CVE-2023-23362 QTS, QuTS hero, QuTScloud

An OS command injection vulnerability has been reported to affect QNAP operating systems. If exploited, the vulnerability allows remote authenticated users to execute commands via susceptible QNAP devices. We have already fixed the vulnerability in the following versions: QTS 5.0.1.2376 build...

CVE-2023-23362

CVE-2023-23362 is an OS command injection affecting QNAP QTS, QuTS Hero, QuTScloud. The issue allows remote authenticated users to execute commands via vulnerable QNAP devices. Public disclosures in the provided sources confirm the vulnerability and list fixed versions: QTS 5.0.1.2376 build 20230...

CVE-2023-28614

Freewill iFIS aka SMART Trade 20.01.01.04 allows OS Command Injection via shell metacharacters to a report page...

Command injection

Freewill iFIS aka SMART Trade 20.01.01.04 allows OS Command Injection via shell metacharacters to a report page...

CVE-2023-28614

Freewill iFIS aka SMART Trade 20.01.01.04 allows OS Command Injection via shell metacharacters to a report page...

CVE-2023-28614

Freewill iFIS aka SMART Trade 20.01.01.04 allows OS Command Injection via shell metacharacters to a report page...

CVE-2023-28614

CVE-2023-28614 affects Freewill iFIS (SMART Trade) 20.01.01.04. Description: OS Command Injection via shell metacharacters to a report page. Root cause: improper handling of shell metacharacters in the report page input leads to command execution. Impact per CVSS: Confidentiality, Integrity, and ...

CVE-2023-36642

An improper neutralization of special elements used in an OS command vulnerability CWE-78 in the management interface of FortiTester 3.0.0 through 7.2.3 may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments to existing commands...

CVE-2022-35849

An improper neutralization of special elements used in an OS command vulnerability CWE-78 in the management interface of FortiADC 7.1.0 through 7.1.1, 7.0.0 through 7.0.3, 6.2.0 through 6.2.5 and 6.1.0 all versions may allow an authenticated attacker to execute unauthorized commands via...

Command injection

An improper neutralization of special elements used in an OS command vulnerability CWE-78 in the management interface of FortiTester 3.0.0 through 7.2.3 may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments to existing commands...

Command injection

An improper neutralization of special elements used in an OS command vulnerability CWE-78 in the management interface of FortiADC 7.1.0 through 7.1.1, 7.0.0 through 7.0.3, 6.2.0 through 6.2.5 and 6.1.0 all versions may allow an authenticated attacker to execute unauthorized commands via...

CVE-2022-35849

An improper neutralization of special elements used in an OS command vulnerability CWE-78 in the management interface of FortiADC 7.1.0 through 7.1.1, 7.0.0 through 7.0.3, 6.2.0 through 6.2.5 and 6.1.0 all versions may allow an authenticated attacker to execute unauthorized commands via...

CVE-2022-35849

CVE-2022-35849 affects Fortinet FortiADC: an OS command injection vulnerability in the management interface. Affected FortiADC versions are 7.1.0–7.1.1, 7.0.0–7.0.3, 6.2.0–6.2.5, and 6.1.0 (all versions). The issue allows an authenticated attacker to execute unauthorized commands by supplying spe...

CVE-2023-36642

An improper neutralization of special elements used in an OS command vulnerability CWE-78 in the management interface of FortiTester 3.0.0 through 7.2.3 may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments to existing commands...

CVE-2023-36642

CVE-2023-36642 affects FortiTester management interface, with versions 3.0.0–7.2.3 vulnerable to an OS command injection due to improper neutralization of special elements (CWE-78). An authenticated attacker can execute unauthorized commands by crafting arguments to existing commands. The issue i...

OS Command Injection

cacti is vulnerable to OS Command Injection. The vulnerability exists in the snmp.php due to lack of parameter checks which allows an attacker to inject and execute arbitrary commands...

CVE-2023-39780

On ASUS RT-AX55 3.0.0.4.386.51598 devices, authenticated attackers can perform OS command injection via the /startapply.htm qosbwrulelist parameter. NOTE: for the similar "token-generated module" issue, see CVE-2023-41345; for the similar "token-refresh module" issue, see CVE-2023-41346; for the...

CVE-2023-39780

On ASUS RT-AX55 3.0.0.4.386.51598 devices, authenticated attackers can perform OS command injection via the /startapply.htm qosbwrulelist parameter. NOTE: for the similar “token-generated module” issue, see CVE-2023-41345; for the similar “token-refresh module” issue, see CVE-2023-41346; for the...

CVE-2023-4873

A vulnerability, which was classified as critical, was found in Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform up to 20230906. Affected is an unknown function of the file /importexport.php. The manipulation of the argument sql leads to os command injection. It is...

CVE-2023-4873

A vulnerability, which was classified as critical, was found in Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform up to 20230906. Affected is an unknown function of the file /importexport.php. The manipulation of the argument sql leads to os command injection. It is...