CVE-2022-33127

The function that calls the diff tool in Diffy 3.4.1 does not properly handle double quotes in a filename when run in a windows environment. This allows attackers to execute arbitrary commands via a crafted string...

CVE-2022-33127

CVE-2022-33127 concerns the Diffy library. The issue arises in the function that calls the diff tool in Diffy 3.4.1, which does not properly handle double quotes in a filename when run on Windows. This insufficient input handling can allow an attacker to execute arbitrary commands via a crafted s...

CVE-2022-31767

IBM CICS TX Standard and Advanced 11.1 could allow a remote attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-Force ID: 227980...

The vulnerability of the “Main” function in TOTOLINK A3000RU router microprogramming software allows a intruder to execute arbitrary commands.

The vulnerability of the “Main” function in TOTOLINK A3000RU router microprogramming systems is related to insufficient checking of arguments passed in commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands through the QUERYSTRING parameter...

CVE-2022-31795

An issue was discovered on Fujitsu ETERNUS CentricStor CS8000 Control Center devices before 8.1A SP02 P04. The vulnerability resides in the grelfinfo function in grel.php. An attacker is able to influence the username user, password pw, and file-name file parameters and inject special characters...

CVE-2022-31794

An issue was discovered on Fujitsu ETERNUS CentricStor CS8000 Control Center devices before 8.1A SP02 P04. The vulnerability resides in the requestTempFile function in hwview.php. An attacker is able to influence the unitName POST parameter and inject special characters such as semicolons,...

CVE-2022-31795

An issue was discovered on Fujitsu ETERNUS CentricStor CS8000 Control Center devices before 8.1A SP02 P04. The vulnerability resides in the grelfinfo function in grel.php. An attacker is able to influence the username user, password pw, and file-name file parameters and inject special characters...

CVE-2022-31794

CVE-2022-31794 affects Fujitsu ETERNUS CentricStor CS8000 Control Center prior to 8.1A SP02 P04. The issue is in hw_view.php: the function requestTempFile can be influenced via the unitName POST parameter, allowing an attacker to inject special characters (e.g., semicolons, backticks, command-sub...

WAVLINK AERIAL X 1200M Command Injection Vulnerability

WAVLINK AERIAL X 1200M, a WiFi extender from WAVLINK China, is vulnerable to a command injection vulnerability in version M79X3.V5030.180719, which stems from the execution of a POST received in adm.cgi spliced directly into a system function, which can be exploited by an attacker to exploit this...

CVE-2022-31311

An issue in adm.cgi of WAVLINK AERIAL X 1200M M79X3.V5030.180719 allows attackers to execute arbitrary commands via a crafted POST request...

CVE-2022-31311

An issue in adm.cgi of WAVLINK AERIAL X 1200M M79X3.V5030.180719 allows attackers to execute arbitrary commands via a crafted POST request...

WAVLINK AERIAL X 1200M 操作系统命令注入漏洞

WAVLINK AERIAL X 1200M, a WiFi extender from WAVLINK China, is vulnerable to a command injection vulnerability in version M79X3.V5030.180719, which stems from the execution of a POST received in adm.cgi spliced directly into a system function, which can be exploited by an attacker to exploit this...

PT-2022-3909 · Robustel · Robustel R1510

Name of the Vulnerable Software and Affected Versions: Robustel R1510 version 3.3.0 Description: The issue is related to command injection vulnerabilities in the web server's ajax endpoints functionalities. A specially-crafted network packet can lead to arbitrary command execution. An attacker ca...

PT-2022-20683 · Wavlink · Wavlink Aerial X 1200M

Name of the Vulnerable Software and Affected Versions: WAVLINK AERIAL X 1200M version M79X3.V5030.180719 Description: The issue allows attackers to execute arbitrary commands via a crafted POST request to the adm.cgi endpoint. This is achieved by sending a specifically designed request to the...

LibreNMS Command Injection Vulnerability (CNVD-2022-91160)

LibreNMS is a PHP and MySQL based open source network monitoring system from the LibreNMS community. LibreNMS v22.3.0 contains a command injection vulnerability that stems from the failure of the serviceip, hostname and serviceparam parameters to properly filter the construct command special...

Arbitrary Command Execution

jmespath is vulnerable to arbitrary command execution. An attacker is able to inject and execute arbitrary commands due to the unsafe usage of JSON.load where JSON.parse is preferable...

The vulnerability of Fortinet FortiAP-S/W2 and FortiAP microprogramming software arises from the lack of measures taken to neutralize special elements used in the operating system command set. This allows attackers to execute arbitrary commands.

The vulnerability of Fortinet FortiAP-S/W2 and FortiAP lies in the lack of measures taken to neutralize special elements used in the operating system command set. Exploiting this vulnerability can allow an attacker to execute arbitrary commands...

EulerOS 2.0 SP10 : ghostscript (EulerOS-SA-2022-1804)

According to the versions of the ghostscript packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A trivial sandbox enabled with the -dSAFER option escape flaw was found in the ghostscript interpreter by injecting a specially crafted pip...

CVE-2022-29735

Delta Controls enteliTOUCH 3.40.3935, 3.40.3706, and 3.33.4005 allows attackers to execute arbitrary commands via a crafted HTTP request...

gitsome 操作系统命令注入漏洞

npm bbultman gitsome is a small library from npm, USA. It can help make decisions based on the data available in a git repository. A security vulnerability exists in gitsome version 0.2.3, which stems from the fact that an attacker controlling the tagged name of the target git repository may...