Multiple vulnerabilities in I-O DATA network attached hard disk 'HDL-T Series'

Overview Network attached hard disk 'HDL-T Series' provided by I-O DATA DEVICE, INC. contains multiple vulnerabilities. OS command injection CWE-78 Affected when 'Remote Link3 function' is enabled CVE-2025-32002 Missing authentication for critical function CWE-306 CVE-2025-32738 Chuya Hayakawa an...

CVE-2025-32002

Improper neutralization of special elements used in an OS command 'OS Command Injection' issue exists in I-O DATA network attached hard disk 'HDL-T Series' firmware Ver.1.21 and earlier when 'Remote Link3 function' is enabled. If exploited, a remote unauthenticated attacker may execute an arbitra...

CVE-2025-32002

The CVE-2025-32002 issue affects I-O DATA HDL-T Series network attached storage with firmware 1.21 and earlier, where enabling the Remote Link3 function allows an unauthenticated remote attacker to execute arbitrary OS commands due to improper neutralization of OS command elements. Documented imp...

CVE-2025-32002

Improper neutralization of special elements used in an OS command 'OS Command Injection' issue exists in I-O DATA network attached hard disk 'HDL-T Series' firmware Ver.1.21 and earlier when 'Remote Link3 function' is enabled. If exploited, a remote unauthenticated attacker may execute an arbitra...

CVE-2025-32002

Improper neutralization of special elements used in an OS command 'OS Command Injection' issue exists in I-O DATA network attached hard disk 'HDL-T Series' firmware Ver.1.21 and earlier when 'Remote Link3 function' is enabled. If exploited, a remote unauthenticated attacker may execute an arbitra...

CVE-2024-6486: Improper Neutralization of Special Elements used in an OS Command

The ImageMagick Engine ImageMagick Engine WordPress plugin before 1.7.11 for WordPress is vulnerable to OS Command Injection via the "clipath" parameter. This allows authenticated attackers, with administrator-level permission to execute arbitrary OS commands on the server leading to remote code...

CVE-2025-32002: Improper Neutralization of Special Elements used in an OS Command

Improper neutralization of special elements used in an OS command 'OS Command Injection' issue exists in I-O DATA network attached hard disk 'HDL-T Series' firmware Ver.1.21 and earlier when 'Remote Link3 function' is enabled. If exploited, a remote unauthenticated attacker may execute an arbitra...

PT-2025-21483 · WordPress · Imagemagick Engine

Name of the Vulnerable Software and Affected Versions: ImageMagick Engine WordPress plugin versions prior to 1.7.11 Description: The issue allows authenticated attackers with administrator-level permission to execute arbitrary OS commands on the server, leading to remote code execution. This is...

DrayTek Vigor Routers OS Command Injection Vulnerability

DrayTek Vigor2960, Vigor300B, and Vigor3900 routers contain an OS command injection vulnerability due to an unknown function of the file /cgi-bin/mainfunction.cgi/apmcfgupload of the component web management interface...

Alibaba Cloud Linux 3 : 0026: nodejs:14 (ALINUX3-SA-2023:0026)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2023:0026 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2021-44906: Minimist =1.2.5 is...

CVE-2025-47782: Improper Neutralization of Special Elements used in an OS Command

motionEye is an online interface for the software motion, a video surveillance program with motion detection. In versions 0.43.1b1 through 0.43.1b3, using a constructed camera device path with the add/addcamera motionEye web API allows an attacker with motionEye admin user credentials to execute...

CVE-2025-24022: Improper Neutralization of Special Elements used in an OS Command

iTop is an web based IT Service Management tool. Prior to versions 2.7.12, 3.1.3, and 3.2.1, server code execution is possible through the frontend of iTop's portal. This is fixed in versions 2.7.12, 3.1.3 and 3.2.1...

PT-2025-21217 · I O Data · I-O Data Hdl-T Series

Name of the Vulnerable Software and Affected Versions: I-O DATA HDL-T Series firmware versions 1.21 and earlier Description: The issue is related to the improper neutralization of special elements used in an OS command, also known as 'OS Command Injection'. This problem exists in the I-O DATA...

PT-2025-21171 · Itop · Itop

Name of the Vulnerable Software and Affected Versions: iTop versions prior to 2.7.12 iTop versions 3.0.0 through 3.1.3 iTop versions 3.2.0 through 3.2.1 Description: iTop is a web-based IT Service Management tool. Server code execution is possible through the frontend of iTop's portal. This issue...

Alibaba Cloud Linux 3 : 0165: nodejs:14 (ALINUX3-SA-2022:0165)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2022:0165 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2022-32212: A OS Command Injection...

CVE-2025-43562

ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability that could result in arbitrary code execution in the context of the current user. A high-privileged attacker could...

CVE-2025-43562

ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability that could result in arbitrary code execution in the context of the current user. A high-privileged attacker could...

CVE-2025-43562 ColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)

ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability that could result in arbitrary code execution in the context of the current user. A high-privileged attacker could...

CVE-2025-43562

CVE-2025-43562 describes an OS Command Injection in Adobe ColdFusion affecting versions 2025.1, 2023.13, 2021.19 and earlier. The root cause is improper neutralization/validation of elements in commands, enabling arbitrary code execution in the context of the current user. Exploitation is possibl...

CVE-2025-43562 ColdFusion | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)

ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability that could result in arbitrary code execution in the context of the current user. A high-privileged attacker could...