CVE-2022-2253 Distributed Data Systems WebHMI OS Command Injection

A user with administrative privileges in Distributed Data Systems WebHMI 4.1.1.7662 may send OS commands to execute on the host server...

CVE-2022-2253

CVE-2022-2253 affects Distributed Data Systems WebHMI 4.1.1.7662 (and possibly prior versions). It is an OS command injection (CWE-78) vulnerability caused by improper neutralization of input during web page generation, allowing a user with administrative privileges to send OS commands to execute...

CVE-2014-0156

Awesome spawn contains OS command injection vulnerability, which allows execution of additional commands passed to Awesome spawn as arguments. If untrusted input was included in command arguments, attacker could use this flaw to execute arbitrary command...

CVE-2014-0156

Awesome spawn contains OS command injection vulnerability, which allows execution of additional commands passed to Awesome spawn as arguments. If untrusted input was included in command arguments, attacker could use this flaw to execute arbitrary command...

CVE-2014-0156

CVE-2014-0156 corresponds to an OS command injection in the Ruby gem awesome_spawn (ManageIQ). The vulnerability allows an attacker to execute arbitrary commands when untrusted input is passed as command arguments to AwesomeSpawn.run, via the underlying Kernel.spawn usage. The issue affects versi...

Robustel R1510 web_server ajax endpoints OS command injection vulnerabilities

Summary Multiple command injection vulnerabilities exist in the webserver ajax endpoints functionalities of Robustel R1510 3.3.0. A specially-crafted network packets can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger these vulnerabilities. Tested...

Robustel R1510 web_server action endpoints OS command injection vulnerabilities

Summary Multiple command injection vulnerabilities exist in the webserver action endpoints functionalities of Robustel R1510 3.3.0. A specially-crafted network request can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger these vulnerabilities. Tested...

Distributed Data Systems WebHMI

1. EXECUTIVE SUMMARY CVSS v3 9.1 ATTENTION: Exploitable remotely/low attack complexity/public exploits are available Vendor: Distributed Data Systems Equipment: WebHMI Vulnerabilities: Cross-site Scripting, OS Command Injection 2. RISK EVALUATION Successful exploitation of these vulnerabilities...

JVN#41017328: HOME SPOT CUBE2 vulnerable to OS command injection

HOME SPOT CUBE2 provided by KDDI CORPORATION contains an OS command injection vulnerability CWE-78 due to improper processing of data received from DHCP server. Impact An arbitrary OS command may be executed on the product if a malicious DHCP server is placed on the WAN side of the product...

Command injection

Marval MSM v14.19.0.12476 is vulnerable to OS Command Injection due to the insecure handling of VBScripts...

CVE-2022-31885

Marval MSM v14.19.0.12476 is vulnerable to OS Command Injection due to the insecure handling of VBScripts...

CVE-2022-31885

Marval MSM v14.19.0.12476 is affected by an OS command injection due to insecure handling of VBScript. CVE-2022-31885 details this vulnerability (NVD/Red Hat/PRION entries). Advisory CPAI-2022-0881 explicitly notes remote code execution could result from exploitation, enabling arbitrary code exec...

CVE-2022-26147

The Quectel RG502Q-EA modem before 2022-02-23 allow OS Command Injection...

Command injection

The Quectel RG502Q-EA modem before 2022-02-23 allow OS Command Injection...

CVE-2022-26147

CVE-2022-26147 affects the Quectel RG502Q-EA modem. The issue is OS command injection arising from the OTA download process, allowing an attacker to execute arbitrary commands with root privileges on the device. The public descriptions consistently note the vulnerability exists before 2022-02-23....

CVE-2022-26147

The Quectel RG502Q-EA modem before 2022-02-23 allow OS Command Injection...

Exploit for OS Command Injection in Tenda Hg9_Firmware

CVE-2022-30023 Authenticated Command Injection on Tenda HG9 R...

CVE-2022-30310 FESTO: CECC-X-M1 and Servo Press Kit YJKP OS Command Injection vulnerability

In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-acknerr-request" POST request doesn’t check for port syntax. This can result in unauthorized execution of system commands with root privileges due to improper access control command injection...

CVE-2022-30308 FESTO: CECC-X-M1 and Servo Press Kit YJKP OS Command Injection vulnerability

In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-web-viewer-request-on" POST request doesn’t check for port syntax. This can result in unauthorized execution of system commands with root privileges due to improper access control command injection...

OS Command Injection in git-promise

All versions of package git-promise is vulnerable to Command Injection due to an inappropriate fix of a prior vulnerability in this package. Note: Please note that the vulnerability will not be fixed. The README file was updated with a warning regarding this issue. Credits @lirantal for discoveri...