D-Link DIR882 Command Injection (CVE-2022-28895; CVE-2022-28896)

A command injection vulnerability exists in D-Link DIR882. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

PT-2022-24131 · Aruba · Arubaos

Name of the Vulnerable Software and Affected Versions: ArubaOS affected versions not specified Description: The issue concerns authenticated command injection vulnerabilities in the ArubaOS command line interface. Successful exploitation of these vulnerabilities results in the ability to execute...

CVE-2022-22425

IBM InfoSphere Information Server 11.7 is identified as potentially vulnerable to CSV Injection due to improper validation of CSV file contents. The vulnerability could allow a remote attacker to execute arbitrary commands on the system; CVSS metrics in public records indicate a high impact (C, I...

The vulnerability of the D-Link DSL-2750B router’s microprogramming software lies in the lack of measures taken to clean data at the control level, allowing attackers to execute arbitrary commands.

The vulnerability of the D-Link DSL-2750B router’s microprogramming software is related to the lack of measures taken to clean data at the control level. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands through the login.cgi parameter...

CVE-2022-40741

Mail SQR Expert’s specific function has insufficient filtering for special characters. An unauthenticated remote attacker can exploit this vulnerability to perform arbitrary system command and disrupt service...

Command injection

Mail SQR Expert’s specific function has insufficient filtering for special characters. An unauthenticated remote attacker can exploit this vulnerability to perform arbitrary system command and disrupt service...

VMware Cloud Foundation XStream Deserialization

Added: 10/31/2022 Background VMware Cloud Foundation is a hybrid cloud platform. Problem An XStream deserialization vulnerability in the NSM Manager component of VMware Cloud Foundation NSX-V allows a remote attacker to execute arbitrary commands. Resolution Apply the patch referenced in...

PT-2022-25503 · Unknown · Mail Sqr Expert

Name of the Vulnerable Software and Affected Versions: Mail SQR Expert affected versions not specified Description: The issue is related to insufficient filtering for special characters in a specific function of Mail SQR Expert. This allows an unauthenticated remote attacker to exploit the issue...

The vulnerability of the Fortinet FortiClient for Mac security tool arises from the lack of measures taken to neutralize special elements used in the operating system’s command set. This allows attackers to bypass security restrictions and execute arbitrary commands.

The vulnerability of the Fortinet FortiClient for Mac protection tool is related to the lack of measures taken to neutralize special elements used in the operating system’s command set. Exploiting this vulnerability allows an attacker to bypass security restrictions and execute arbitrary commands...

Snapt Aria Command Injection (CVE-2022-24237)

A command injection vulnerability exists in Snapt Aria. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

VMware Cloud Foundation XStream Deserialization

Added: 10/31/2022 Background VMware Cloud Foundation is a hybrid cloud platform. Problem An XStream deserialization vulnerability in the NSM Manager component of VMware Cloud Foundation NSX-V allows a remote attacker to execute arbitrary commands. Resolution Apply the patch referenced in...

Design/Logic Flaw

A vulnerability in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands o...

CVE-2022-37915

A vulnerability in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands o...

CVE-2022-37915

A vulnerability in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands o...

CVE-2022-37915

CVE-2022-37915 affects Aruba EdgeConnect Enterprise Orchestrator 9.1.x prior to 9.1.3.40197. The vulnerability arises from inadequate access control in the web-based management interface, allowing an unauthenticated remote attacker to run arbitrary commands on the underlying host and potentially ...

Security Bulletin: Multiple Vulnerabilities in base image packages affect IBM Voice Gateway

Summary Security Vulnerabilities in base image packages affect IBM Voice Gateway. Vulnerability Details CVEID:CVE-2022-34903 DESCRIPTION: GnuPG could allow a remote attacker to conduct spoofing attacks, caused by a flaw when processing secret-key information from keyring. By sending a...

Joomla! SQL Injection (CVE-2018-8045)

An SQL injection vulnerability exists in Joomla!. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system...

SolarWinds Orion Platform < 2022.4 Multiple Vulnerabilities

The version of SolarWinds Orion Platform installed on the remote host is prior to 2022.4. It is, therefore, affected by multiple vulnerabilities as referenced in the solarwindsplatform20224 advisory: - SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerabilit...

CVE-2022-29889

A hard-coded password vulnerability exists in the telnet functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z. Use of a hard-coded root password can lead to arbitrary command execution. An attacker can authenticate with hard-coded credentials to trigger this vulnerability...

CVE-2022-38108

SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to SolarWinds Web Console to execute arbitrary commands...