CVE-2024-38471

CVE-2024-38471 concerns multiple TP-LINK routers (e.g., Archer AX3000, AXE75, AX5400, Air R5, AXE5400) with an OS command injection vulnerability. The issue allows a network-adjacent attacker who has administrative privileges to execute arbitrary OS commands by restoring a crafted backup file. Th...

CVE-2024-39943

CVE-2024-39943 affects rejetto HFS (HTTP File Server) before v0.52.10 on Linux/UNIX/macOS. The root cause is that the server executes OS commands via a shell (execSync) to run df during file upload, enabling remote authenticated users with Upload permissions to achieve remote code execution. Conn...

CVE-2024-6071

PTC Creo Elements/Direct License Server exposes a web interface which can be used by unauthenticated remote attackers to execute arbitrary OS commands on the server...

CVE-2024-6071 PTC Creo Elements/Direct License Server Missing Authorization

PTC Creo Elements/Direct License Server exposes a web interface which can be used by unauthenticated remote attackers to execute arbitrary OS commands on the server...

CVE-2024-6071

CVE-2024-6071: Missing Authorization in PTC Creo Elements/Direct License Server exposes a web interface that unauthenticated remote attackers can use to execute arbitrary OS commands. Affected products/versions include Creo Elements/Direct License Server (MEls) up to 20.7.0.0; other Creo Elements...

VulnCheck KEV: CVE-2024-29973

The command injection vulnerability in the 'setCookie' parameter in Zyxel NAS326 firmware versions before V5.21AAZF.17C0 and NAS542 firmware versions before V5.21ABAG.14C0 could allow an unauthenticated attacker to execute some operating system OS commands by sending a crafted HTTP POST request...

Zyxel NAS Multiple Vulnerabilities

The Zyxel NAS is potentially affected by multiple vulnerabilities. - This command injection vulnerability in the 'setCookie' parameter in Zyxel NAS326 and NAS542 devices could allow an unauthenticated attacker to execute some OS commands by sending a crafted HTTP POST request. CVE-2024-29973 - Th...

CVE-2024-36103

OS command injection vulnerability in WRC-X5400GS-B v1.0.10 and earlier, and WRC-X5400GSA-B v1.0.10 and earlier allows a network-adjacent attacker with an administrative privilege to execute arbitrary OS commands by sending a specially crafted request to the product...

CVE-2024-36103

OS command injection vulnerability in WRC-X5400GS-B v1.0.10 and earlier, and WRC-X5400GSA-B v1.0.10 and earlier allows a network-adjacent attacker with an administrative privilege to execute arbitrary OS commands by sending a specially crafted request to the product...

CVE-2024-36103

OS command injection vulnerability in WRC-X5400GS-B v1.0.10 and earlier, and WRC-X5400GSA-B v1.0.10 and earlier allows a network-adjacent attacker with an administrative privilege to execute arbitrary OS commands by sending a specially crafted request to the product...

Exploit for Improper Access Control in Apache Hugegraph

CVE-2024-27348 🪶 CVE-2024-27348 Proof of concept Exploit RCE...

CVE-2024-33529

ILIAS 7 before 7.30 and ILIAS 8 before 8.11 as well as ILIAS 9.0 allow remote authenticated attackers with administrative privileges to execute operating system commands via file uploads with dangerous types...

CVE-2024-0401 ASUS OVPN RCE

ASUS routers supporting custom OpenVPN profiles are vulnerable to a code execution vulnerability. An authenticated and remote attacker can execute arbitrary operating system commands by uploading a crafted OVPN profile. Known affected routers include ASUS ExpertWiFi, ASUS RT-AX55, ASUS RT-AX58U,...

GHSA-26HP-CGJJ-M2J3 fuel/core ImageMagick driver does not escape all shell arguments.

This vulnerability may cause OS commands to be executed when you pass unvalidated image filenames containing specially crafted strings to the ImageMagick driver...

fuel/core ImageMagick driver does not escape all shell arguments.

This vulnerability may cause OS commands to be executed when you pass unvalidated image filenames containing specially crafted strings to the ImageMagick driver...

VulnCheck KEV: CVE-2023-41724

A command injection vulnerability in Ivanti Sentry prior to 9.19.0 allows unauthenticated threat actor to execute arbitrary commands on the underlying operating system of the appliance within the same physical or logical network...

CVE-2024-33792

netis-systems MEX605 v2.00.06 allows attackers to execute arbitrary OS commands via a crafted payload to the tracert page...

CVE-2023-41822

An improper export vulnerability was reported in the Motorola Interface Test Tool application that could allow a malicious local application to execute OS commands...

CVE-2023-41822

An improper export vulnerability was reported in the Motorola Interface Test Tool application that could allow a malicious local application to execute OS commands...

CVE-2023-41822

An improper export vulnerability was reported in the Motorola Interface Test Tool application that could allow a malicious local application to execute OS commands...