CVE-2023-25133

Improper privilege management vulnerability in default.cmd file in PowerPanel Business Local/Remote for Windows v4.8.6 and earlier, PowerPanel Business Management for Windows v4.8.6 and earlier, PowerPanel Business Local/Remote for Linux 32bit v4.8.6 and earlier, PowerPanel Business Local/Remote...

Privilege escalation

Improper privilege management vulnerability in default.cmd file in PowerPanel Business Local/Remote for Windows v4.8.6 and earlier, PowerPanel Business Management for Windows v4.8.6 and earlier, PowerPanel Business Local/Remote for Linux 32bit v4.8.6 and earlier, PowerPanel Business Local/Remote...

CVE-2023-25759

OS Command Injection in TripleData Reporting Engine in Tripleplay Platform releases prior to Caveman 3.4.0 allows authenticated users to run unprivileged OS level commands via a crafted request payload...

PT-2023-20282 · Unknown · Tripledata Reporting Engine +1

Name of the Vulnerable Software and Affected Versions: Tripleplay Platform versions prior to 3.4.0 Description: The issue allows authenticated users to run unprivileged OS level commands via a crafted request payload. This is due to an OS Command Injection in the TripleData Reporting Engine...

The vulnerability of the mySCADA myPRO industrial process visualization and control system lies in the lack of measures to neutralize special elements used in the operating system’s commands. This allows attackers to execute arbitrary commands.

The vulnerability of the mySCADA myPRO industrial process visualization and control system exists due to the failure to take measures to neutralize special elements used in the operating system’s commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remote...

The vulnerability of the graphical and application software interface of the FortiTester hardware-based diagnostic and audit software exists due to the failure to take measures to neutralize the special elements used in the operating system’s command set. This allows attackers to execute arbitrary commands.

The vulnerability of the graphical and application software interface of the FortiTester hardware-based diagnostic and audit software exists due to the failure to take measures to neutralize the special elements used in the operating system command set. Exploiting this vulnerability allows a...

PT-2023-2168 · Myscada · Myscada Mypro

Name of the Vulnerable Software and Affected Versions: mySCADA myPRO versions 8.26.0 and prior Description: The issue exists due to the lack of measures to neutralize special elements used in operating system commands. This could allow a remote attacker to execute arbitrary commands. An...

CVE-2023-28726

Panasonic AiSEG2 versions 2.80F through 2.93A allows remote attackers to execute arbitrary OS commands...

PT-2023-21858 · Pymedusa · Pymedusa

Name of the Vulnerable Software and Affected Versions: pymedusa versions prior to 1.0.12 Description: pymedusa is an automatic video library manager for TV Shows. An attacker with access to the web interface can update the git executable path in /config/general/ advanced settings with arbitrary O...

CVE-2023-1304

An authenticated attacker can leverage an exposed getattr method via a Jinja template to smuggle OS commands and perform other actions that are normally expected to be private methods. This issue was resolved in the Managed and SaaS deployments on February 1, 2023, and in version 23.2.1 of the...

Design/Logic Flaw

DrayTek Vigor2960 v1.5.1.4 allows an authenticated attacker with network access to the web management interface to inject operating system commands via the mainfunction.cgi 'parameter' parameter. NOTE: This vulnerability only affects products that are no longer supported by the maintainer...

CVE-2023-24229

Summary: CVE-2023-24229 affects DrayTek Vigor2960 (v1.5.1.4). An authenticated attacker with network access to the device’s web management interface can inject operating system commands through the mainfunction.cgi parameter, enabling arbitrary command execution. This vulnerability exists in a de...

CVE-2023-0978

A command injection vulnerability in Trellix Intelligent Sandbox CLI for version 5.2 and earlier, allows a local user to inject and execute arbitrary operating system commands using specially crafted strings. This vulnerability is due to insufficient validation of arguments that are passed to...

CVE-2023-0978

Summary: CVE-2023-0978 concerns Trellix Intelligent Sandbox CLI, affected in versions 5.2 and earlier, due to insufficient validation of CLI arguments that allows a local user to inject and execute arbitrary OS commands. Impact (as stated): local command execution with potential high impact on co...

CVE-2023-0978

A command injection vulnerability in Trellix Intelligent Sandbox CLI for version 5.2 and earlier, allows a local user to inject and execute arbitrary operating system commands using specially crafted strings. This vulnerability is due to insufficient validation of arguments that are passed to...

The vulnerability of the npm systeminformation package on the Node.js software platform allows a hacker to execute arbitrary commands.

The vulnerability of the npm systeminformation package on Node.js platforms exists due to the lack of measures taken to neutralize special elements used in operating system commands. Exploiting this vulnerability allows an attacker to execute arbitrary commands...

CVE-2023-20075

Vulnerability in the CLI of Cisco Secure Email Gateway could allow an authenticated, remote attacker to execute arbitrary commands. These vulnerability is due to improper input validation in the CLI. An attacker could exploit this vulnerability by injecting operating system commands into a...

Input validation

Vulnerability in the CLI of Cisco Secure Email Gateway could allow an authenticated, remote attacker to execute arbitrary commands. These vulnerability is due to improper input validation in the CLI. An attacker could exploit this vulnerability by injecting operating system commands into a...

The software platform for container deployment in the SUSE Rancher production environment is vulnerable. This vulnerability stems from the failure to address the need to neutralize certain special elements used in the operating system command set. This allows attackers to execute arbitrary commands.

The vulnerability of the software platform for container deployment in the SUSE Rancher wrangler production environment exists due to the lack of measures taken to neutralize special elements used in the operating system command set. Exploiting this vulnerability allows a remote attacker to execu...

pdf_info 安全漏洞

pdfinfo is a package pdfinfo command line tool by tomtaylor personal developer. A security vulnerability exists in pdfinfo version 0.5.3, which can be exploited by an attacker to execute operating system commands using a command chain...