9166 matches found
CVE-2021-22855
The specific function of HR Portal of Soar Cloud System accepts any type of object to be deserialized. Attackers can send malicious serialized objects to execute arbitrary commands...
CVE-2021-22855
The specific function of HR Portal of Soar Cloud System accepts any type of object to be deserialized. Attackers can send malicious serialized objects to execute arbitrary commands...
Changjia Financial Management System Code Issue Vulnerability
Changjia Changjia Financial Management System is an application software of China Changjia Company. It provides financial management functions. A code issue vulnerability exists in the Changjia Financial Management System. An attacker can access the CGE account management function without...
Webmin < 1.970 Multiple Vulnerabilities
According to its self-reported version, the version of Webmin running on the remote host may be affected by multiple vulnerabilities, including the following: - Arbitrary command execution can occur in Webmin through 1.962. Any user authorized for the Package Updates module can execute arbitrary...
Secomea GateManager Security Vulnerability
A security vulnerability exists in Secomea GateManager all versions prior to 9.3, which can be exploited by an attacker to run arbitrary commands on a victim's computer...
Racom 安全漏洞
The RACOM M!DGE is a cellular router designed for SCADA and telemetry mission-critical applications and is ideally suited for many different wireless applications. An OS command injection vulnerability exists in the RACOM M!DGE firmware version 4.4.40.105. An attacker can exploit this vulnerabili...
Buffer overflow
Buffer overflow vulnerability in LOGITEC LAN-W300N/PGRB allows an attacker with administrative privilege to execute an arbitrary OS command via unspecified vectors...
CVE-2021-20640
CVE-2021-20640 is a buffer overflow vulnerability in LOGITEC LAN-W300N/PGRB. The root cause is a buffer overflow that could allow an attacker with administrative privileges to execute arbitrary OS commands via unspecified vectors. Affected device: LAN-W300N/PGRB (and related LOGITEC models per CV...
CVE-2021-20640
Buffer overflow vulnerability in LOGITEC LAN-W300N/PGRB allows an attacker with administrative privilege to execute an arbitrary OS command via unspecified vectors...
Netgear NETGEAR Operating System Command Injection Vulnerability
Netgear NETGEAR is a router from the American company Netgear. A hardware device that connects two or more networks and acts as a gateway between networks. An operating system command injection vulnerability exists in the NETGEAR Orbi, which arises from a network system or product not properly...
The vulnerability in the web interface of the Cisco Smart Software Manager On-Prem administration tool allows a perpetrator to execute arbitrary commands.
The vulnerability of the web interface of the Cisco Smart Software Manager On-Prem administration tool is related to insufficient validation of entered data. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands with elevated privileges remotely...
CVE-2021-3122
CMCAgent in NCR Command Center Agent 16.3 on Aloha POS/BOH servers permits the submission of a runCommand parameter within an XML document sent to port 8089 that enables the remote, unauthenticated execution of an arbitrary command as SYSTEM, as exploited in the wild in 2020 and/or 2021. NOTE: th...
CVE-2021-3122
CMCAgent in NCR Command Center Agent 16.3 on Aloha POS/BOH servers permits the submission of a runCommand parameter within an XML document sent to port 8089 that enables the remote, unauthenticated execution of an arbitrary command as SYSTEM, as exploited in the wild in 2020 and/or 2021. NOTE: th...
CVE-2021-3122
CMCAgent in NCR Command Center Agent 16.3 on Aloha POS/BOH servers permits the submission of a runCommand parameter within an XML document sent to port 8089 that enables the remote, unauthenticated execution of an arbitrary command as SYSTEM, as exploited in the wild in 2020 and/or 2021. NOTE: th...
CVE-2020-20294
CVE-2020-20294 affects CMSWing 1.3.8. The issue is a log function not validating the log parameter, allowing arbitrary command execution through malicious input. No explicit exploitation details or patch/remediation are provided in the supplied documents.
CMSWing SQL注入漏洞
CMSWing is a ThinkJS-based e-commerce platform and CMS builder. A code execution vulnerability exists in CMSWing 1.3.8. The vulnerability stems from the log function not checking the log parameter. An attacker can exploit this vulnerability to execute arbitrary commands via malicious parameters...
ELECOM WRC-300FEBK-S Cross-Site Request Forgery Vulnerability
The ELECOM WRC-300FEBK-S is a wireless access device. A cross-site request forgery vulnerability exists in the ELECOM WRC-300FEBK-S, which can be exploited by an attacker to submit a special request, alter the communication response, and execute arbitrary OS commands in the application context...
Command Injection in @graphql-tools/git-loader
This affects the package @graphql-tools/git-loader before 6.2.6. The use of exec and execSync in packages/loaders/git/src/load-git.ts allows arbitrary command injection...
GHSA-VHHW-XJVF-WPRR Command Injection in @graphql-tools/git-loader
This affects the package @graphql-tools/git-loader before 6.2.6. The use of exec and execSync in packages/loaders/git/src/load-git.ts allows arbitrary command injection...