CVE-2024-34338

Summary: CVE-2024-34338 affects Tenda O3V2 firmware 1.0.0.10 and 1.0.0.12, with a Blind Command Injection via the dest parameter in the /goform/getTraceroute API. The root cause is an injection in that endpoint, allowing arbitrary commands to run with root privileges. Authentication is required t...

Motorola Interface Test Tool 安全漏洞

Motorola Interface Test Tool is an interface test tool from Motorola, Inc. A security vulnerability exists in Motorola Interface Test Tool, which stems from an incorrect export vulnerability that could allow a malicious local application to execute operating system commands...

The vulnerability of the FortiSandbox threat detection and mitigation system arises from the lack of measures taken to neutralize special elements used in the operating system’s command set. This allows attackers to execute arbitrary commands.

The vulnerability of the FortiSandbox threat detection and mitigation system exists because measures are not taken to neutralize the special elements used in the operating system’s command set. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands using specially...

The vulnerability of the Pandora FMS monitoring and management system, related to the failure to neutralize special elements used in the operating system’s command set, allows a hacker to execute arbitrary code.

The vulnerability of the Pandora FMS monitoring and management system lies in the lack of measures taken to neutralize special elements used in the operating system’s command set. Exploiting this vulnerability allows a malicious actor to execute arbitrary code on the server remotely...

The vulnerability of the svc_cbr utility in the operating system for Dell Unity Operating Environment storage systems allows a perpetrator to execute arbitrary operating system commands.

The vulnerability of the svccbr utility in the Dell Unity Operating Environment OE storage system exists due to the lack of measures taken to neutralize the special elements used in the operating system’s commands. Exploiting this vulnerability can allow an attacker to execute arbitrary operating...

The vulnerability of the Microsoft Defender for IoT’s threat detection mechanism lies in the lack of measures to neutralize special elements used in the operating system’s command set, allowing attackers to execute arbitrary code.

The vulnerability of the Microsoft Defender for IoT threat detection mechanism is related to the lack of measures taken to neutralize special elements used in the operating system’s command set. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the Dell vApp Manager software, which manages data storage devices like Dell PowerMax EEM, and the Dell Unisphere for PowerMax Virtual Appliance and Solutions Enabler Virtual Appliance, allows a malicious individual to execute arbitrary commands.

The vulnerability of the Dell vApp Manager software, which manages data storage of Dell PowerMax EEM, and the Dell Unisphere for PowerMax Virtual Appliance and Solutions Enabler Virtual Appliance, exists due to the failure to address the special elements used in the operating system’s command set...

The vulnerability of the GlobalProtect function in the PAN-OS operating system allows a perpetrator to execute arbitrary code with root privileges.

The vulnerability of the GlobalProtect function in the PAN-OS operating system is related to the lack of measures taken to neutralize special elements used in the OS command. Exploiting this vulnerability allows a malicious actor, operating remotely, to execute arbitrary code with root privileges...

The vulnerability of the JuiceFSRuntime orchestrator environment for distributed data sets and the open-source Kubernetes accelerator for applications with intensive data processing in Fluid, allows attackers to execute arbitrary commands.

The vulnerability of the JuiceFSRuntime orchestrator for distributed data sets and the open-source Kubernetes accelerator for applications with intensive data processing exists due to the lack of measures taken to eliminate special elements used in the operating system command set. Exploiting thi...

The vulnerability of the dashboard component of the application scaling framework for AI and Python Ray applications, which allows a hacker to execute arbitrary commands.

The vulnerability of the dashboard framework for scaling AI and Python Ray applications exists due to the failure to address the issues related to the special elements used in the operating system’s command set. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands...

The vulnerability of the vpnAction function (/itbox_pi/vpn_quickset_service.php?a=set_vpn) in the microprogramming software for Ruijie’s RG-EG series routers allows a hacker to execute arbitrary commands.

The vulnerability of the vpnAction function /itboxpi/vpnquicksetservice.php?a=setvpn of the Ruijie RG-EG series router microprogramming software is related to the failure to eliminate special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to...

LunarNight Laboratory WebProxy 安全漏洞

Lunarnight Laboratory LunarNight Laboratory WebProxy is a perl script for web proxies from Lunarnight Laboratory Vietnam. A security vulnerability exists in LunarNight Laboratory WebProxy versions 1.7.8 through 1.7.9 that originates from a vulnerability that could allow an unauthenticated, remote...

The vulnerability of the microprogrammed software of the cloud-controlled switch Ruijie Reyee series RG-ES200 allows a intruder to execute arbitrary code.

The vulnerability of the microprogrammed cloud-controlled switch Ruijie Reyee series RG-ES200 is related to the lack of measures taken to neutralize special elements used in the OS command. Exploiting this vulnerability can allow a remote attacker to execute arbitrary code...

GHSA-X9R9-48RM-4XM6 FitNesse allows execution of arbitrary OS commands

FitNesse all releases allows a remote authenticated attacker to execute arbitrary OS commands...

Fluid Security Vulnerability

Fluid is an open source Kubernetes native distributed dataset orchestrator and gas pedal from the Cloud Native Computing Foundation Foundation for data-intensive applications such as big data and AI applications. A security vulnerability exists in versions of Fluid prior to v0.9.3. An attacker...

CVE-2024-27889

Multiple SQL Injection vulnerabilities exist in the reporting application of the Arista Edge Threat Management - Arista NG Firewall NGFW. A user with advanced report application access rights can exploit the SQL injection, allowing them to execute commands on the underlying operating system with...

The vulnerability of the File Transfer Protocol (FTP) implementation in the microprogrammed networking devices of ZyXEL USG FLEX, USG FLEX 50(W)/USG20(W)-VPN, USG FLEX H, and ATP allows a perpetrator to execute arbitrary commands.

The vulnerability of the File Transfer Protocol FTP implementation in microprogrammed network devices such as ZyXEL USG FLEX, USG FLEX 50W/USG20W-VPN, USG FLEX H, and ATP lies in the lack of measures to neutralize special elements used in operating system commands during the loading of binary...

The vulnerability of the FontForge font editing software lies in its lack of measures to neutralize special elements used in operating system commands, allowing attackers to execute arbitrary commands.

The vulnerability of the FontForge font editing software exists because measures to neutralize special elements have not been taken. Exploiting this vulnerability allows an attacker to execute arbitrary commands...

The vulnerability of the FontForge font editing software lies in its lack of measures to neutralize special elements used in operating system commands, allowing attackers to execute arbitrary commands.

The vulnerability of the FontForge font editing software exists because measures to neutralize special elements have not been taken. Exploiting this vulnerability allows an attacker to execute arbitrary commands...

CVE-2023-6398

A post-authentication command injection vulnerability in the file upload binary in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4.50 through 5.37 Patch 1, USG FLEX 50W series firmware versions from 4.16 through 5.37 Patch 1, USG20W-VPN...