CVE-2024-7699

An low privileged remote attacker can execute OS commands with root privileges due to improper neutralization of special elements in user data...

CVE-2024-43386

A low privileged remote attacker can trigger the execution of arbitrary OS commands as root due to improper neutralization of special elements in the variable EMAILNOTIFICATION.TO in mGuard devices...

CVE-2024-43385

A low privileged remote attacker can trigger the execution of arbitrary OS commands as root due to improper neutralization of special elements in the variable PROXYHTTPPORT in mGuard devices...

CVE-2024-43387 Phoenix Contact: Access files due to improper neutralization of special elements in MGUARD devices

A low privileged remote attacker can read and write files as root due to improper neutralization of special elements in the variable EMAILRELAYPASSWORD in mGuard devices...

CVE-2024-43387 Phoenix Contact: Access files due to improper neutralization of special elements in MGUARD devices

A low privileged remote attacker can read and write files as root due to improper neutralization of special elements in the variable EMAILRELAYPASSWORD in mGuard devices...

CVE-2024-43386 Phoenix Contact: OS command execution through EMAIL_NOTIFICATION.TO in mGuard devices.

A low privileged remote attacker can trigger the execution of arbitrary OS commands as root due to improper neutralization of special elements in the variable EMAILNOTIFICATION.TO in mGuard devices...

CVE-2024-43386

CVE-2024-43386 affects Phoenix Contact mGuard devices (including FL/TC MGUARD) where a low-privileged remote attacker can trigger OS command execution as root via improper neutralization of elements in the EMAIL_NOTIFICATION.TO variable. The issue is rooted in input handling of that field, enabli...

CVE-2024-43385

CVE-2024-43385 affects PHOENIX CONTACT mGuard devices. The vulnerability stems from improper neutralization of a special element in the PROXY_HTTP_PORT variable, enabling a low-privileged remote attacker to trigger arbitrary OS command execution as root. Documents identify the affected component ...

CVE-2024-7699

CVE-2024-7699 affects PHOENIX CONTACT MGUARD devices. The issue is an OS command injection caused by improper neutralization of certain user data elements, enabling a low-privileged remote attacker to execute commands with root privileges. The vulnerability is network-exploitable (AV:N, AC:L, PR:...

CVE-2024-7699 Phoenix Contact: OS command execution in MGUARD products

An low privileged remote attacker can execute OS commands with root privileges due to improper neutralization of special elements in user data...

PT-2024-20166

Name of the Vulnerable Software and Affected Versions Controller 6000 and Controller 7000 versions 8.70 and prior Controller 6000 and Controller 7000 versions 8.80 through 8.80.1938 MR6 Controller 6000 and Controller 7000 versions 8.90 through 8.90.2155 MR5 Controller 6000 and Controller 7000...

CVE-2024-43387: Improper Neutralization of Special Elements used in an OS Command

A low privileged remote attacker can read and write files as root due to improper neutralization of special elements in the variable EMAILRELAYPASSWORD in mGuard devices...

PT-2024-30545 · Mguard · Mguard

Name of the Vulnerable Software and Affected Versions: mGuard devices affected versions not specified Description: A low privileged remote attacker can trigger the execution of arbitrary OS commands as root due to improper neutralization of special elements in the variable PROXY HTTP PORT. This...

CVE-2024-38227: Improper Neutralization of Special Elements used in a Command

Microsoft SharePoint Server Remote Code Execution Vulnerability...

Exploit for Code Injection in Sqlpad

I am not the researcher w...

QTS QuTS Command Injection

The vulnerability of QTS and QuTS operating systems, as well as Qnap network devices, is related to the failure to take measures to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

CVE-2024-40643: Improper Neutralization of Input During Web Page Generation

Joplin is a free, open source note taking and to-do application. Joplin fails to take into account that "" followed by a non letter character will not be considered html. As such it is possible to do an XSS by putting an "illegal" tag within a tag...

CVE-2024-27126: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow authenticated users to inject malicious code via a network. We have already fixed the vulnerability in the following versions: Notes Station 3 3.9.6 and later...

Zyxel Ethernet Switches Command Injection

The vulnerability of Zyxel Ethernet switches with microprogrammed software in the ATP, USG FLEX, and USG FLEX 50W/USG20W-VPN series is related to the lack of measures taken to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker...

CVE-2024-2166

CVE-2024-2166 affects Forcepoint Email Security (Real Time Monitor modules). Root cause: improper neutralization of input during web page generation, leading to a reflected cross-site scripting (XSS) vulnerability. Affected product version: Email Security prior to 8.5.5 HF003. CVSS details from N...