15746 matches found
Fidelis Network Deception 命令注入漏洞
Fidelis Network Deception is a security product from Fidelis USA, Inc. A command injection vulnerability exists in versions prior to Fidelis Network Deception 9.4.5, which stems from the filename parameter of CommandPost when using the updatecheckfile value. Command injection exists, and an...
The vulnerability of the HTTP interface implementation for Zyxell network interfaces allows attackers to execute arbitrary commands.
The vulnerability of the HTTP interface implementation for Zyxell network interfaces relates to errors in processing input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely by introducing a specially crafted file...
SMA100 post-authentication Remote Command Execution vulnerability
Improper neutralization of special elements in the SonicWall SSL-VPN SMA100 series management interface allows a remote authenticated attacker to inject OS Command as a 'root' user which potentially leads to remote command execution vulnerability or denial of service DoS attack.IMPORTANT: SMA 100...
CVE-2021-42897
A remote command execution RCE vulnerability was found in FeMiner wms V1.0 in /wms/src/system/datarec.php. The $POSTrname is directly passed into the $mysqlstr and is executed by exec...
CVE-2021-42897
A remote command execution RCE vulnerability was found in FeMiner wms V1.0 in /wms/src/system/datarec.php. The $POSTrname is directly passed into the $mysqlstr and is executed by exec...
CVE-2021-42897
A remote command execution RCE vulnerability was found in FeMiner wms V1.0 in /wms/src/system/datarec.php. The $POSTrname is directly passed into the $mysqlstr and is executed by exec...
CVE-2021-42897
A remote command execution RCE vulnerability was found in FeMiner wms V1.0 in /wms/src/system/datarec.php. The $POSTrname is directly passed into the $mysqlstr and is executed by exec...
FeMiner wms 操作系统命令注入漏洞
FeMiner wms is a repository management system for individual developers of Front End Miner FeMiner in China. FeMiner wms version 1.0 suffers from an operating system command injection vulnerability that stems from a Remote Command Execution RCE vulnerability found in /wms/src/system/datarec.php...
Zyxel Firewall ZTP Unauthenticated Command Injection Exploit
This Metasploit module exploits CVE-2022-30525, an unauthenticated remote command injection vulnerability affecting Zyxel firewalls with zero touch provisioning ZTP support. By sending a malicious setWanPortSt command containing an mtu field with a crafted OS command to the /ztp/cgi-bin/handler...
Zyxel Firewall ZTP Unauthenticated Command Injection
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Zyxel Firewall ZTP Unauthenticated Command Injection', 'Description' = %q This module exploits CVE-2022-30525, an unauthenticated remote command...
karo Metacharacter Handling Remote Command Execution
The karo gem through 2.5.2 for Ruby allows Remote command injection via the host field. A flaw in db.rb is triggered when handling metacharacters. This may allow a remote attacker to execute arbitrary commands. In particular lines 76 and 95 as of 2014-06-01 pass unsanitized user supplied input to...
GHSA-8QHQ-RQ4J-8PRJ Elasticsearch Logstash allows remote attackers to execute arbitrary commands
Elasticsearch Logstash 1.0.14 through 1.4.x before 1.4.2 allows remote attackers to execute arbitrary commands via a crafted event in 1 zabbix.rb or 2 nagiosnsca.rb in outputs/...
Elasticsearch Logstash allows remote attackers to execute arbitrary commands
Elasticsearch Logstash 1.0.14 through 1.4.x before 1.4.2 allows remote attackers to execute arbitrary commands via a crafted event in 1 zabbix.rb or 2 nagiosnsca.rb in outputs/...
Bazaar allows remote attackers to execute arbitrary commands via a bzr+ssh URL with initial dash character in hostname
Bazaar through 2.7.0, when Subprocess SSH is used, allows remote attackers to execute arbitrary commands via a bzr+ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-16228, CVE-2017-1000116, and CVE-2017-1000117...
GHSA-X549-R7M8-GV63 SaltStack Salt Remote command execution and incorrect access control when using salt-api
SaltStack Salt 2016.11.x before 2016.11.10, 2017.7.x before 2017.7.8 and 2018.3.x before 2018.3.3 allow remote attackers to bypass authentication and execute arbitrary commands via salt-apinetapi...
Code injection in Apache Struts
A vulnerability introduced by forcing parameter inclusion in the URL and Anchor Tag allows remote command execution, session access and manipulation and XSS attacks. both the s:url and s:a tag provide an includeParams attribute. The main scope of that attribute is to understand whether includes...
The vulnerability of extensions for providing access to InTouch Access Anywhere and Plant SCADA Access Anywhere, related to the disclosure of information in the error data area, allows a intruder to execute arbitrary OS commands.
The vulnerability of extensions for providing access to InTouch Access Anywhere and Plant SCADA Access Anywhere relates to the disclosure of information in the error area of data. Exploiting this vulnerability could allow a malicious actor to execute arbitrary OS commands remotely...
The vulnerability in the web interface for managing microprogrammed software routers of Cisco Small Business RV340, RV340W, RV345, and R345P allows a hacker to execute arbitrary commands.
The vulnerability of the web-based management interface for Cisco Small Business RV340, RV340W, RV345, and R345P microprogramming devices is related to insufficient checking of arguments passed in commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands...
The vulnerability of the iControl REST API for BIG-IP application protection interfaces allows a attacker to execute arbitrary commands, modify or delete files.
The vulnerability of the iControl REST API for BIG-IP application protection interfaces is related to the lack of authentication checks for a critical function. Exploiting this vulnerability allows an attacker to execute arbitrary commands, modify or delete files remotely...
