PT-2022-15630 · Synology · Synology Diskstation Manager

Name of the Vulnerable Software and Affected Versions: Synology DiskStation Manager DSM versions prior to 6.2.4-25553 Description: The issue is related to improper neutralization of special elements used in an OS command, allowing remote attackers to execute arbitrary commands via unspecified...

Veritas NetBackup 安全漏洞

Veritas NetBackup is a storage service from Veritas, Inc. that is used to provide backup and recovery capabilities for enterprise environments. The software supports the detection of ransomware and backup protection of environmental data such as metadata and virtual environments. A security...

PT-2022-18517 · Synology · Synology Audio Station

Name of the Vulnerable Software and Affected Versions: Synology Audio Station versions prior to 6.5.4-3367 Description: The issue is related to a buffer copy without checking the size of the input, also known as a 'Classic Buffer Overflow' vulnerability, in the cgi component. This allows remote...

CVE-2022-36956

In Veritas NetBackup, the NetBackup Client allows arbitrary command execution from any remote host that has access to a valid host-id NetBackup certificate/private key from the same domain. The affects 9.0.x through 9.0.0.1 and 9.1.x through 9.1.0.1...

The vulnerability of the clntudp_call function (sunrpc/clnt_udp.c) in the GNU C library (glibc or libc6) relates to writing beyond the buffer boundaries in memory. This allows an attacker to insert and execute arbitrary commands or cause a service denial.

The vulnerability of the clntudpcall function sunrpc/clntudp.c in the GNU C library glibc or libc6 is related to writing beyond the buffer boundaries in memory. Exploiting this vulnerability allows a remote attacker to inject and execute arbitrary commands, or cause service failures using special...

CVE-2022-35873

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition 8.1.15 b2022030114. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw...

CVE-2022-35872

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition 8.1.15 b2022030114. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw...

CVE-2022-35871

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition 8.1.15 b2022030114. Authentication is not required to exploit this vulnerability. The specific flaw exists within the authenticateAdSso method. The issue results from th...

PT-2022-4536 · Unknown · Prestashop

Name of the Vulnerable Software and Affected Versions: PrestaShop versions 1.6.0.10 through 1.7.x before 1.7.8.2 Description: The issue is related to a lack of protection against SQL injection attacks, allowing remote attackers to execute arbitrary code. This vulnerability has been exploited in t...

Input validation

Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated, remote attacker to execute arbitrary code on an affected device or cause the device to restart unexpectedly, resulting in a denial of...

The vulnerability of Firefox browser for iOS lies in the lack of protection for SQL query structures, allowing attackers to execute arbitrary SQL commands.

The vulnerability of Firefox browser for iOS is related to the lack of protection for SQL query structures. Exploiting this vulnerability allows a malicious actor to send specially crafted data to the application and execute arbitrary SQL commands remotely...

CVE-2022-20903 Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Remote Command Execution and Denial of Service Vulnerabilities

Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated, remote attacker to execute arbitrary code on an affected device or cause the device to restart unexpectedly, resulting in a denial of...

CVE-2022-20877 Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Remote Command Execution and Denial of Service Vulnerabilities

Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated, remote attacker to execute arbitrary code on an affected device or cause the device to restart unexpectedly, resulting in a denial of...

CVE-2022-33318

Deserialization of Untrusted Data vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric ICONICS Suite versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions...

Vulnerability of the njs_value_own_enumerate() function (src/njs_value.c) in the njs interpreter of the nginx server, allowing a hacker to execute arbitrary code

The vulnerability of the njsvalueownenumerate function src/njsvalue.c in the njs interpreter of the nginx server is related to the execution of an operation outside of the buffer in memory. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

The vulnerability of the Apache Spark framework’s interface, allowing a perpetrator to execute arbitrary commands

The vulnerability of the Apache Spark framework interface is related to insufficient checking of arguments passed in commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

PT-2022-3784 · Cisco · Cisco Nexus Dashboard

Name of the Vulnerable Software and Affected Versions: Cisco Nexus Dashboard affected versions not specified Description: The issue is related to multiple vulnerabilities in the Cisco Nexus Dashboard, which could allow an unauthenticated, remote attacker to execute arbitrary commands, read or...

Medium: vim

Issue Overview: Use after free in appendcommand in GitHub repository vim/vim prior to 8.2.4895. This vulnerability is capable of crashing software, Bypass Protection Mechanism, Modify Memory, and possible remote execution CVE-2022-1616 Heap-based Buffer Overflow in function cmdlineerasechars in...

phicomm Feixun fir302b A2 操作系统命令注入漏洞

The PHICOMM Feixun fir302b A2 is a router from China's Feixun PHICOMM. The Feixun fir302b A2 suffers from an operating system command injection vulnerability that stems from the discovery of a Remote Command Execution RCE vulnerability via the Ping function...

Roxy-WI 命令注入漏洞

Roxy-WI is an open source web interface for managing Haproxy, Nginx and Keepalived servers. A command injection vulnerability exists in Roxy-WI versions prior to 6.1.1.0, which stems from the ability to remotely run system commands via the subprocessexecute function...