CVE-2023-33378

Connected IO v2.1.0 and prior has an argument injection vulnerability in its AT command message in its communication protocol, enabling attackers to execute arbitrary OS commands on devices...

Connected IO Operating System Command Injection Vulnerability

Connected IO is a leading hardware, software and cloud-based IoT and machine-to-machine solution from US-based Connected IO, Inc. A security vulnerability previously existed in Connected IO version v2.1.0 that stemmed from having a command as part of its communication protocol that allowed the...

Connected IO Parameter Injection Vulnerability

Connected IO is a leading hardware, software and cloud-based IoT and machine-to-machine solution from US-based Connected IO, Inc. A security vulnerability exists in Connected IO ER2000 v2.1.0 and earlier versions, which stems from a parameter injection vulnerability in the iptables command in the...

Design/Logic Flaw

A vulnerability in the privilege management functionality of all Cisco BroadWorks server types could allow an authenticated, local attacker to elevate privileges to root on an affected system. This vulnerability is due to incorrect implementation of user role permissions. An attacker could exploi...

Suprema BioStar 2 Operating System Command Injection Vulnerability

Suprema BioStar 2 is a web-based biometric security smart lock platform from Suprema Korea. A security vulnerability exists in Suprema BioStar 2 versions prior to V2.9.1, which stems from a vulnerability that allows an authenticated user to execute arbitrary operating system commands on the BioSt...

The vulnerability of Cisco BroadWorks server software arises from the lack of measures taken to neutralize specific elements, allowing attackers to elevate their privileges to the root level.

The vulnerability of Cisco BroadWorks server software exists due to the lack of measures taken to neutralize special elements used in the operating system command. Exploiting this vulnerability can allow attackers to elevate their privileges to the root level...

PT-2023-4177 · Mlflow · Mlflow

Name of the Vulnerable Software and Affected Versions: MLflow versions prior to 2.6.0 Description: The issue exists due to the failure to neutralize special elements used in an operating system command. This could allow an attacker to execute arbitrary commands or cause a denial of service. The...

The vulnerability of the access point management function in microprogrammed software for Zyxel USG FLEX, USG FLEX 50(W), USG20(W)-VPN, ATP, and VPN allows a hacker to execute arbitrary commands.

The vulnerability of the access point management function in Zyxel USG FLEX, USG FLEX 50W, USG20W-VPN, ATP, and VPN software for network devices is related to the lack of measures taken to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a...

The vulnerability of the Free Time WiFi Hotspot function in the microprogrammed networking devices of Zyxel USG FLEX and VPN allows a intruder to execute arbitrary commands.

The vulnerability of the Free Time WiFi Hotspot function in the microprogrammed networking devices of Zyxel USG FLEX and VPN relates to the lack of measures taken to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execut...

Hikvision Hybrid SAN Ds-a71024 Firmware - Multiple Remote Code Execution Exploit

Exploit Title: Hikvision Hybrid SAN Ds-a71024 Firmware - Multiple Remote Code Execution Exploit Author: Thurein Soe CVE : CVE-2022-28171 Vendor Homepage: https://www.hikvision.com Software Link: N/A Refence Link: https://cve.report/CVE-2022-28171 Version: Filmora 12: Ds-a71024 Firmware, Ds-a71024...

Zyxel USG FLEX 操作系统命令注入漏洞

Zyxel USG FLEX is a firewall from China Hopkins Zyxel. It provides flexible VPN options IPsec, SSL or L2TP to provide flexible and secure remote access for remote work and management. A security vulnerability exists in the Zyxel USG FLEX that stems from a command injection in the Free Time WiFi...

SAP NetWeaver ABAP Server Operating System Command Injection Vulnerability

SAP NetWeaver ABAP Server is a German SAP SAP company used as a Web application server for SAP products. SAP NetWeaver ABAP Server suffers from an operating system command injection vulnerability that arises from the application failing to properly filter constructor command special characters,...

ELECOM WRC 代码注入漏洞

The ELECOM WRC is a home-applicable network camera from ELECOM Japan. A code injection vulnerability exists in ELECOM WRC-1167FEBK-A v1.18 and earlier versions, which stems from the presence of a code injection that allows network-adjacent authenticated attackers to execute arbitrary operating...

D-Link DIR-823G Command Execution Vulnerability (CNVD-2023-65130)

The D-Link DIR-823G is a wireless router from China's AUO D-Link. A command execution vulnerability exists in the D-Link DIR-823G version 1.02B05, which stems from the application failing to properly filter construct command special characters, commands, etc. An attacker can exploit this...

The vulnerability in the FortiADC Manager web management tool, a controller for FortiADC applications, allows a attacker to execute arbitrary commands with root privileges.

The vulnerability of the FortiADC Manager web management tool, a controller for FortiADC application delivery, is related to the failure to remove special elements used in the operating system’s command set. Exploiting this vulnerability can allow an attacker to execute arbitrary commands with ro...

CVE-2023-37237

The CVE-2023-37237 issue affects Veritas NetBackup Appliance software prior to 4.1.0.1 MR3. Insecure permissions allow an authenticated Admin to bypass shell restrictions and execute arbitrary OS commands via SSH. Root cause: insecure permissions on the appliance environment. Impact: potential fu...

CVE-2023-26613

An OS command injection vulnerability in D-Link DIR-823G firmware version 1.02B05 allows unauthorized attackers to execute arbitrary operating system commands via a crafted GET request to EXCUSHELL...

Zyxel NAS326 操作系统命令注入漏洞

Zyxel NAS326 is a cloud storage NAS from China Heqin Zyxel. A security vulnerability exists in the Zyxel NAS326 V5.21 AAZF.14 firmware version prior to C0, NAS540 V5.21 AATB.11 firmware version prior to C0, and NAS542V5.21 firmware version prior to V5.21, which originates from a vulnerability tha...

The vulnerability of the cable gateway Hitron CODA-5310 arises from the failure to take measures to neutralize special elements used in the operating system’s command set. This allows a hacker to execute arbitrary commands.

The vulnerability of the Hitron CODA-5310 cable gateway exists due to the failure to take measures to neutralize special elements used in the operating system’s commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

PT-2023-22965 · Kb-Ahr08D +3 · Kb-Ahr08D +5

Name of the Vulnerable Software and Affected Versions: KB-AHR04D versions prior to 91110.1.101106.78 KB-AHR08D versions prior to 91210.1.101106.78 KB-AHR16D versions prior to 91310.1.101106.78 KB-IRIP04A versions prior to 95110.1.100290.78A KB-IRIP08A versions prior to 95210.1.100290.78A KB-IRIP1...