CVE-2023-30854

WWBN AVideo (open-source video platform) has a documented OS command-injection vulnerability in the authenticated endpoint /plugin/CloneSite/cloneClient.json.php. Attackers can achieve Remote Code Execution via this endpoint, with the issue fixed in version 12.4 per CVE-2023-30854. Red Hat adviso...

CVE-2023-30854 WWBN AVideo vulnerable to OS Command Injection

AVideo is an open source video platform. Prior to version 12.4, an OS Command Injection vulnerability in an authenticated endpoint /plugin/CloneSite/cloneClient.json.php allows attackers to achieve Remote Code Execution. This issue is fixed in version 12.4...

openSUSE 15 Security Update : liferea (openSUSE-SU-2023:0096-1)

The remote openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2023:0096-1 advisory. - A vulnerability was found in liferea. It has been rated as critical. Affected by this issue is the function updatejobrun of the file src/update.c of th...

Remote code injection in wwbn/avideo

WWBN Avideo Authenticated RCE - OS Command Injection Description An OS Command Injection vulnerability in an Authenticated endpoint /plugin/CloneSite/cloneClient.json.php allows attackers to achieve Remote Code Execution. Vulnerable code: php $cmd = "wget -O $clonesDir$json-sqlFile...

CVE-2023-28400 CVE-2023-28400

mySCADA myPRO versions 8.26.0 and prior has parameters which an authenticated user could exploit to inject arbitrary operating system commands...

CVE-2023-28400

CVE-2023-28400 affects mySCADA myPRO, versions 8.26.0 and earlier. The vulnerability arises from parameters that an authenticated user can abuse to inject arbitrary operating system commands (OS Command Injection, CWE-78). Exploitation is described as possible remotely with low attack complexity ...

CVE-2023-28716 CVE-2023-28716

mySCADA myPRO versions 8.26.0 and prior has parameters which an authenticated user could exploit to inject arbitrary operating system commands...

CVE-2023-28384

CVE-2023-28384 affects mySCADA myPRO (versions 8.26.0 and earlier). An authenticated user can exploit parameters to inject arbitrary operating system commands, with the commands executed under NT AUTHORITY\SYSTEM. Public sources (including CISA ICS advisory) confirm remote exploitable OS command ...

CVE-2023-29169 CVE-2023-29169

mySCADA myPRO versions 8.26.0 and prior has parameters which an authenticated user could exploit to inject arbitrary operating system commands...

CVE-2023-29169

Summary (CVE-2023-29169) mySCADA myPRO versions 8.26.0 and prior are affected by an OS command injection vulnerability. An authenticated user can exploit parameters with insufficient validation to inject arbitrary operating system commands. This is documented in multiple sources (including Red Ha...

CVE-2023-29150

CVE-2023-29150 affects mySCADA myPRO up to version 8.26.0 and earlier, due to parameters that authenticated users can abuse to inject OS commands. Public sources (NVD/Red Hat CNVD/ICS advisories) confirm OS command injection with high impact (C/H, I/H, A/H) and note remote exposure in advisories,...

PT-2023-23010

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 12.4 Description An OS Command Injection issue in the authenticated endpoint /plugin/CloneSite/cloneClient.json.php allows attackers to achieve Remote Code Execution. The vulnerable code executes a command that include...

IBM Corporation AIX errlog() Log Injection Vulnerability

Talos Vulnerability Report TALOS-2023-1690 IBM Corporation AIX errlog Log Injection Vulnerability April 24, 2023 CVE Number None,CVE-2023-26286 SUMMARY An OS command injection vulnerability exists in the errlog syscall functionality of IBM Corporation AIX 7.2. A specially crafted syscall can lead...

OS Command Injection via Type Confusion in Scan and Preview Parameters

Description Scanservjs has a RESTful API that provides endpoints for interacting with scanners using the SANE library. There are two APIs for scanning an image and generating a preview image that call out to Process.spawn, invoking a scanimage command as a subprocess of the server, and passing...

CVE-2023-2131

Versions of INEA ME RTU firmware prior to 3.36 are vulnerable to OS command injection, which could allow an attacker to remotely execute arbitrary code...

Command injection

Versions of INEA ME RTU firmware prior to 3.36 are vulnerable to OS command injection, which could allow an attacker to remotely execute arbitrary code...

CVE-2023-2131 CVE-2023-2131

Versions of INEA ME RTU firmware prior to 3.36 are vulnerable to OS command injection, which could allow an attacker to remotely execute arbitrary code...

CVE-2023-25759

OS Command Injection in TripleData Reporting Engine in Tripleplay Platform releases prior to Caveman 3.4.0 allows authenticated users to run unprivileged OS level commands via a crafted request payload...

CVE-2023-29412

CWE-78: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability exists that could cause remote code execution when manipulating internal methods through Java RMI interface...

CVE-2023-25554

A CWE-78: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability exists that allows a local privilege escalation on the appliance when a maliciously crafted Operating System command is entered on the device. Affected products: StruxureWare Data Cent...