CVE-2023-22643

CVE-2023-22643 affects libzypp-plugin-appdata in SUSE Linux Enterprise Server for SAP 15-SP3 and openSUSE Leap 15.4. The issue is an OS command injection vulnerability due to improper neutralization of special elements in repo configuration (REPO_ALIAS, REPO_TYPE, REPO_METADATA_PATH) that can be ...

PT-2023-2359 · D Link · D-Link Dir-820L

Name of the Vulnerable Software and Affected Versions: D-Link DIR820LA1 FW105B03 Description: The issue is an OS Command injection vulnerability that allows attackers to escalate privileges to root via a crafted payload with the ping addr parameter to ping.ccp. This vulnerability exists due to th...

CVE-2022-43758 Rancher: Command injection in Git package

A Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in SUSE Rancher allows code execution for user with the ability to add an untrusted Helm catalog or modifying the URL configuration used to download KDM only admin users by default This issue...

CVE-2022-31249 [RANCHER] OS command injection in Rancher and Fleet

A Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in wrangler of SUSE Rancher allows remote attackers to inject commands in the underlying host via crafted commands passed to Wrangler. This issue affects: SUSE Rancher wrangler version 0.7.3 a...

CVE-2022-43758 Rancher: Command injection in Git package

A Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in SUSE Rancher allows code execution for user with the ability to add an untrusted Helm catalog or modifying the URL configuration used to download KDM only admin users by default This issue...

CVE-2022-47339

In cmd services, there is a OS command injection issue due to missing permission check. This could lead to local escalation of privilege with system execution privileges needed...

CVE-2022-47339

CVE-2022-47339 describes a local OS command injection in the cmd_services component due to missing permission checks, enabling local privilege escalation to a root/system level on affected Unisoc/Android devices. The CVSS vector indicates LOCAL access, low attack complexity, but HIGH privileges r...

Mitsubishi Electric Multiple Factory Automation Products (Update D)

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Mitsubishi Electric Equipment: GOT2000 compatible HMI software, CC-Link IE TSN Industrial Managed Switch, MELSEC iQ-R Series OPC UA Server Module Vulnerabilities: Infinite Loop, OS Command Injection 2...

Delta Electronics DVW-W02W2-E2

1. EXECUTIVE SUMMARY CVSS v3 9.9 ATTENTION: Public exploit available/exploitable remotely/low attack complexity Vendor: Delta Electronics Equipment: DVW-W02W2-E2 Vulnerabilities: OS Command Injection 2. RISK EVALUATION Successful exploitation of this vulnerability could allow a threat actor with...

CVE-2023-23692

Dell EMC prior to version DDOS 7.9 contains an OS command injection Vulnerability. An authenticated non admin attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the application's underlying OS, with the privileges of the vulnerable...

CVE-2023-23692

Dell EMC prior to version DDOS 7.9 contains an OS command injection Vulnerability. An authenticated non admin attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the application's underlying OS, with the privileges of the vulnerable...

CVE-2023-23692

CVE-2023-23692 affects Dell PowerProtect Data Domain (DDOS) prior to version 7.9, where an OS command injection vulnerability could allow an authenticated non-admin attacker to run arbitrary OS commands on the underlying system with the vulnerable app’s privileges. The available sources confirm t...

CVE-2023-23076

CVE-2023-23076 affects ManageEngine SupportCenter Plus 11, where an OS command injection via the Executor in Action when creating new schedules allows unauthenticated or network-based exploitation (cvss3.1: 9.8). For affected versions, multiple sources indicate remediation through upgrading to Su...

PT-2023-18835 · Unknown · Supportcenter Plus

Name of the Vulnerable Software and Affected Versions: Support Center Plus version 11 Description: The issue is an OS Command injection vulnerability in Support Center Plus via Executor in Action when creating new schedules. Recommendations: For Support Center Plus version 11, consider disabling...

CVE-2023-23076

OS Command injection vulnerability in Support Center Plus 11 via Executor in Action when creating new schedules...

nemo-appium vulnerable to OS Command Injection

Versions of the package nemo-appium before 0.0.9 are vulnerable to Command Injection due to improper input sanitization in the 'module.exports.setup' function. Note: In order to exploit this vulnerability appium-running 0.1.3 has to be installed as one of nemo-appium dependencies...

GHSA-C6RX-GXQV-VR5J nemo-appium vulnerable to OS Command Injection

Versions of the package nemo-appium before 0.0.9 are vulnerable to Command Injection due to improper input sanitization in the 'module.exports.setup' function. Note: In order to exploit this vulnerability appium-running 0.1.3 has to be installed as one of nemo-appium dependencies...

Control Web Panel Unauthenticated Remote Command Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'rex/stopwatch' class MetasploitModule 'CWP login.php Unauthenticated RCE', 'Description' = %q Control Web Panel versions 'Spencer McIntyre', metasploit module...

CVE-2022-42484

An OS command injection vulnerability exists in the httpd logs/view.cgi functionality of FreshTomato 2022.5. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can send an HTTP request to trigger this vulnerability...

CVE-2022-42484

An OS command injection vulnerability exists in the httpd logs/view.cgi functionality of FreshTomato 2022.5. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can send an HTTP request to trigger this vulnerability...