CVE-2024-8517 SPIP Bigup Multipart File Upload OS Command Injection

SPIP before 4.3.2, 4.2.16, and 4.1.18 is vulnerable to a command injection issue. A remote and unauthenticated attacker can execute arbitrary operating system commands by sending a crafted multipart file upload HTTP request...

Vulnerability fixed in Zyxel Access Points and Secure Routers

Zyxel has fixed a vulnerability in several types of Access Points and Secure Routers. The vulnerability is in the way the cgi system processes the 'host' parameter and allows a malicious person to execute OS-level commands. For successful exploitation, the malicious party must have access to the...

CVE-2024-7203

A post-authentication command injection vulnerability in Zyxel ATP series firmware versions from V4.60 through V5.38 and USG FLEX series firmware versions from V4.60 through V5.38 could allow an authenticated attacker with administrator privileges to execute some operating system OS commands on a...

CVE-2024-7203

CVE-2024-7203 describes a post-authentication command-injection in Zyxel USG FLEX and ATP firmware (versions V4.60–V5.38). An authenticated administrator could execute OS commands on affected devices by sending crafted CLI input. Reported impact in sources includes potential for arbitrary OS comm...

TOTOLINK X5000r Command Injection Vulnerability

The TOTOLINK X5000r is a wireless router manufactured by TOTOLINK. TOTOLINK X5000r has a command injection vulnerability in version 9.1.0cu.2350b20230313. The vulnerability arises because the setAccessDeviceCfg function within the /cgi-bin/cstecgi.cgi file fails to properly validate or clean up...

Siemens SINEC NMS Elevation of Privilege Vulnerability (CNVD-2024-35426)

SINEC NMS is a new generation network management system for digital enterprises. An elevation of privilege vulnerability exists in Siemens SINEC NMS, which can be exploited by an attacker to execute operating system commands with elevated privileges...

PT-2024-19112 · Envoy · Envoy

Name of the Vulnerable Software and Affected Versions: Envoy versions 4.x through 5.x Description: The issue is related to inadequate encryption strength, allowing an authenticated attacker to execute arbitrary OS commands via encrypted package upload. Recommendations: For Envoy versions 4.x...

SysAid Software Command Injection

The vulnerability of the software used for supporting and controlling hardware and software systems of SysAid is related to the failure to take measures to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrar...

EMACS etags Code Execution

The vulnerability of the lib-src/etags.c file of the EMACS text editor’s etags component is related to the improper elimination of special elements used in the OS command. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Junos OS Evolved Privilege Escalation

The vulnerability of the command-line interface CLI of Junos OS Evolved routers from the PTX Series, ACX Series, and QFX Series exists due to the lack of measures taken to neutralize special elements used in operating system commands. Exploiting this vulnerability can allow attackers to elevate...

PT-2024-25648 · Elecom · Elecom Wireless Lan Routers

Name of the Vulnerable Software and Affected Versions: ELECOM wireless LAN routers affected versions not specified Description: The issue allows for the unrestricted upload of files with dangerous types in ELECOM wireless LAN routers. A specially crafted file can be uploaded by a logged-in user...

CVE-2022-4002

A command injection vulnerability could allow an authenticated user to execute operating system commands as root via a specially crafted API request...

CVE-2022-4002

Motorola Q14 Mesh Router firmware vulnerability: a command-injection flaw exists prior to version 1.5.0.16 that could let an authenticated user execute OS commands as root via a crafted API request. The issue affects the Q14 firmware family before the stated fix; exploitation context and in-the-w...

CVE-2022-4002

A command injection vulnerability could allow an authenticated user to execute operating system commands as root via a specially crafted API request...

Ghostscript Command Injection Code Execution

The vulnerability of the software for processing, transforming, and generating Ghostscript documents is related to the introduction of a specially created pipe command. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary code...

ELECOM WRC-X6000XS-G, WRC-X1500GS-B, and WRC-X1500GSA-B have security vulnerabilities

ELECOM WRC-X6000XS-G and others are a wireless router from ELECOM Japan. A security vulnerability exists in the ELECOM WRC-X6000XS-G, WRC-X1500GS-B, and WRC-X1500GSA-B v1.11 and earlier versions, which stems from the possibility that a logged in user with administrative privileges could send a...

mySCADA MyPRO Authenticated Command Injection

class MetasploitModule 'mySCADA MyPRO Authenticated Command Injection CVE-2023-28384', 'Description' = %q Authenticated Command Injection in MyPRO MSFLICENSE, 'Author' = 'Michael Heinzl', Vulnerability discovery & MSF module 'References' = 'URL',...

xdg-desktop-portal-hyprland security vulnerability

xdg-desktop-portal-hyprland is an open source XDG desktop portal for Hyprland by Hypr Development. A security vulnerability exists in xdg-desktop-portal-hyprland versions prior to 1.3.3 that stems from allowing execution of operating system commands...

GeoVision GV-DSP, GV-IPCAMD, GV-VS, and GVLX Command Injection

The vulnerability of the microprogramming software used in video surveillance systems GeoVision GV-DSP, GV-IPCAMD, GV-VS, and GVLX 4 exists due to the lack of measures taken to neutralize the special elements used in the operating system commands. Exploiting this vulnerability allows a remote...

PHP proc_open Command Execution

The vulnerability of the procopen function in the PHP programming language exists because measures to neutralize the special elements used in operating system commands have not been implemented. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...