CVE-2021-26612

An improper input validation leading to arbitrary file creation was discovered in copy method of Nexacro platform. Remote attackers use copy method to execute arbitrary command after the file creation included malicious code...

CVE-2021-44077

Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution. This is related to /RestAPI URLs in a servlet, and ImportTechnicians in the Struts configuration...

CVE-2021-38685

A command injection vulnerability has been reported to affect QNAP device, VioStor. If exploited, this vulnerability allows remote attackers to run arbitrary commands. We have already fixed this vulnerability in the following versions of QVR: QVR FW 5.1.6 build 20211109 and later...

The vulnerability of the debug_fcgid component in the D-Link DWR-932C E1 router microprogramming software allows a hacker to execute arbitrary commands.

The vulnerability of the debugfcgid component in the D-Link DWR-932C E1 router microprogramming software is related to the failure to take measures to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary...

The vulnerability of the CMA module in the FusionCompute virtualization software allows a hacker to execute arbitrary commands.

The vulnerability of the CMA module in FusionCompute virtualization software exists due to the lack of measures taken to neutralize the special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

PowerCMS XMLRPC API vulnerable to OS command injection

Overview PowerCMS XMLRPC API provided by Alfasado Inc. contains an OS command injection vulnerability CWE-78. Alfasado Inc. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and Alfasado Inc. coordinated under the Information Security Early Warning...

JVN#17645965: PowerCMS XMLRPC API vulnerable to OS command injection

PowerCMS XMLRPC API provided by Alfasado Inc. contains an OS command injection vulnerability CWE-78. Impact An arbitrary OS command may be executed by a remote attacker. Solution In the case that not using XMLRPC API: If using as CGI/FCGI Delete mt-xmlrpc.cgi or remove execute permission to...

CVE-2021-42784

OS Command Injection vulnerability in debugfcgi of D-Link DWR-932C E1 firmware allows a remote attacker to perform command injection via a crafted HTTP request...

CVE-2021-42784

OS Command Injection vulnerability in debugfcgi of D-Link DWR-932C E1 firmware allows a remote attacker to perform command injection via a crafted HTTP request...

CVE-2021-42785

Buffer Overflow in tvnviewer.exe of TightVNC Viewer allows a remote attacker to execute arbitrary instructions via a crafted FramebufferUpdate packet from a VNC server. Affected component: TightVNC Viewer (tvnviewer.exe); referenced version in the CVE context includes TightVNC Viewer 2.8.59. Root...

GNU gdbserver 9.2 Remote Command Execution

Exploit Title: GNU gdbserver 9.2 - Remote Command Execution RCE Date: 2021-11-21 Exploit Author: Roberto Gesteira Miñarro 7Rocky Vendor Homepage: https://www.gnu.org/software/gdb/ Software Link: https://www.gnu.org/software/gdb/download/ Version: GNU gdbserver Ubuntu 9.2-0ubuntu120.04 9.2 Tested...

CVE-2021-38873

IBM Planning Analytics 2.0 is potentially vulnerable to CSV Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 208396...

The vulnerability of the HEVC Video Extensions application, related to improper code generation, allows a perpetrator to execute arbitrary code.

The vulnerability of the HEVC Video Extensions application is related to incorrect code generation. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the Java library for determining, analyzing, checking, and migrating cron elements in cron-utils, related to improper code generation management, allows a perpetrator to execute arbitrary code.

The vulnerability of the Java library for determining, analyzing, checking, and migrating cron elements in cron-utils is related to improper code generation. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

APT Actors Exploiting Newly Identified Vulnerability in ManageEngine ADSelfService Plus

Summary This Joint Cybersecurity Advisory uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge ATT &CK® framework, Version 8. See the ATT&CK for Enterprise for referenced threat actor tactics and for techniques. This joint advisory is the result of analytic efforts between the...

Advantech R-SeeNet SQL注入漏洞

Advantech R-SeeNet is an industrial monitoring software from Advantech Taiwan, China. The software is based on the snmp protocol for monitoring platforms and is available for Linux and Windows platforms.Advantech R-SeeNet is vulnerable to SQL injection, which can be exploited by remote attackers ...

Advantech R-SeeNet SQL注入漏洞

Advantech R-SeeNet is an industrial monitoring software from Advantech Taiwan, China. The software is based on the snmp protocol for monitoring platforms and is available for Linux and Windows platforms.Advantech R-SeeNet is vulnerable to SQL injection, which can be exploited by remote attackers ...

Commvault CommCell DataProvider JavaScript Sandbox Escape Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the DataProvider class. T...

[SECURITY] [DLA 2823-1] salt security update

Debian LTS Advisory DLA-2823-1 [email protected] https://www.debian.org/lts/security/ Markus Koschany November 19, 2021 https://wiki.debian.org/LTS Package : salt Version : 2016.11.2+ds-1+deb9u8 CVE ID : CVE-2021-21996 Debian Bug : 994016 Jonathan Schlue discovered a vulnerability in...

GHSA-Q5MQ-6FJG-4MW8 SQL Injection in thinkjs

SQL injection vulnerability in the model.increment and model.decrement function in ThinkJS 3.2.10 allows remote attackers to execute arbitrary SQL commands via the step parameter...