CVE-2024-0005

A condition exists in FlashArray and FlashBlade Purity whereby a malicious user could execute arbitrary commands remotely through a specifically crafted SNMP configuration...

CVE-2024-26295

Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to comple...

CVE-2024-8957

PTZOptics PT30X-SDI/NDI-xx before firmware 6.3.40 is vulnerable to an OS command injection issue. The camera does not sufficiently validate the ntpaddr configuration value which may lead to arbitrary command execution when ntpclient is started. When chained with CVE-2024-8956, a remote and...

CVE-2025-25039

The CVE-2025-25039 entry concerns Hewlett Packard Enterprise Aruba ClearPass Policy Manager (CPPM) by way of its web-based management interface. The vulnerability allows remote authenticated users to execute arbitrary commands on the underlying host, with the impact described as executing command...

Zyxel VMG4325-B10A: Operating System Command Injection Vulnerability

The Zyxel VMG4325-B10A is a modem from China Heqin Zyxel. An operating system command injection vulnerability exists in the Zyxel VMG4325-B10A version 1.00AAFR.4C020170615. An attacker could exploit this vulnerability to execute operating system OS commands...

TOTOLINK X5000R Router Command Execution

The vulnerability of the setVpnAccountCfg function /web/cgi-bin/cstecgi.cgi of the TOTOLINK X5000R router’s microprogramming software is related to the failure to eliminate special elements used in the operating system’s command when processing the user parameter. Exploiting this vulnerability...

TOTOLINK X5000R Router Command Execution

The vulnerability of the setVpnAccountCfg function /web/cgi-bin/cstecgi.cgi of the TOTOLINK X5000R router’s microprogramming software is related to the failure to take measures to neutralize special elements used in the operating system’s command processing when handling the desc parameter...

TOTOLINK X5000R Router Arbitrary Command Execution

The vulnerability of the setVpnAccountCfg function located at web/cgi-bin/cstecgi.cgi in the TOTOLINK X5000R router’s microprogramming software is related to the failure to eliminate special elements used in the operating system’s command processing when handling the pass parameter. Exploiting th...

Advantive VeraCore security vulnerability

Advantive VeraCore is a SaaS order and warehouse management software from Advantive. A security vulnerability exists in Advantive VeraCore version 2025.1.0 and earlier, which stems from the presence of an SQL injection in timeoutWarning.asp that allows remote attackers to execute arbitrary SQL...

PT-2025-5620

Name of the Vulnerable Software and Affected Versions Advantive VeraCore versions through 2025.1.0 Description A SQL injection vulnerability in timeoutWarning.asp allows remote attackers to execute arbitrary SQL commands via the PmSess1 parameter. This issue is being actively exploited. The...

CVE-2024-52875

An issue was discovered in GFI Kerio Control 9.2.5 through 9.4.5. The dest GET parameter passed to the /nonauth/addCertException.cs and /nonauth/guestConfirm.cs and /nonauth/expiration.cs pages is not properly sanitized before being used to generate a Location HTTP header in a 302 HTTP response...

CVE-2024-52875

An issue was discovered in GFI Kerio Control 9.2.5 through 9.4.5. The dest GET parameter passed to the /nonauth/addCertException.cs and /nonauth/guestConfirm.cs and /nonauth/expiration.cs pages is not properly sanitized before being used to generate a Location HTTP header in a 302 HTTP response...

CVE-2024-52875

Kerio Control (GFI) versions 9.2.5–9.4.5 are affected by a CRLF/HTTP response splitting vulnerability that abuses the dest parameter in GET requests to generate a Location header in a 302 response, enabling Open Redirect and HTTP Response Splitting, which can lead to reflected XSS. The issue affe...

CVE-2024-52875

An issue was discovered in GFI Kerio Control 9.2.5 through 9.4.5. The dest GET parameter passed to the /nonauth/addCertException.cs and /nonauth/guestConfirm.cs and /nonauth/expiration.cs pages is not properly sanitized before being used to generate a Location HTTP header in a 302 HTTP response...

CVE-2024-52875

An issue was discovered in GFI Kerio Control 9.2.5 through 9.4.5. The dest GET parameter passed to the /nonauth/addCertException.cs and /nonauth/guestConfirm.cs and /nonauth/expiration.cs pages is not properly sanitized before being used to generate a Location HTTP header in a 302 HTTP response...

CVE-2024-52875: Improper Neutralization of CRLF Sequences in HTTP Headers

An issue was discovered in GFI Kerio Control 9.2.5 through 9.4.5. The dest GET parameter passed to the /nonauth/addCertException.cs and /nonauth/guestConfirm.cs and /nonauth/expiration.cs pages is not properly sanitized before being used to generate a Location HTTP header in a 302 HTTP response...

CVE-2025-24505

This vulnerability allows a high-privileged authenticated PAM user to achieve remote command execution on the affected PAM system by uploading a specially crafted upgrade file...

CVE-2025-24505

Technical details about CVE-2025-24505, including affected products, versions, root cause, and fixes, are not publicly available in the provided connected documents. Monitor for updates.

CVE-2025-24505

This vulnerability allows a high-privileged authenticated PAM user to achieve remote command execution on the affected PAM system by uploading a specially crafted upgrade file...

CVE-2025-24505

This vulnerability allows a high-privileged authenticated PAM user to achieve remote command execution on the affected PAM system by uploading a specially crafted upgrade file...