Mageia: Security Advisory (MGASA-2024-0327)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CLSA-2024-1728056367 Fix CVE(s): CVE-2024-32465

SECURITY UPDATE: Bypass of protections in untrusted repositories - debian/patches/CVE-2024-32465.patch: Disable lazy-fetching by default in upload-pack to prevent arbitrary command execution during clone/fetch - CVE-2024-32465...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to an arbitrary command execution in OpenSSH [CVE-2023-51385]

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to an arbitrary command execution in OpenSSH, caused by improper validation of shell metacharacters CVE-2023-51385. OpenSSH is included as a Base OS package used by our service runtimes. This vulnerabilitiy has...

The vulnerability of the CLI interface of ArubaOS operating systems allows a perpetrator to execute arbitrary commands.

The vulnerability of the CLI interface of ArubaOS operating systems is related to the lack of measures taken to neutralize special elements used in operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

CVE-2024-20432

A vulnerability in the REST API and web UI of Cisco Nexus Dashboard Fabric Controller NDFC could allow an authenticated, low-privileged, remote attacker to perform a command injection attack against an affected device. This vulnerability is due to improper user authorization and insufficient...

The vulnerability of the gena.cgi file in D-Link DIR-860L router microprogramming software allows a hacker to cause a service failure or execute arbitrary commands.

The vulnerability of the gena.cgi file of the D-Link DIR-860L router’s microprogramming system lies in the copying of buffers without checking the size of the input data. Exploiting this vulnerability can allow an attacker to cause service failures or execute arbitrary commands using a specially...

Synology DiskStation Manager Improper Neutralization of Special Elements used in a Command (CVE-2017-12075)

Command injection vulnerability in EZ-Internet in Synology DiskStation Manager DSM before 6.2-23739 allows remote authenticated users to execute arbitrary command via the username parameter. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more...

The vulnerability of the FUN_00415aa4() function (/usr/sbin/shttpd) of the TOTOLINK X6000R router software allows a attacker to execute arbitrary commands.

The vulnerability of the FUN00415aa4 function /usr/sbin/shttpd of the TOTOLINK X6000R router operating system is related to the lack of measures taken to clean data at the management level. Exploiting this vulnerability can allow a remote attacker to execute arbitrary commands using a specially...

Atos Eviden iCare 安全漏洞

Atos Eviden iCare is a smart card application from Atos France. A security vulnerability exists in Atos Eviden iCare versions 2.7.1 through 2.7.11, which originated from a vulnerability that allows an attacker to execute arbitrary commands with system privileges on an endpoint hosting the...

The vulnerability of the cgi_FMT_R12R5_1st_DiskMGR() function (/cgi-bin/hd_config.cgi) in the D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05, and DNS-1550-04 devices allows a attacker to execute arbitrary commands.

The vulnerability of the cgiFMTR12R51stDiskMGR function /cgi-bin/hdconfig.cgi in the D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05, and DNS-1550-04...

[SECURITY] [DLA 3905-1] cups-filters security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3905-1 [email protected] https://www.debian.org/lts/security/ Thorsten Alteholz September 29, 2024 https://wiki.debian.org/LTS -...

[SECURITY] [DSA 5778-1] cups-filters security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5778-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso September 29, 2024 https://www.debian.org/security/faq -...

Arbitrary Command Execution

cups is vulnerable to Arbitrary Command Execution. The libppd function ppdCreatePPDFromIPP2 does not sanitize IPP attributes when creating the PPD buffer. When used in combination with other functions such as cfGetPrinterAttributes5, can result in user controlled input and ultimately code executi...

CUPS cups-filters command injection vulnerability

CUPS is a standards-based open source printing system. A command injection vulnerability exists in CUPS cups-filters, which can be exploited by an attacker to inject and execute arbitrary commands on the system...

PT-2024-6501

Name of the Vulnerable Software and Affected Versions cups versions prior to 2.4.11-alt1 cups-browsed versions prior to 2.0.1-0ubuntu2.1 cups-filters affected versions not specified Description The Common UNIX Printing System CUPS and related components, including cups-browsed and cups-filters, a...

IBM ManageIQ 代码问题漏洞

IBM ManageIQ is an open source cloud management platform from International Business Machines IBM. A code issue vulnerability exists in IBM ManageIQ that stems from allowing a remotely authenticated attacker to execute arbitrary commands on the system by sending a specially constructed request fo...

PT-2024-7029 · D Link · D-Link Dir-878 +1

Name of the Vulnerable Software and Affected Versions: D-Link DIR-882 versions FW130B06 D-Link DIR-878 versions FW130B08 Description: A command injection issue exists in the SetMACFilters2 function due to insufficient neutralization of special elements used in an OS command. This allows attackers...

PT-2024-31207 · Gigastone · Gigastone Tr1 Travel Router R101

Name of the Vulnerable Software and Affected Versions: Gigastone TR1 Travel Router R101 version 1.0.2 Description: The issue allows an authenticated attacker to execute arbitrary commands on the device by sending a crafted HTTP request to the ssid parameter in the request. This enables the attack...

DedeCMS Command Injection Vulnerability

DedeCMS Dream Weaving Content Management System is a PHP-based open source content management system CMS. The system has content publishing, content management, content editing and content retrieval functions. DedeCMS has a command injection vulnerability that stems from the articlestringmix.php...

The vulnerability of the msp_info_htm function in D-Link DI-8300 router microprogramming software allows a hacker to execute arbitrary commands.

The vulnerability of the mspinfohtm function in D-Link DI-8300 router microprogramming software is related to incorrect code generation. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands using the GET request...