CVE-2024-35059

CVE-2024-35059 affects NASA AIT-Core v2.5.2 and its Pickle-based processing. Red Hat entries describe an unencrypted network channel enabling a man-in-the-middle, which when chained with CVE-2024-35059 results in unauthenticated, fully remote code execution. The core issue is the use of Pickle wi...

Adobe Dreamweaver OS Command Injection Vulnerability

Adobe Dreamweaver is the United States of America Odooby Adobe company a Windows-based platform to support visual HTML editing and code editing software. An operating system command injection vulnerability exists in Adobe Dreamweaver Desktop prior to version 21.3, which can be exploited by an...

The software of the centralized data storage system management center of Dell Technologies PowerProtect Data Domain Management Center is vulnerable, allowing a intruder to execute arbitrary OS commands.

The software of the Dell Technologies PowerProtect Data Domain Management Center has a vulnerability due to the lack of measures taken to neutralize special elements used in the operating system’s command set. Exploiting this vulnerability can allow an attacker to execute arbitrary OS commands...

Exploit for CVE-2024-29895

CVE-2024-29895 - RCE ON CACTI !WARNING This is an edu...

The vulnerability in the web interface of the operating system administrator FortiOS allows a perpetrator to execute arbitrary commands.

The vulnerability in the Windows operating system’s administrator web interface, FortiOS.sv, relates to operations that go beyond buffer boundaries in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands by sending specially crafted HTTP or HTTPS requests...

The vulnerability of the FortiOS operating systems, related to a memory reclamation error, allows a perpetrator to execute arbitrary commands.

The vulnerability of the FortiOS operating systems is related to a memory reclamation error. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

cri-o: Arbitrary command injection via pod annotation

A flaw was found in cri-o, where an arbitrary systemd property can be injected via a Pod annotation. Any user who can create a pod with an arbitrary annotation may perform an arbitrary action on the host system...

VulnCheck KEV: CVE-2023-50358

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network...

IBM AIX 安全漏洞

IBM AIX is an open standards-based UNIX operating system developed for the IBM Power architecture by International Business Machines IBM. A security vulnerability exists in IBM AIX version 7.2, 7.3, VIOS version 3.1, and VIOS version 4.1. An attacker could exploit this vulnerability to execute...

LlamaIndex Code Injection Vulnerability

LlamaIndex is a data framework for LLM applications by the individual developer Jerry Liu. A code injection vulnerability exists in LlamaIndex version 0.9.47, which stems from improper use of the eval function and allows a malicious or compromised LLM hosting provider to execute arbitrary command...

Huawei EulerOS: Security Advisory for util-linux (EulerOS-SA-2024-1668)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

AIX is vulnerable to arbitrary command execution due to invscout (CVE-2024-27260)

IBM SECURITY ADVISORY First Issued: Wed May 15 17:28:09 CDT 2024 The most recent version of this document is available here: https://aix.software.ibm.com/aix/efixes/security/invscoutadvisory6.asc Security Bulletin: AIX is vulnerable to arbitrary command execution due to invscout CVE-2024-27260...

Fortinet FortiProxy Command Execution Vulnerability (CNVD-2024-26504)

Fortinet FortiProxy is a secure network proxy from Fortinet that protects employees from cyberattacks by combining multiple detection technologies such as Web filtering, DNS filtering, DLP, anti-virus, intrusion prevention, and advanced threat protection.FortiProxy helps reduce bandwidth...

The vulnerability of the text terminal utility for UNIX-like systems, Less, is related to the lack of measures taken to neutralize special elements, allowing attackers to execute arbitrary commands.

The vulnerability of the text terminal utility for UNIX-like systems is related to incorrect handling of quotes in the file filename.c. Exploiting this vulnerability allows an attacker to execute arbitrary commands...

IBM Security Guardium 操作系统命令注入漏洞

IBM Security Guardium is a suite of platforms from International Business Machines IBM that provide data protection capabilities. The platform includes features such as custom UI, report management and streamlined audit process building. IBM Security Guardium suffers from an operating system...

TOTOLINK X5000R 安全漏洞

The TOTOLINK X5000R is a router from China's Gion Electronics TOTOLINK. A command injection vulnerability exists in the TOTOLINK X5000R timeout parameter, which originates from the failure of the timeout parameter of /cgi-bin/cstecgi.cgi to properly filter constructed command special characters,...

TOTOLINK X5000R 安全漏洞

The TOTOLINK X5000R is a router from China's Gion Electronics TOTOLINK. A command injection vulnerability exists in the TOTOLINK X5000R password parameter, which originates from the password parameter of /cgi-bin/cstecgi.cgi failing to properly filter constructed command special characters,...

PT-2024-24109 · Hewlett Packard +1 · Aos-8 Instant/Aos-10 Ap +4

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: Multiple authenticated command injection vulnerabilities exist in the command line interface. Successful exploitation of these vulnerabilities results i...

CVE-2024-35205

The WPS Office aka cn.wps.mofficeeng application before 17.0.0 for Android fails to properly sanitize file names before processing them through external application interactions, leading to a form of path traversal. This potentially enables any application to dispatch a crafted library file, aimi...

The vulnerability of the hnap_main() function in D-Link DIR-845L router microprogramming software allows a hacker to bypass security restrictions and execute arbitrary commands.

The vulnerability of the hnapmain function in D-Link DIR-845L router microprogramming software arises from the lack of measures taken to neutralize special elements used in the operating system’s command for processing the SOAP request purenetworks.com/HNAP1/GetDeviceSettings. Exploiting this...