18170 matches found
CVE-2024-30270
mailcow: dockerized is an open source groupware/email suite based on docker. A security vulnerability has been identified in mailcow affecting versions prior to 2024-04. This vulnerability is a combination of path traversal and arbitrary code execution, specifically targeting the rspamdmaps...
CVE-2024-29192
CVE-2024-29192 affects gotortc (camera streaming app). The vulnerability arises from CSRF in the /api/config endpoint, which can modify existing configuration with user-supplied values and, via the exec handler, enable arbitrary command execution. The issue exists even though the API may be restr...
CVE-2024-2692
SiYuan version 3.0.3 allows executing arbitrary commands on the server. This is possible because the application is vulnerable to Server Side XSS...
CVE-2024-26258
OS command injection vulnerability in ELECOM wireless LAN routers allows a network-adjacent attacker with credentials to execute arbitrary OS commands by sending a specially crafted request to the product...
PT-2024-22796
Name of the Vulnerable Software and Affected Versions: gotortc versions 1.8.5 and prior Description: The issue concerns a camera streaming application. It allows modification of the existing configuration with user-supplied values through the /api/config endpoint. Although this API only allows...
CVE-2024-29949
There is a command injection vulnerability in some Hikvision NVRs. This could allow an authenticated user with administrative rights to execute arbitrary commands...
CVE-2024-29949
There is a command injection vulnerability in some Hikvision NVRs. This could allow an authenticated user with administrative rights to execute arbitrary commands...
CVE-2024-29949
CVE-2024-29949 concerns Hikvision NVRs with a command injection vulnerability. The available documents consistently state that an authenticated user with administrative rights can execute arbitrary commands on affected devices. The vulnerability is tied to Hikvision’s advisories for NVR devices, ...
OS Command Injection
gtkwave is vulnerable to OS Command Injection. The vulnerability is due to insufficient input validation in the decompression functionality in vcdrecordermain, allowing attackers to execute arbitrary commands by crafting a specially crafted wave file...
OS Command Injection
gtkwave is vulnerable to OS Command Injection. The vulnerability is due to inadequate input validation in the decompression functionality in vcdmain, enabling attackers to execute arbitrary commands through a specially crafted wave file...
OS Command Injection
gtkwave is vulnerable to OS Command Injection. The vulnerability is due to insufficient input validation in the decompression functionality in the vcd2lxt utility, which allows attackers to execute arbitrary commands by exploiting a specially crafted wave file...
OS Command Injection
gtkwave is vulnerable to OS Command Injection. The vulnerability is due to inadequate input validation in the decompression functionality in the vcd2lxt2 utility, allowing attackers to execute arbitrary commands by crafting a specially crafted wave file...
OS Command Injection
gtkwave is vulnerable to OS Command Injection. The vulnerability is due to inadequate input validation in the decompression functionality in the vcd2vzt utility, allowing attackers to execute arbitrary commands by exploiting a specially crafted wave file...
CVE-2024-29435
An issue discovered in Alldata v0.4.6 allows attacker to run arbitrary commands via the processId parameter...
CVE-2024-29435
An issue discovered in Alldata v0.4.6 allows attacker to run arbitrary commands via the processId parameter...
CVE-2024-29433
A deserialization vulnerability in the FASTJSON component of Alldata v0.4.6 allows attackers to execute arbitrary commands via supplying crafted data...
CVE-2024-29433
CVE-2024-29433 affects Alldata v0.4.6 via a deserialization vulnerability in the FASTJSON component, allowing attackers to execute arbitrary commands by supplying crafted data. Documents confirm the vulnerable software/version and the underlying cause; no details on exploitation methods beyond th...
CVE-2024-29435
Summary : CVE-2024-29435 affects Alldata v0.4.6, enabling an attacker to execute arbitrary commands via the processId parameter. Affected software : Alldata version 0.4.6. Impact : arbitrary command execution (described as high-risk functionality exposure in multiple sources); CVSS 3.1 base score...