Command injection

A vulnerability was found in Chengdu VEC40G 3.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /sendorder.cgi?parameter=accessdetect of the component Network Detection. The manipulation of the argument COUNT with the input 3 | netstat -an...

CVE-2023-2522

CVE-2023-2522 affects Chengdu VEC40G 3.0 (Network Detection). The vulnerability lies in the /send_order.cgi?parameter=access_detect endpoint, where manipulating the COUNT argument with input like 3 | netstat -an causes os command injection. Exploitation is remote and has been publicly disclosed. ...

CVE-2023-27999

An improper neutralization of special elements used in an OS command vulnerability CWE-78 in FortiADC 7.2.0, 7.1.0 through 7.1.1 may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments to existing commands...

CVE-2023-27999

CVE-2023-27999 affects FortiADC 7.2.0 and 7.1.0–7.1.1. It is an OS command injection due to improper neutralization of special elements (CWE-78) in FortiADC’s command handling, allowing an authenticated attacker to execute arbitrary commands via specially crafted arguments to existing commands. A...

CVE-2023-25826

Due to insufficient validation of parameters passed to the legacy HTTP query API, it is possible to inject crafted OS commands into multiple parameters and execute malicious code on the OpenTSDB host system. This exploit exists due to an incomplete fix that was made when this vulnerability was...

CVE-2023-25826 Remote Code Execution in OpenTSDB

Due to insufficient validation of parameters passed to the legacy HTTP query API, it is possible to inject crafted OS commands into multiple parameters and execute malicious code on the OpenTSDB host system. This exploit exists due to an incomplete fix that was made when this vulnerability was...

CVE-2023-25826

CVE-2023-25826 affects OpenTSDB via unauthenticated command injection in the HTTP query path (legacy API). The issue stems from insufficient validation of parameters (notably in the query API), allowing crafted commands to bypass regex filters and execute on the host. Public writeups and exploits...

FortiADC - Command injection in external resource module

An improper neutralization of special elements used in an OS command vulnerability CWE-78 in FortiADC may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments to existing commands...

CVE-2023-29778

GL.iNET MT3000 4.1.0 Release 2 is vulnerable to OS Command Injection via /usr/lib/oui-httpd/rpc/logread...

CVE-2023-2479

OS Command Injection in GitHub repository appium/appium-desktop prior to v1.22.3-4...

CVE-2023-2479 OS Command Injection in appium/appium-desktop

OS Command Injection in GitHub repository appium/appium-desktop prior to v1.22.3-4...

CVE-2023-29778

GL.iNET MT3000 4.1.0 Release 2 is vulnerable to OS Command Injection via /usr/lib/oui-httpd/rpc/logread...

CVE-2023-2479 OS Command Injection in appium/appium-desktop

OS Command Injection in GitHub repository appium/appium-desktop prior to v1.22.3-4...

CVE-2023-2479

CVE-2023-2479 affects Appium Desktop (appium-desktop) prior to v1.22.3-4. The connected Nuclei template documents an OS Command Injection vulnerability in the Appium Desktop Server, exploitable via an untrusted URL parameter, allowing unauthenticated attackers to execute arbitrary commands and po...

PT-2023-22414 · Gl.Inet · Gl-Inet Mt3000

Name of the Vulnerable Software and Affected Versions: GL.iNET MT3000 version 4.1.0 Release 2 Description: The issue is related to OS Command Injection, which can be exploited via the /usr/lib/oui-httpd/rpc/logread endpoint. This allows for potential execution of system commands, posing a securit...

PT-2023-19784 · Unknown · Appium-Desktop

Name of the Vulnerable Software and Affected Versions: appium-desktop versions prior to 1.22.3-4 Description: The issue is an OS Command Injection, which affects the GitHub repository appium/appium-desktop. Recommendations: For versions prior to 1.22.3-4, update to version 1.22.3-4 or later to...

CVE-2023-29778

GL.iNET MT3000 4.1.0 Release 2 is vulnerable to OS Command Injection via /usr/lib/oui-httpd/rpc/logread...

CVE-2023-29778

GL.iNET MT3000 4.1.0 Release 2 is documented as vulnerable to an OS Command Injection via the /usr/lib/oui-httpd/rpc/logread endpoint. The affected component is the logread handler in the oui-httpd path; CVSS v3.1 metrics indicate a critical impact (CRITICAL, 9.8) affecting confidentiality, integ...

Exploit for OS Command Injection in Wwbn Avideo

WWBN Avideo Authenticated RCE - OS Command Injection CVE-20...

CVE-2023-30854

WWBN AVideo (open-source video platform) has a documented OS command-injection vulnerability in the authenticated endpoint /plugin/CloneSite/cloneClient.json.php. Attackers can achieve Remote Code Execution via this endpoint, with the issue fixed in version 12.4 per CVE-2023-30854. Red Hat adviso...