CVE-2021-23258

Authenticated users with Administrator or Developer roles may execute OS commands by SPEL Expression in Spring beans. SPEL Expression does not have security restrictions, which will cause attackers to execute arbitrary commands remotely RCE...

Crafter CMS 访问控制错误漏洞

An access control error vulnerability exists in Crafter CMS, an open source content management system CMS for digital experience applications, which stems from a system that does not validate groovy scripts. An attacker with administrator, developer privileges could use the groovy lib to render...

CVE-2021-20864

Improper access control vulnerability in ELECOM routers WRC-1167GST2 firmware v1.25 and prior, WRC-1167GST2A firmware v1.25 and prior, WRC-1167GST2H firmware v1.25 and prior, WRC-2533GS2-B firmware v1.52 and prior, WRC-2533GS2-W firmware v1.52 and prior, WRC-1750GS firmware v1.03 and prior,...

CVE-2021-20852

Buffer overflow vulnerability in ELECOM LAN routers WRH-733GBK firmware v1.02.9 and prior and WRH-733GWH firmware v1.02.9 and prior allows a network-adjacent attacker with an administrator privilege to execute an arbitrary OS command via unspecified vectors...

CVE-2021-20854

ELECOM LAN routers WRH-733GBK firmware v1.02.9 and prior and WRH-733GWH firmware v1.02.9 and prior allows a network-adjacent attacker with an administrator privilege to execute arbitrary OS commands via unspecified vectors...

CVE-2021-20853

ELECOM LAN routers WRH-733GBK firmware v1.02.9 and prior and WRH-733GWH firmware v1.02.9 and prior allows a network-adjacent attacker with an administrator privilege to execute arbitrary OS commands via unspecified vectors...

The vulnerability of the ping and tracert commands implemented in the web interface for managing Netis WF2419 router microprogramming software allows a perpetrator to execute arbitrary commands and gain unauthorized access to protected information.

The vulnerability of the ping and tracert commands in the web interface for managing Netis WF2419 microprogramming devices relates to the lack of measures taken to neutralize specific elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands and gain...

The vulnerability of the Microsoft Outlook email client, related to incorrect handling of objects in memory, allows a hacker to bypass security restrictions and execute arbitrary commands.

The vulnerability of the Microsoft Outlook email client is related to incorrect handling of objects in memory. Exploiting this vulnerability can allow an attacker to bypass security restrictions and execute arbitrary commands...

CVE-2021-26612

An improper input validation leading to arbitrary file creation was discovered in copy method of Nexacro platform. Remote attackers use copy method to execute arbitrary command after the file creation included malicious code...

elecom lan 操作系统命令注入漏洞

elecom lan routers is a router from Elecom Japan. An operating system command injection vulnerability exists in elecom lan routers, which can be exploited by an attacker to execute arbitrary operating system commands via an unspecified vector...

baserCMS OS Command Injection Vulnerability

baserCMS is an enterprise content management system CMS from the baserCMS Basercms team. baserCMS's management system is vulnerable to operating system command injection, which could be exploited by an attacker with upload file privileges to upload crafted zip files that could execute arbitrary...

elecom lan 缓冲区错误漏洞

elecom lan routers is a router from Elecom Japan. A buffer overflow vulnerability exists in elecom lan routers, which can be exploited by an attacker to execute arbitrary operating system commands via an unspecified vector...

CSZ CMS SQL Injection (CVE-2020-21250)

An SQL injection vulnerability exists in CSZ CMS. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system...

Eufy Anker Eufy Homebase 操作系统命令注入漏洞

The Anker Eufy Homebase 2 is a wireless home security camera system from Eufy USA. The Anker Eufy Homebase 2 suffers from an operating system command injection vulnerability that can be exploited by an attacker to execute arbitrary commands via specially crafted network packets...

NET-SNMP Memory Corruption (CVE-2018-1000116)

A memory corruption vulnerability exists in NET-SNMP. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

CVE-2021-41243

There is a Potential Zip Slip Vulnerability and OS Command Injection Vulnerability on the management system of baserCMS. Users with permissions to upload files may upload crafted zip files which may execute arbitrary commands on the host operating system. This is a vulnerability that needs to be...

CVE-2021-41243

There is a Potential Zip Slip Vulnerability and OS Command Injection Vulnerability on the management system of baserCMS. Users with permissions to upload files may upload crafted zip files which may execute arbitrary commands on the host operating system. This is a vulnerability that needs to be...

Command injection

There is a Potential Zip Slip Vulnerability and OS Command Injection Vulnerability on the management system of baserCMS. Users with permissions to upload files may upload crafted zip files which may execute arbitrary commands on the host operating system. This is a vulnerability that needs to be...

CVE-2021-41243

CVE-2021-41243 affects baserCMS management system. Affected: baserCMS ≤ 4.5.3 (and related OSV/GHSA entries). Vulnerability: OS command injection and a Zip Slip-like issue where an uploaded crafted ZIP by users with file-upload privileges can cause arbitrary commands to run on the host; data expo...

CVE-2021-38685

A command injection vulnerability has been reported to affect QNAP device, VioStor. If exploited, this vulnerability allows remote attackers to run arbitrary commands. We have already fixed this vulnerability in the following versions of QVR: QVR FW 5.1.6 build 20211109 and later...