18164 matches found
OpenNMS Horizon Authenticated RCE
This module exploits built-in functionality in OpenNMS Horizon in order to execute arbitrary commands as the opennms user. For versions 32.0.2 and higher, this module requires valid credentials for a user with ROLEFILESYSTEMEDITOR privileges and either ROLEADMIN or ROLEREST. For versions 32.0.1 a...
Improper Neutralization of Special Elements used in a Command
Overview node-qpdf is an A Content Preserving transformations on PDFs wrapped around QPDF Affected versions of this package are vulnerable to Improper Neutralization of Special Elements used in a Command such that the package-exported method encrypt fails to sanitize its parameter input, which...
The vulnerability in the FortiADC Manager web management tool, a controller for FortiADC applications, allows a attacker to execute arbitrary commands with root privileges.
The vulnerability of the FortiADC Manager web management tool, a controller for FortiADC application delivery, is related to the failure to remove special elements used in the operating system’s command set. Exploiting this vulnerability can allow an attacker to execute arbitrary commands with ro...
Binary Vulnerability in Magic R365 of Xinhua San Technologies Limited (CNVD-2023-62724)
The Magic R365 is a full gigabit wireless router. A binary vulnerability exists in the Magic R365 from Xinhua San Technologies, which can be exploited by attackers to execute arbitrary commands...
The vulnerability of the command-line interface (CLI) of the FortiADC application controller allows a attacker to execute arbitrary commands.
The vulnerability of the command-line interface CLI of the FortiADC application controller is related to the lack of measures taken to neutralize special elements used in operating system commands. Exploiting this vulnerability allows an attacker to execute arbitrary commands...
CVE-2023-37237
In Veritas NetBackup Appliance before 4.1.0.1 MR3, insecure permissions may allow an authenticated Admin to bypass shell restrictions and execute arbitrary operating system commands via SSH...
CVE-2023-37237
In Veritas NetBackup Appliance before 4.1.0.1 MR3, insecure permissions may allow an authenticated Admin to bypass shell restrictions and execute arbitrary operating system commands via SSH...
PT-2023-25845 · Veritas · Veritas Netbackup Appliance
Name of the Vulnerable Software and Affected Versions: Veritas NetBackup Appliance versions prior to 4.1.0.1 MR3 Description: The issue allows an authenticated Admin to bypass shell restrictions and execute arbitrary operating system commands via SSH due to insecure permissions. Recommendations:...
Cross-Site Scripting (XSS)
gitlab is vulnerable to Cross-Site Scripting XSS. The vulnerability exists because the inaccurate display of Snippet files containing special characters, which allows an attacker to create Snippets with misleading content that could potentially trick unsuspecting users into executing arbitrary...
CVE-2023-33567
CVE-2023-33567 is rejected/not used; this CVE ID does not represent an active vulnerability entry.
CVE-2023-30261
Command Injection vulnerability in OpenWB 1.6 and 1.7 allows remote attackers to run arbitrary commands via crafted GET request...
The vulnerability of the corporate VPN application GlobalProtect Agent, related to errors in processing input data, allows a hacker to execute arbitrary commands with elevated privileges.
The vulnerability of the corporate VPN application GlobalProtect Agent is related to errors in processing input data. Exploiting this vulnerability allows an attacker to execute arbitrary commands with elevated privileges...
openWB 操作系统命令注入漏洞
openWB is an open source application from snaptec. A security vulnerability exists in OpenWB versions 1.6 and 1.7 that stems from the presence of a command injection vulnerability. An attacker exploits this vulnerability to run arbitrary commands by constructing a GET request...
CVE-2023-30261
OpenWB CVE-2023-30261 affects OpenWB versions 1.6 and 1.7. The vulnerability is a command injection via crafted GET requests that could allow remote attackers to execute arbitrary commands with high impact (per the record: CVSS v3.1 base score 9.8, CRITICAL, network attack vector, no user interac...
CVE-2023-30261
Command Injection vulnerability in OpenWB 1.6 and 1.7 allows remote attackers to run arbitrary commands via crafted GET request...
MagnusBilling application unauthenticated Remote Command Execution.
A Command Injection vulnerability in MagnusBilling application 6.x and 7.x allows remote attackers to run arbitrary commands via unauthenticated HTTP request. A piece of demonstration code is present in lib/icepay/icepay.php, with a call to an exec. The parameter to exec includes the GET paramete...
GHSA-HHQM-F4M4-PQ39 RaspAP raspap-webgui Command Injection vulnerability
Command injection vulnerability in RaspAP raspap-webgui 2.8.8 and earlier allows remote attackers to run arbitrary commands via crafted POST request to hostapd settings form...
CVE-2023-30258
Command Injection vulnerability in MagnusSolution magnusbilling 6.x and 7.x allows remote attackers to run arbitrary commands via unauthenticated HTTP request...
