CVE-2024-43774 Huachu Easytest Online Learning Test Platform - SQL Injection

SQL Injection in download personal learning course function of Easytest Online Test Platform ver.24E01 and earlier allow remote authenticated users to execute arbitrary SQL commands via the uid parameter...

CVE-2024-43774 Huachu Easytest Online Learning Test Platform - SQL Injection

SQL Injection in download personal learning course function of Easytest Online Test Platform ver.24E01 and earlier allow remote authenticated users to execute arbitrary SQL commands via the uid parameter...

CVE-2024-7871

CVE-2024-7871: SQL Injection in the online dictionary function of Easytest Online Test Platform (versions 24E01 and earlier). Root cause: vulnerable handling of the word parameter enables arbitrary SQL execution by remote authenticated users. Impact notes (from CVSS): high confidentiality, integr...

PT-2024-38648 · Unknown · Easytest Online Test Platform

Name of the Vulnerable Software and Affected Versions: Easytest Online Test Platform versions 24E01 and earlier Description: The issue allows remote authenticated users to execute arbitrary SQL commands via the word parameter in the online dictionary function. This can potentially lead to...

CVE-2024-6117

A Unrestricted upload of file with dangerous type vulnerability in meeting management function in Hamastar MeetingHub Paperless Meetings 2021 allows remote authenticated users to perform arbitrary system commands via a crafted ASP file...

CVE-2024-6117

CVE-2024-6117 affects Hamastar MeetingHub Paperless Meetings (version 2021). Multiple connected sources describe an unrestricted upload of files with dangerous types in the meeting management function, enabling remote authenticated users to execute arbitrary system commands via a crafted ASP file...

Hamastar MeetingHub Paperless Meetings 安全漏洞

Hamastar MeetingHub Paperless Meetings is a paperless e-meeting software from China-based Hamastar. A security vulnerability exists in Hamastar MeetingHub Paperless Meetings version 2021, which stems from an unrestricted file upload vulnerability that could allow a remote authenticated user to...

CVE-2024-41135

A vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateway's Command Line Interface that allows remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation of this vulnerability will result in the ability to execute arbitrary commands as...

CVE-2024-41133

A vulnerability exists in the HPE Aruba Networking EdgeConnect SD-WAN gateway's Command Line Interface that allows remote authenticated users to run arbitrary commands on the underlying host. Successful exploitation of this vulnerability will result in the ability to execute arbitrary commands as...

CVE-2024-41135

The CVE-2024-41135 affects HPE Aruba Networking EdgeConnect SD-WAN gateway CLI. The vulnerability allows remote authenticated users to execute arbitrary commands on the underlying host with root privileges, enabling complete system compromise. Documented impact is high (CVSS 3.1: AV:N/AC:L/PR:H/U...

CVE-2024-41134

CVE-2024-41134 affects HPE Aruba Networking EdgeConnect SD-WAN gateway CLI. The vulnerability allows remote authenticated users to execute arbitrary commands on the underlying host with root privileges, potentially leading to full system compromise. Documented impact is high (CVSS 3.1: 7.2, Netwo...

CVE-2024-41133

CVE-2024-41133 affects the HPE Aruba Networking EdgeConnect SD-WAN gateway Command Line Interface. The vulnerability allows remote authenticated users to execute arbitrary commands on the underlying host with root privileges, potentially leading to complete system compromise. The public CVSS v3.1...

CVE-2024-30213

CVE-2024-30213 affects StoneFly Storage Concentrator (SC and SCVM) prior to version 8.0.4.26. The issue allows remote authenticated users to perform command injection via a Ping URL, leading to remote code execution. Affected versions: SC/SCVM before 8.0.4.26. Mitigation: update to 8.0.4.26 or la...

rejetto HFS vulnerable to OS Command Execution by remote authenticated users

rejetto HFS aka HTTP File Server 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users if they have Upload permissions. This occurs because a shell is used to execute df i.e., with execSync instead of spawnSync in childprocess in Node.js...

GHSA-5F4X-HWV2-W9W2 rejetto HFS vulnerable to OS Command Execution by remote authenticated users

rejetto HFS aka HTTP File Server 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users if they have Upload permissions. This occurs because a shell is used to execute df i.e., with execSync instead of spawnSync in childprocess in Node.js...

CVE-2024-39943

rejetto HFS aka HTTP File Server 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users if they have Upload permissions. This occurs because a shell is used to execute df i.e., with execSync instead of spawnSync in childprocess in Node.js...

CVE-2024-39943

rejetto HFS aka HTTP File Server 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users if they have Upload permissions. This occurs because a shell is used to execute df i.e., with execSync instead of spawnSync in childprocess in Node.js...

CVE-2024-39943

CVE-2024-39943 affects rejetto HFS (HTTP File Server) before v0.52.10 on Linux/UNIX/macOS. The root cause is that the server executes OS commands via a shell (execSync) to run df during file upload, enabling remote authenticated users with Upload permissions to achieve remote code execution. Conn...

PT-2024-28745 · Rejetto · Rejetto Hfs

Name of the Vulnerable Software and Affected Versions: rejetto HFS aka HTTP File Server versions 3 before 0.52.10 Description: The issue allows OS command execution by remote authenticated users who have Upload permissions. This occurs because a shell is used to execute df with execSync instead o...

CVE-2024-39351

A vulnerability regarding improper neutralization of special elements used in an OS command 'OS Command Injection' is found in the NTP configuration. This allows remote authenticated users with administrator privileges to execute arbitrary commands via unspecified vectors. The following models wi...