CVE-2023-3974

The CVE-2023-3974 issue affects jgraph/drawio prior to 21.4.0, where saving drafts in the desktop app can trigger an OS command injection due to using spawn with shell: true. The Red Hat/NVD entries describe OS command injection risk with the affected desktop release, and PoCs illustrate commands...

CVE-2023-3974 OS Command Injection in jgraph/drawio

OS Command Injection in GitHub repository jgraph/drawio prior to 21.4.0...

PT-2023-8504 · Qnap · Qnap Qts +2

Name of the Vulnerable Software and Affected Versions: QNAP QTS versions prior to 5.1.3.2578 build 20231110 QNAP QuTS hero versions prior to h5.1.3.2578 build 20231110 QNAP QuTScloud versions prior to c5.1.5.2651 Description: An OS command injection issue affects QNAP operating system versions,...

OS Command Injection

github.com/1panel-dev/1panel is vulnerable to OS Command Injection. The vulnerability exists in the 1Panel firewall functionality which allows an attacker to inject and execute arbitrary commands using a specially-crafted authenticated HTTP request...

CVE-2023-37292

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in HGiga iSherlock 4.5 iSherlock-user modules, HGiga iSherlock 5.5 iSherlock-user modules allows OS Command Injection.This issue affects iSherlock 4.5: before iSherlock-user-4.5-174; iSherlock...

CVE-2023-37292

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in HGiga iSherlock 4.5 iSherlock-user modules, HGiga iSherlock 5.5 iSherlock-user modules allows OS Command Injection.This issue affects iSherlock 4.5: before iSherlock-user-4.5-174; iSherlock...

Command injection

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in HGiga iSherlock 4.5 iSherlock-user modules, HGiga iSherlock 5.5 iSherlock-user modules allows OS Command Injection.This issue affects iSherlock 4.5: before iSherlock-user-4.5-174; iSherlock...

CVE-2023-37292 HGiga iSherlock - Command Injection

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in HGiga iSherlock 4.5 iSherlock-user modules, HGiga iSherlock 5.5 iSherlock-user modules allows OS Command Injection.This issue affects iSherlock 4.5: before iSherlock-user-4.5-174; iSherlock...

CVE-2023-37292 HGiga iSherlock - Command Injection

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in HGiga iSherlock 4.5 iSherlock-user modules, HGiga iSherlock 5.5 iSherlock-user modules allows OS Command Injection.This issue affects iSherlock 4.5: before iSherlock-user-4.5-174; iSherlock...

CVE-2023-37292

CVE-2023-37292 affects HGiga iSherlock software. The OS Command Injection vulnerability arises from improper neutralization of special elements in iSherlock-user modules. Affected versions are iSherlock 4.5 (before iSherlock-user-4.5-174) and iSherlock 5.5 (before iSherlock-user-5.5-174). Consequ...

PT-2023-25890 · Hgiga · Isherlock

Name of the Vulnerable Software and Affected Versions: HGiga iSherlock versions 4.5 before iSherlock-user-4.5-174 HGiga iSherlock versions 5.5 before iSherlock-user-5.5-174 Description: The issue is related to an Improper Neutralization of Special Elements used in an OS Command, also known as 'OS...

CVE-2023-3722

An OS command injection vulnerability was found in the Avaya Aura Device Services Web application which could allow remote code execution as the Web server user via a malicious uploaded file. This issue affects Avaya Aura Device Services version 8.1.4.0 and earlier...

Command injection

An OS command injection vulnerability was found in the Avaya Aura Device Services Web application which could allow remote code execution as the Web server user via a malicious uploaded file. This issue affects Avaya Aura Device Services version 8.1.4.0 and earlier...

CVE-2023-3722 Avaya Aura Device Services Remote Code Execution

An OS command injection vulnerability was found in the Avaya Aura Device Services Web application which could allow remote code execution as the Web server user via a malicious uploaded file. This issue affects Avaya Aura Device Services version 8.1.4.0 and earlier...

CVE-2023-3722 Avaya Aura Device Services Remote Code Execution

An OS command injection vulnerability was found in the Avaya Aura Device Services Web application which could allow remote code execution as the Web server user via a malicious uploaded file. This issue affects Avaya Aura Device Services version 8.1.4.0 and earlier...

CVE-2023-3722

Vulnerability summary (CVE-2023-3722) Avaya Aura Device Services Web, versions 8.1.4.0 and earlier, suffers an OS command injection via a malicious uploaded file, allowing remote code execution with the web server’s privileges. The issue affects the web interface and is documented as unauthentica...

CVE-2023-37477

1Panel exposes an OS command injection in its firewall IP endpoint (/hosts/firewall/ip). The vulnerability allows an authenticated attacker to craft input that leads to arbitrary command execution, potentially full system compromise. The issue stems from lack of input validation in the firewall f...

CVE-2023-37477 Command injection in firewall ip functionality in 1Panel

1Panel is an open source Linux server operation and maintenance management panel. An OS command injection vulnerability exists in 1Panel firewall functionality. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger...

CVE-2020-36762

A vulnerability was found in ONS Digital RAS Collection Instrument up to 2.0.27 and classified as critical. Affected by this issue is the function jobs of the file .github/workflows/comment.yml. The manipulation of the argument $COMMENTBODY leads to os command injection. Upgrading to version 2.0....

CVE-2020-36762 ONS Digital RAS Collection Instrument comment.yml jobs os command injection

A vulnerability was found in ONS Digital RAS Collection Instrument up to 2.0.27 and classified as critical. Affected by this issue is the function jobs of the file .github/workflows/comment.yml. The manipulation of the argument $COMMENTBODY leads to os command injection. Upgrading to version 2.0....