Command injection

A vulnerability has been identified in Desigo PXM30-1 All versions V02.20.126.11-41, Desigo PXM30.E All versions V02.20.126.11-41, Desigo PXM40-1 All versions V02.20.126.11-41, Desigo PXM40.E All versions V02.20.126.11-41, Desigo PXM50-1 All versions V02.20.126.11-41, Desigo PXM50.E All versions...

Command injection

A improper neutralization of special elements used in an os command 'os command injection' in Fortinet FortiOS version 6.0.0 through 6.0.14, FortiOS version 6.2.0 through 6.2.10, FortiOS version 6.4.0 through 6.4.8, FortiOS version 7.0.0 through 7.0.3 allows attacker to execute privileged command...

CVE-2022-33873

An improper neutralization of special elements used in an OS Command 'OS Command Injection' vulnerabilities CWE-78 in Console login components of FortiTester 2.3.0 through 3.9.1, 4.0.0 through 4.2.0, 7.0.0 through 7.1.0 may allow an unauthenticated attacker to execute arbitrary command in the...

FortiTester - Unauthenticated command injection

Multiple improper neutralization of special elements used in an OS Command 'OS Command Injection' vulnerabilities CWE-78 in Console, Telnet, and SSH login components of FortiTester may allow an unauthenticated remote attacker to execute arbitrary command in the underlying shell...

CVE-2022-33874

CVE-2022-33874 affects FortiTester: OS Command Injection in the SSH login component. Affects FortiTester versions 2.3.0–3.9.1, 4.0.0–4.2.0, and 7.0.0–7.1.0. Root cause: improper neutralization of special elements in OS commands. Impact: unauthenticated remote attacker can execute arbitrary comman...

CVE-2021-44171

A improper neutralization of special elements used in an os command 'os command injection' in Fortinet FortiOS version 6.0.0 through 6.0.14, FortiOS version 6.2.0 through 6.2.10, FortiOS version 6.4.0 through 6.4.8, FortiOS version 7.0.0 through 7.0.3 allows attacker to execute privileged command...

CVE-2022-35844

CVE-2022-35844 is a command-injection vulnerability in FortiTester’s management interface. It affects FortiTester versions 2.3.0–3.9.1, 4.0.0–4.2.0, and 7.0.0–7.1.0, caused by improper neutralization of special elements in OS commands. An authenticated attacker can execute unauthorized commands v...

CVE-2022-33873

An improper neutralization of special elements used in an OS Command 'OS Command Injection' vulnerabilities CWE-78 in Console login components of FortiTester 2.3.0 through 3.9.1, 4.0.0 through 4.2.0, 7.0.0 through 7.1.0 may allow an unauthenticated attacker to execute arbitrary command in the...

CVE-2022-33874

An improper neutralization of special elements used in an OS Command 'OS Command Injection' vulnerabilities CWE-78 in SSH login components of FortiTester 2.3.0 through 3.9.1, 4.0.0 through 4.2.0, 7.0.0 through 7.1.0 may allow an unauthenticated remote attacker to execute arbitrary command in the...

CVE-2021-44171

A improper neutralization of special elements used in an os command 'os command injection' in Fortinet FortiOS version 6.0.0 through 6.0.14, FortiOS version 6.2.0 through 6.2.10, FortiOS version 6.4.0 through 6.4.8, FortiOS version 7.0.0 through 7.0.3 allows attacker to execute privileged command...

PT-2022-4989 · Fortinet · Fortitester

Name of the Vulnerable Software and Affected Versions: FortiTester versions 2.3.0 through 3.9.1 FortiTester versions 4.0.0 through 4.2.0 FortiTester versions 7.0.0 through 7.1.0 Description: The issue is related to an improper neutralization of special elements used in an OS Command, which may...

CVE-2022-33873

CVE-2022-33873 describes an OS command injection in FortiTester Console login components due to improper neutralization of special elements. Affected FortiTester versions: 2.3.0–3.9.1, 4.0.0–4.2.0, and 7.0.0–7.1.0. Unauthenticated attackers could execute arbitrary commands in the underlying shell...

CVE-2022-33872

The CVE-2022-33872 entry concerns FortiTester Telnet login components with an OS Command Injection (CWE-78) flaw. Affected versions include FortiTester 2.3.0–3.9.1, 4.0.0–4.2.0, and 7.0.0–7.1.0. The vulnerability allows an unauthenticated remote attacker to execute arbitrary commands in the under...

Debian dla-3137 : libnode-dev - security update

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3137 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3137-1 [email protected]...

CVE-2022-28811

CVE-2022-28811 affects Carlo Gavazzi UWP3.0 (multiple versions) and CPY Car Park Server 2.8.3. The vulnerability stems from improper input validation on an API-submitted parameter, enabling a remote, unauthenticated attacker to execute arbitrary OS commands. The CVSS score is 9.8 (Critical) with ...

Exploit for Argument Injection in Atlassian Bitbucket

CVE-2022-36804 Bitbucket RCE 2022 This repo is part of the...

Security Bulletin: Vulnerability in IBM® Sterling B2B Integrator can lead to ability to execute OS commands from CLA2 server without authentication (CVE-2012-5937).

Abstract A security vulnerability exists in the Sterling B2B Integrator CLA2 server which permits an unauthenticated user to execute arbitrary OS commands. Content VULNERABILITY DETAILS: CVE ID: CVE-2012-5937 DESCRIPTION: A security vulnerability exists in the Sterling B2B Integrator CLA2 server...

OS Command Injection

arr-pm is vulnerable to OS command injection. A local attacker is able to inject and execute arbitrary OS commands, resulting in shell execution due to lack of validations in extract and files methods when the RPM contains a malicious payload compressor field...

CVE-2022-39224

Arr-pm is an RPM reader/writer library written in Ruby. Versions prior to 0.0.12 are subject to OS command injection resulting in shell execution if the RPM contains a malicious "payload compressor" field. This vulnerability impacts the extract and files methods of the RPM::File class of this...

CVE-2022-39224 Arbitrary shell execution when extracting or listing files contained in a malicious rpm.

Arr-pm is an RPM reader/writer library written in Ruby. Versions prior to 0.0.12 are subject to OS command injection resulting in shell execution if the RPM contains a malicious "payload compressor" field. This vulnerability impacts the extract and files methods of the RPM::File class of this...