MOXA EDR-810: Operating System Command Injection Vulnerability

MOXA EDR-810 is a secure router from China's MOXA MOXA. The MOXA EDR-810 suffers from a security vulnerability that originates from the NTP settings in the device's web interface, which could lead to the execution of arbitrary system commands and an infinite reboot loop by a remote attacker...