Mageia: Security Advisory (MGASA-2021-0124)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Grandstream GXV3175 'settimezone' Unauthenticated Command Execution

This module exploits a command injection vulnerability in Grandstream GXV3175 IP multimedia phones. The 'settimezone' action does not validate input in the 'timezone' parameter allowing injection of arbitrary commands. A buffer overflow in the 'phonecookie' cookie parsing allows authentication to...

Netgear RBR750和NETGEAR 命令注入漏洞

Netgear RBR750 and NETGEAR are both products of Netgear, Inc.RBR750 is a home WiFi system.NETGEAR is a router. A hardware device that connects two or more networks and acts as a gateway between networks. A security vulnerability exists in certain NETGEAR devices that stems from the fact that some...

Lantronix PremierWave 2050 OS Command Injection Vulnerability (CNVD-2022-04976)

The Lantronix PremierWave 2050 is an embedded enterprise Wi-Fi module from Lantronix, Inc. Used to provide reliable and always-on 5G Wi-Fi connectivity, the Lantronix PremierWave 2050 version 8.9.0.0R4 is vulnerable to an operating system command injection vulnerability that can be exploited by...

Pulse Connect Secure Command Injection (CVE-2020-8243)

A command injection vulnerability exists in Pulse Connect Secure. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

OPENSUSE-SU-2021:1535-1 Security update for ruby2.5

This update for ruby2.5 fixes the following issues: - CVE-2021-31799: Fixed Command injection vulnerability in RDoc bsc1190375. - CVE-2021-31810: Fixed trusting FTP PASV responses vulnerability in Net:FTP bsc1188161. - CVE-2021-32066: Fixed StartTLS stripping vulnerability in Net:IMAP bsc1188160...

Security update for ruby2.5 (important)

openSUSE Security Update: Security update for ruby2.5 Announcement ID: openSUSE-SU-2021:1535-1 Rating: important References: 1188160 1188161 1190375 Cross-References: CVE-2021-31799 CVE-2021-31810 CVE-2021-32066 CVSS scores: CVE-2021-31799 SUSE: 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H...

SUSE-SU-2021:3838-1 Security update for ruby2.5

This update for ruby2.5 fixes the following issues: - CVE-2021-31799: Fixed Command injection vulnerability in RDoc bsc1190375. - CVE-2021-31810: Fixed trusting FTP PASV responses vulnerability in Net:FTP bsc1188161. - CVE-2021-32066: Fixed StartTLS stripping vulnerability in Net:IMAP bsc1188160...

Elecom Edwrc 操作系统操作系统命令注入漏洞

The Elecom Edwrc is a series of routers from Elecom Japan. The Elecom Edwrc suffers from an operating system command injection vulnerability that originates from a network system or product not properly filtering specific elements of the data entered externally to the ELECOM router during the...

Exploit for Command Injection in Tp-Link Tapo_C200_Firmware

CVE-2021-4045 CVE-2021-4045 is a Command Injection vulnerabil...

yongyou PLM 命令注入漏洞

Yonyou yongyou PLM is a data management platform from CN UFIDA Network Technology Yonyou. A security vulnerability exists in yongyou PLM, which can be exploited by attackers to gain server privileges...

CVE-2021-31357

A command injection vulnerability in tcpdump command processing on Juniper Networks Junos OS Evolved allows an attacker with authenticated CLI access to be able to bypass configured access protections to execute arbitrary shell commands within the context of the current user. The vulnerability...

FreakOut Botnet Turns DVRs Into Monero Cryptominers

Threat group FreakOut’s Necro botnet has developed a new trick: infecting Visual Tools DVRs with a Monero miner. Juniper Threat Labs researchers have issued a report detailing new activities from FreakOut, also known as Necro Python and Python.IRCBot. In late September, the team noticed that the...

CVE-2021-20035

Improper neutralization of special elements in the SMA100 management interface allows a remote authenticated attacker to inject arbitrary commands as a ‘nobody’ user which potentially leads to DoS. Recent assessments: Assessed Attacker Value: 0 Assessed Attacker Value: 0Assessed Attacker Value: 0...

Edgecore ECS2020 命令注入漏洞

The Edgecore ECS2020 is a network smart switch solution from Edgecore China. A security vulnerability exists in the Edgecore ECS2020 version 1.0.0.0 firmware that originates from allowing unauthenticated commands to be injected into the /EXCUSHELL URI via the command1 HTTP header...

Important: Red Hat Security Advisory: rh-ruby27-ruby security update

An update for rh-ruby27-ruby is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerabili...

Command Injection Vulnerability in Legacy IBM System x IMM - Lenovo Support US

No description provided...

CVE-2020-26300

systeminformation is an npm package that provides system and OS information library for node.js. In systeminformation before version 4.26.2 there is a command injection vulnerability. Problem was fixed in version 4.26.2 with a shell string sanitation fix...

Cisco IOS XR 操作系统命令注入漏洞

Cisco IOS XR Software is an operating system developed by Cisco for its network devices.An elevation of privilege vulnerability exists in Cisco IOS XR Software, which could be exploited by attackers to elevate the privileges of affected devices...

多款Altus Sistemas de Automacao产品操作系统操作系统命令注入漏洞

The Altus Sistemas de Automacao Nexto NX30xx, among others, is an industrial automation device from the Brazilian company Altus Sistemas de Automacao. An operating system command injection vulnerability exists in several Altus Sistemas de Automacao devices. The vulnerability stems from the tcpdum...