8012 matches found
OS Command Injection
genieacs is vulnerable to OS command injection. An attacker is able to inject malicious OS command via the ping host argument of lib/ui/api.ts and lib/ping.ts because it does not escape the argument and does not properly perform authorization check...
GHSA-2877-693Q-PJ33 OS Command Injection in GenieACS
In GenieACS 1.2.x before 1.2.8, the UI interface API is vulnerable to unauthenticated OS command injection via the ping host argument lib/ui/api.ts and lib/ping.ts. The vulnerability arises from insufficient input validation combined with a missing authorization check...
CVE-2021-46704
In GenieACS 1.2.x before 1.2.8, the UI interface API is vulnerable to unauthenticated OS command injection via the ping host argument lib/ui/api.ts and lib/ping.ts. The vulnerability arises from insufficient input validation combined with a missing authorization check...
CVE-2021-46704
CVE-2021-46704 – GenieACS : In GenieACS 1.2.x before 1.2.8, the UI interface API is vulnerable to unauthenticated OS command injection via the ping host argument in lib/ui/api.ts and lib/ping.ts. The root cause is insufficient input validation combined with a missing authorization check. This can...
CVE-2021-46704
In GenieACS 1.2.x before 1.2.8, the UI interface API is vulnerable to unauthenticated OS command injection via the ping host argument lib/ui/api.ts and lib/ping.ts. The vulnerability arises from insufficient input validation combined with a missing authorization check...
CVE-2021-44827
There is remote authenticated OS command injection on TP-Link Archer C20i 0.9.1 3.2 v003a.0 Build 170221 Rel.55462n devices vie the XTPExternalIPv6Address HTTP parameter, allowing a remote attacker to run arbitrary commands on the router with root privileges...
CVE-2021-44827
There is remote authenticated OS command injection on TP-Link Archer C20i 0.9.1 3.2 v003a.0 Build 170221 Rel.55462n devices vie the XTPExternalIPv6Address HTTP parameter, allowing a remote attacker to run arbitrary commands on the router with root privileges...
CVE-2022-0848
Summary (CVE-2022-0848): part-db/part-db prior to 0.5.11 is vulnerable to an OS Command Injection via unrestricted file upload, enabling remote code execution on the affected web server. Multiple sources document an RCE exploit and practical PoCs (e.g., packetstorm/huntr/exploit-db) that leverage...
CVE-2022-0848 OS Command Injection in part-db/part-db
OS Command Injection in GitHub repository part-db/part-db prior to 0.5.11...
OS Command Injection
npm-lockfile is vulnerable to OS command injection. An attacker is able to inject malicious OS command to invoke sensitive command execution API...
OS Command injection in npm-lockfile
npm-lockfile safely generates an npm lockfile and output it to the filename of your choice. npm-lockfile before 2.0.4 does not santize unsafe external input and invoke sensitive command execution API with the input, causing command injection vulnerability. A fix was released in version 2.0.5...
CVE-2022-0841
CVE-2022-0841 concerns OS command injection in ljharb/npm-lockfile (GitHub: npm-lockfile) for versions 2.0.3 and 2.0.4. The Red Hat entry notes a flaw where npm-lockfile v2 did not sanitize the only parameter before invoking a sensitive command execution API, enabling command injection. Other sou...
CVE-2021-43075
CVE-2021-43075 affects Fortinet FortiWLM (FortiWLM) where an improper neutralization of special elements used in OS commands allows an attacker to execute arbitrary commands via crafted HTTP requests to the alarm dashboard and controller configuration handlers. Affected versions include 8.6.2 and...
Exploit for OS Command Injection in Tp-Link Tl-Wr840N_Firmware
CVE-2022-25064 TP-LINK TL-WR840N RCE via the function oal...
C-DATA ONU4FERW OS Command Injection Vulnerability
C-DATA ONU4FERW is used for data management.C-DATA ONU4FERW is vulnerable to OS command injection, which can be exploited by attackers to execute arbitrary commands via the FormImportomCashell function...
FortiWLM - command Injection in script handlers
An improper neutralization of special elements used in an OS command 'OS Command Injection' CWE-78 vulnerability in FortiWLM may allow an authenticated attacker to execute arbitrary shell commands via crafted HTTP requests to the alarm dashboard and controller config handlers...
OS Command Injection
github.com/google/fscrypt is vulnerable to OS command injection. The vulnerability exists in fscryptmountpoints function of fscryptbashcompletion because the "compgen -W" is not single quoted which allows an attacker to inject and execute untrusted arbitrary strings...
OS Command injection in Apache Airflow
In Apache Airflow, prior to version 2.2.4, some example DAGs did not properly sanitize user-provided params, making them susceptible to OS Command Injection from the web UI...
GHSA-3V7G-4PG3-7R6J OS Command injection in Apache Airflow
In Apache Airflow, prior to version 2.2.4, some example DAGs did not properly sanitize user-provided params, making them susceptible to OS Command Injection from the web UI...
