CVE-2023-24333

A stack overflow vulnerability in Tenda AC21 with firmware version USAC21V1.0reV16.03.08.15cnTDC01 allows attackers to run arbitrary commands via crafted POST request to /goform/openSchedWifi...

CVE-2023-24334

The set of sources confirms a stack overflow vulnerability in Tenda AC23 routers (firmware US_AC23V1.0re_V16.03.07.45_cn_TDC01). The flaw is triggered via the schedStartTime parameter, enabling an attacker to run arbitrary commands. Affected component: likely the device’s input handling surroundi...

D-Link DIR-816 Security Vulnerability

The D-Link DIR-816 is a wireless router from China-based AUO D-Link. A security vulnerability exists in the D-Link DIR-816 DIR-816A2v1.10CNB04 firmware version, which originated from allowing an attacker to run arbitrary commands via the urlAdd parameter...

CVE-2023-24332

A stack overflow vulnerability in Tenda AC6 with firmware version USAC6V5.0reV03.03.02.01cnTDC01 allows attackers to run arbitrary commands via crafted POST request to /goform/PowerSaveSet...

CVE-2023-24333

A stack overflow vulnerability in Tenda AC21 with firmware version USAC21V1.0reV16.03.08.15cnTDC01 allows attackers to run arbitrary commands via crafted POST request to /goform/openSchedWifi...

CVE-2022-48624

A flaw was found in less. The closealtfile function in filename.c omits shellquote calls for LESSCLOSE, a command line to invoke the optional input postprocessor. This issue could lead to an OS command injection vulnerability and arbitrary command execution on the host operating system...

The server for managing Fortinet FortiClient Enterprise Management Server (EMS) is vulnerable due to insecure privilege management, allowing attackers to execute arbitrary commands.

The vulnerability of the Fortinet FortiClient Enterprise Management Server EMS server relates to insecure management of privileges. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands using specially crafted HTTP or HTTPS requests...

CVE-2024-1297 Loomio 2.22.0 - Code injection

Loomio version 2.22.0 allows executing arbitrary commands on the server. This is possible because the application is vulnerable to OS Command Injection...

Dell Unity Command Injection Vulnerability (CNVD-2024-09162)

Dell Unity is a unified hybrid storage array for general purpose workloads both locally and in the cloud. A command injection vulnerability exists in Dell Unity, which can be exploited by a local attacker to execute arbitrary operating system commands on the application's underlying operating...

PT-2024-18199 · Unknown · Torrentpier

Name of the Vulnerable Software and Affected Versions: Torrentpier version 2.4.1 Description: The issue allows executing arbitrary commands on the server due to the application being vulnerable to insecure deserialization. Recommendations: For Torrentpier version 2.4.1, as a temporary workaround,...

PT-2024-4011 · Less +9 · Less +9

Name of the Vulnerable Software and Affected Versions: less versions prior to 606 Description: The issue is related to the close altfile function in filename.c, which omits shell quote calls for LESSCLOSE. This can allow an attacker to execute arbitrary commands. Recommendations: For versions pri...

CVE-2024-25413

A XSLT Server Side injection vulnerability in the Import Jobs function of FireBear Improved Import And Export v3.8.6 allows attackers to execute arbitrary commands via a crafted XSLT file...

CVE-2024-21782 BIG-IP and BIG-IQ secure copy vulnerability

BIG-IP or BIG-IQ Resource Administrators and Certificate Managers who have access to the secure copy scp utility but do not have access to Advanced shell bash can execute arbitrary commands with a specially crafted command string. This vulnerability is due to an incomplete fix for CVE-2020-5873...

Vulnerability of QuTS hero, QTS, and QuTScloud network devices: commands that allow attackers to execute arbitrary commands

The vulnerability of the QuTS hero, QTS, and QuTScloud network devices from operating systems is related to the possibility of executing commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

F5 BIG-IP and F5 BIG-IQ Security Vulnerabilities

F5 BIG-IP and F5 BIG-IQ are both products of F5 Corporation, U.S.A. F5 BIG-IP is an application delivery platform that integrates network traffic management, application security management, load balancing, etc. F5 BIG-IQ is a software-based cloud management solution. The solution supports the...

SAP IDES 操作系统命令注入漏洞

SAP IDES Systems is an interactive presentation and education system from SAP. A security vulnerability exists in SAP IDES Systems, which can be exploited by a remote attacker to submit a special request that can inject code to execute arbitrary code in the context of the application...

Arbitrary Command Injection

clamav is vulnerable to Arbitrary Command Injection. The vulnerability is due to unsafe handling of file names within the VirusEvent feature of ClamAV and the application fails to properly sanitize file names provided to this feature, allowing for the injection of arbitrary command-line sequences...

VulnCheck KEV: CVE-2023-7311

BYTEVALUE Intelligent Flow Control Router contains a command injection vulnerability via the /goform/webRead/open endpoint. The path parameter is not properly validated and is echoed into a shell context, allowing an attacker to inject and execute arbitrary shell commands on the device...

CVE-2023-49716

CVE-2023-49716 affects Emerson Rosemount GC370XA, GC700XA, and GC1500XA gas chromatographs. It allows an authenticated user with network access to run arbitrary commands from a remote computer due to command injection in the affected software/firmware (versions 4.1.5 and earlier per ICS/EMERSON a...

UBUNTU-CVE-2024-20328

A vulnerability in the VirusEvent feature of ClamAV could allow a local attacker to inject arbitrary commands with the privileges of the application service account.The vulnerability is due to unsafe handling of file names. A local attacker could exploit this vulnerability by supplying a file nam...