CVE-2024-22063 ZTE ZENIC ONE R58 product has a CSV injection vulnerability

The ZENIC ONE R58 products by ZTE Corporation have a command injection vulnerability. An authenticated attacker can exploit this vulnerability to tamper with messages, inject malicious code, and subsequently launch attacks on related devices...

CVE-2024-22063

The CVE-2024-22063 entry concerns ZTE ZENIC ONE R58 devices, describing a command-injection vulnerability. According to the connected sources, an authenticated attacker could tamper with messages and inject malicious code, potentially enabling further attacks on related devices. The available doc...

CVE-2024-12987

CVE-2024-12987 affects DrayTek Vigor2960 and Vigor300B running firmware 1.5.1.4, where the Web Management Interface endpoint /cgi-bin/mainfunction.cgi/apmcfgupload processes the session parameter in an insecure way, enabling OS command injection. The issue is exploitable remotely and has public e...

VulnCheck KEV: CVE-2024-33112

D-Link DIR-845L v1.01KRb03 and before is vulnerable to an operating system command injection vulnerability...

IBM Security Directory Integrator Operating System Command Injection Vulnerability

IBM Security Directory Integrator is an integrated development environment and runtime service from International Business Machines IBM. IBM Security Directory Integrator suffers from an operating system command injection vulnerability that stems from the application's failure to properly filter...

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2024-12356link is external BeyondTrust Privileged Remote Access PRA and Remote Support RS Command Injection Vulnerability These types of vulnerabilities are frequent...

CVE-2023-23356

CVE-2023-23356 is a command-injection vulnerability in QNAP QuFirewall. The issue allows remote attackers who have gained administrator access to execute arbitrary commands via the QuFirewall module on affected QNAP OS versions. Affected/impacted component: QuFirewall (QNAP devices). Root cause d...

BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) Command Injection Vulnerability

BeyondTrust Privileged Remote Access PRA and Remote Support RS contain a command injection vulnerability, which can allow an unauthenticated attacker to inject commands that are run as a site user...

CVE-2024-11858

A flaw was found in Radare2, which contains a command injection vulnerability caused by insufficient input validation when handling Pebble Application files. Maliciously crafted inputs can inject shell commands during command parsing, leading to unintended behavior during file processing​...

ORing IAP-420 安全漏洞

The ORing IAP-420 is a wireless access point from ORing. A security vulnerability exists in the ORing IAP-420 version 2.01e and prior versions that stems from an SNMP object in the used NET-SNMP that allows command injection...

CVE-2024-50393 QTS, QuTS hero

A command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands. We have already fixed the vulnerability in the following versions: QTS 5.1.9.2954 build 20241120 and...

CVE-2024-50393

CVE-2024-50393 is a command-injection vulnerability reported to affect QNAP QTS and QuTS hero OS families. The issue may allow remote attackers to execute arbitrary commands via network access, with a low attack complexity and no privileges required, potentially impacting confidentiality, integri...

QNAP Systems HBS 3 安全漏洞

QNAP Systems HBS 3 is an application from China Weilian Technology QNAP Systems, Inc. A comprehensive data backup and disaster recovery solution. A security vulnerability exists in QNAP Systems HBS 3 version 25.1.1.673 and prior versions, which stems from the inclusion of an OS command injection...

Cisco NX-OS Command Injection (CVE-2017-12339)

A vulnerability in the CLI of Cisco NX-OS System Software could allow an authenticated, local attacker to perform a command injection attack. The vulnerability is due to insufficient input validation of command arguments to the CLI parser. An attacker could exploit this vulnerability by injecting...

CVE-2024-9200

A post-authentication command injection vulnerability in the "host" parameter of the diagnostic function in Zyxel VMG4005-B50A firmware versions through V5.15ABQA.2.2C0 could allow an authenticated attacker with administrator privileges to execute operating system OS commands on a vulnerable devi...

CVE-2024-50370

A CWE-78 "Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection'" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G = 1.6.3, EKI-6333AC-2GD = v1.6.3 and EKI-6333AC-1GPO = v1.2.1. The vulnerability can be exploited by remote...

CVE-2024-50365

A CWE-78 "Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection'" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G = 1.6.3, EKI-6333AC-2GD = v1.6.3 and EKI-6333AC-1GPO = v1.2.1. The source of the vulnerability relies on...

CVE-2024-50367

A CWE-78 "Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection'" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G = 1.6.3, EKI-6333AC-2GD = v1.6.3 and EKI-6333AC-1GPO = v1.2.1. The source of the vulnerability relies on...

CVE-2024-7517 Privileged escalation via crafted use of portcfg command

A command injection vulnerability in Brocade Fabric OS before 9.2.0c, and 9.2.1 through 9.2.1a on IP extension platforms could allow a local authenticated attacker to perform a privileged escalation via crafted use of the portcfg command. This specific exploitation is only possible on IP Extensio...

Cisco Industrial Network Director Operating System Command Injection Vulnerability

Cisco Industrial Network Director IND is an industrial automation management system from Cisco. The system achieves automation management by visualizing the industrial Ethernet infrastructure. Cisco Industrial Network Director suffers from an operating system command injection vulnerability that...