CVE-2023-23355

An OS command injection vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability possibly allows remote authenticated administrators to execute commands via unspecified vectors. QES is not affected. We have already fixed the vulnerability in the following...

CVE-2023-23355

CVE-2023-23355 is an OS command injection affecting QNAP QTS/QuTS hero/QuTScloud (QVR/QVP-related appliances). The vulnerability could allow remote authenticated administrators to execute commands via unspecified vectors; QES is not affected. Affected products and fixed versions are explicitly li...

CVE-2023-23355 QTS, QuTS hero, QuTScloud, QVP (QVR Pro appliances), QVR

An OS command injection vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability possibly allows remote authenticated administrators to execute commands via unspecified vectors. QES is not affected. We have already fixed the vulnerability in the following...

CVE-2023-23355 QTS, QuTS hero, QuTScloud, QVP (QVR Pro appliances), QVR

An OS command injection vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability possibly allows remote authenticated administrators to execute commands via unspecified vectors. QES is not affected. We have already fixed the vulnerability in the following...

D-Link DIR-825 操作系统命令注入漏洞

The D-Link DIR-825 is a router from China-based AUO D-Link. The D-Link DIR-825 suffers from an operating system command injection vulnerability that originates from failure to properly validate a user-supplied string before executing a system call using it...

PT-2023-2150 · Qnap · Quts Hero +2

Name of the Vulnerable Software and Affected Versions: QNAP QTS versions prior to 5.0.1.2346 build 20230322 QNAP QTS versions prior to 4.5.4.2374 build 20230416 QNAP QuTS hero versions prior to h5.0.1.2348 build 20230324 QNAP QuTS hero versions prior to h4.5.4.2374 build 20230417 QNAP QuTScloud...

Wago (CVE-2020-12522)

The reported vulnerability allows an attacker who has network access to the device to execute code with specially crafted packets in WAGO Series PFC 100 750-81xx/xxx-xxx, Series PFC 200 750-82xx/xxx-xxx, Series Wago Touch Panel 600 Standard Line 762-4xxx, Series Wago Touch Panel 600 Advanced Line...

CVE-2023-27394

Osprey Pump Controller version 1.01 is vulnerable an unauthenticated OS command injection vulnerability. This can be exploited to inject and execute arbitrary shell commands through a HTTP GET parameter called by DataLogView.php, EventsView.php and AlarmsView.php scripts...

CVE-2023-27886

Osprey Pump Controller version 1.01 is vulnerable to an unauthenticated OS command injection vulnerability. This can be exploited to inject and execute arbitrary shell commands through a HTTP POST parameter called by index.php script...

CVE-2023-27394 CVE-2023-27394

Osprey Pump Controller version 1.01 is vulnerable an unauthenticated OS command injection vulnerability. This can be exploited to inject and execute arbitrary shell commands through a HTTP GET parameter called by DataLogView.php, EventsView.php and AlarmsView.php scripts...

CVE-2023-27394 CVE-2023-27394

Osprey Pump Controller version 1.01 is vulnerable an unauthenticated OS command injection vulnerability. This can be exploited to inject and execute arbitrary shell commands through a HTTP GET parameter called by DataLogView.php, EventsView.php and AlarmsView.php scripts...

CVE-2023-27394

CVE-2023-27394 affects the Osprey Pump Controller; versions prior to 20230518 are vulnerable to an unauthenticated OS command injection via HTTP GET parameters in DataLogView.php, EventsView.php, and AlarmsView.php, allowing arbitrary shell commands to be executed. The issue is confirmed in multi...

CVE-2023-28627 OS Command Injection via GIT_PATH in pymedusa

pymedusa is an automatic video library manager for TV Shows. In versions prior 1.0.12 an attacker with access to the web interface can update the git executable path in /config/general/ advanced settings with arbitrary OS commands. An attacker may exploit this vulnerability to take execute...

CVE-2023-28627 OS Command Injection via GIT_PATH in pymedusa

pymedusa is an automatic video library manager for TV Shows. In versions prior 1.0.12 an attacker with access to the web interface can update the git executable path in /config/general/ advanced settings with arbitrary OS commands. An attacker may exploit this vulnerability to take execute...

Duplicate Advisory: pullit Command Injection vulnerability

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-8px5-63x9-5c7p. This link is maintained to preserve external references. Original Description The pullit package before 1.4.0 for Node.js allows OS Command Injection because eval is used on an attacker-supplied...

CVE-2018-25083

The pullit package before 1.4.0 for Node.js allows OS Command Injection because eval is used on an attacker-supplied Git branch name...

Command injection

The pullit package before 1.4.0 for Node.js allows OS Command Injection because eval is used on an attacker-supplied Git branch name...

CVE-2018-25083

The pullit package before 1.4.0 for Node.js allows OS Command Injection because eval is used on an attacker-supplied Git branch name...

CVE-2018-25083

The pullit package before 1.4.0 for Node.js allows OS Command Injection because eval is used on an attacker-supplied Git branch name...

CVE-2018-25083

The CVE-2018-25083 issue affects the pullit package for Node.js, before version 1.4.0. The root cause is the use of eval on an attacker-supplied Git branch name, enabling OS command injection. Impact is high across confidentiality, integrity, and availability (per CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:...