9131 matches found
The vulnerability of the byte_4C0160 function in D-Link DSL-3782 router microprogramming software allows a hacker to enhance their privileges and execute arbitrary commands.
The vulnerability of the byte4C0160 function in D-Link DSL-3782 router microprogramming software is related to insufficient checking of arguments passed to certain CLI commands. Exploiting this vulnerability can allow an attacker to enhance their privileges and execute arbitrary commands...
Apple PDFKit 安全漏洞
Apple PDFKit is one of Apple's Apple PDF document generation components. A security vulnerability exists in Apple PDFKit, which can be exploited by attackers to execute illegal commands...
CVE-2022-38094
OS command injection vulnerability in the telnet function of CentreCOM AR260S V2 firmware versions prior to Ver.3.3.7 allows a remote authenticated attacker to execute an arbitrary OS command...
CVE-2022-34869
Undocumented hidden command that can be executed from the telnet function of CentreCOM AR260S V2 firmware versions prior to Ver.3.3.7 allows a remote authenticated attacker to execute an arbitrary OS command...
Hardcoded credentials
Use of hard-coded credentials for the telnet server of CentreCOM AR260S V2 firmware versions prior to Ver.3.3.7 allows a remote unauthenticated attacker to execute an arbitrary OS command...
Command injection
Undocumented hidden command that can be executed from the telnet function of CentreCOM AR260S V2 firmware versions prior to Ver.3.3.7 allows a remote authenticated attacker to execute an arbitrary OS command...
Command injection
OS command injection vulnerability in GUI setting page of CentreCOM AR260S V2 firmware versions prior to Ver.3.3.7 allows a remote authenticated attacker to execute an arbitrary OS command...
CVE-2022-30078
NETGEAR R6200V2 firmware versions through R6200v2-V1.0.3.1210.1.11 and R6300V2 firmware versions through R6300v2-V1.0.4.5210.0.93 allow remote authenticated attackers to execute arbitrary command via shell metacharacters in the ipv6fix.cgi ipv6wanipaddr, ipv6lanipaddr, ipv6wanlength, or...
Design/Logic Flaw
NETGEAR R6200V2 firmware versions through R6200v2-V1.0.3.1210.1.11 and R6300V2 firmware versions through R6300v2-V1.0.4.5210.0.93 allow remote authenticated attackers to execute arbitrary command via shell metacharacters in the ipv6fix.cgi ipv6wanipaddr, ipv6lanipaddr, ipv6wanlength, or...
PT-2022-20055 · Fortinet · Fortisoar
Name of the Vulnerable Software and Affected Versions: Fortinet FortiSOAR versions prior to 7.2.1 Description: The issue is related to improper privilege management, allowing a GUI user who has already found a way to modify system files to execute arbitrary Python commands as root. Recommendation...
Amazon Linux 2022 : openssl, openssl-devel, openssl-libs (ALAS2022-2022-123)
It is, therefore, affected by a vulnerability as referenced in the ALAS2022-2022-123 advisory. A flaw was found in OpenSSL. The issue in CVE-2022-1292 did not find other places in the crehash script where it possibly passed the file names of certificates being hashed to a command executed through...
CVE-2022-36640
influxData influxDB before v1.8.10 contains no authentication mechanism or controls, allowing unauthenticated attackers to execute arbitrary commands. NOTE: the CVE ID assignment is disputed because the vendor's documentation states "If InfluxDB is being deployed on a publicly accessible endpoint...
CVE-2022-36640
influxData influxDB before v1.8.10 contains no authentication mechanism or controls, allowing unauthenticated attackers to execute arbitrary commands. NOTE: the CVE ID assignment is disputed because the vendor's documentation states "If InfluxDB is being deployed on a publicly accessible endpoint...
Dell SmartFabric storage software command injection vulnerability
Dell SmartFabric Storage Software is a stand-alone storage software solution from Dell USA. A command injection vulnerability exists in Dell SmartFabric storage software version 1.0.0, which arises from a failure of a network system or product to properly filter special characters, commands, etc...
Deserialization Of Untrusted Data
Apache Hadoop YARN Server is vulnerable to Deserialization Of Untrusted Data. The vulnerability exists in deserializeObject function in ZKConfigurationStore.java due to unsafe deserialization of data in ZooKeeper that is not being validated which allows an attacker to run arbitrary commands as YA...
Dell Container Storage Modules 操作系统命令注入漏洞
Dell Container Storage Modules is a set of modules from Dell USA. Dell Container Storage Modules version 1.2 contains an operating system command injection vulnerability, which stems from a failure to properly filter constructed command special characters, commands, etc. in the goiscsi and gobric...
Wavlink WL-WN575A3 操作系统命令注入漏洞
WAVLINK WL-WN575A3 is a wireless network signal extender from China RuiYin Technology WAVLINK. An operating system command injection vulnerability exists in the Wavlink WL-WN575A3 RPT75A3.V4300.201217 version, which stems from a command injection vulnerability found when manipulating the adm.cgi...
Font-Converter Vulnerable to Arbitrary Command Injection
Overview font-converter is a FontForge wrapper that allows conversion between different font formats TTF, WOFF, OTF All versions of this package are vulnerable to Arbitrary Command Injection due to missing sanitization of input that potentially flows into the childprocess.exec function. PoC js va...
GHSA-G2C3-VWFF-M3XR Font-Converter Vulnerable to Arbitrary Command Injection
Overview font-converter is a FontForge wrapper that allows conversion between different font formats TTF, WOFF, OTF All versions of this package are vulnerable to Arbitrary Command Injection due to missing sanitization of input that potentially flows into the childprocess.exec function. PoC js va...