Hamastar MeetingHub Paperless Meetings 安全漏洞

Hamastar MeetingHub Paperless Meetings is a paperless e-meeting software from China-based Hamastar. A security vulnerability exists in Hamastar MeetingHub Paperless Meetings version 2021, which stems from an unrestricted file upload vulnerability that could allow a remote authenticated user to...

CVE-2019-16639

An issue was found on the Ruijie EG-2000 series gateway. There is a newcli.php API interface without access control, which can allow an attacker who only has web interface access to use TELNET commands and/or show admin passwords via the modeurl=exec&command= substring. This affects EG-2000SE...

CVE-2023-36485

The workflow-engine of ILIAS before 7.23 and 8 before 8.3 allows remote authenticated users to run arbitrary system commands on the application server as the application user via a malicious BPMN2 workflow definition file...

aEnrich a+HRD 代码问题漏洞

aEnrich a+HRD is a full-service human resources development solution from Acer China aEnrich. A code issue vulnerability exists in aEnrich Technology a+HRD, which stems from a deserialization vulnerability in the presence of untrusted data. An unauthenticated, remote attacker could use this...

Malicious code in prize-market (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 1158c7ff397e59bc3ac71f973b0f8011d57ebb50ed376f780513195f5c97f596 Malicious packages campaign since 2021 targeting developers, steals source code and secrets Source: ghsa-malware...

Dell VxRail 安全漏洞

Dell VxRail is Dell's single HCI platform for every VMware workload and use case, including VDI, compute-intensive applications, and for hosting legacy and modern applications on a true hybrid cloud infrastructure. A security vulnerability exists in Dell VxRail version 7.0.410, which stems from a...

CVE-2022-44620

Improper authentication vulnerability in UDR-JA1604/UDR-JA1608/UDR-JA1616 firmware versions 71x10.1.107112.43A and earlier allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter the device settings...

PYSEC-2022-42982

A vulnerability in Example Dags of Apache Airflow allows an attacker with UI access who can trigger DAGs, to execute arbitrary commands via manually provided runid parameter. This issue affects Apache Airflow Apache Airflow versions prior to 2.4.0...

CVE-2022-2234

An authenticated mySCADA myPRO 8.26.0 user may be able to modify parameters to run commands directly in the operating system...

Tenable Network Security Nessus操作系统命令注入漏洞

Tenable Network Security Nessus is an open source system vulnerability scanner from Tenable Network Security. An operating system command injection vulnerability exists in Tenable Network Security Nessus version 10.1.3 and earlier versions, which can be exploited by an authenticated attacker to...

CVE-2022-22182

A Cross-site Scripting XSS vulnerability in Juniper Networks Junos OS J-Web allows an attacker to construct a URL that when visited by another user enables the attacker to execute commands with the target's permissions, including an administrator. This issue affects: Juniper Networks Junos OS 12....

Gradio 安全漏洞

gradio is an open source framework. gradio is vulnerable to arbitrary code injection. The vulnerability automatically runs these commands and can be exploited by an attacker to run arbitrary commands on a user's computer...

DEBIAN-CVE-2021-3781

A trivial sandbox enabled with the -dSAFER option escape flaw was found in the ghostscript interpreter by injecting a specially crafted pipe command. This flaw allows a specially crafted document to execute arbitrary commands on the system in the context of the ghostscript interpreter. The highes...

VulnCheck KEV: CVE-2017-6079

The HTTP web-management application on Edgewater Networks Edgemarc appliances has a hidden page that allows for user-defined commands such as specific iptables routes, etc., to be set. You can use this page as a web shell essentially to execute commands, though you get no feedback client-side...

CVE-2021-1540

Multiple vulnerabilities in the authorization process of Cisco ASR 5000 Series Software StarOS could allow an authenticated, remote attacker to bypass authorization and execute a subset of CLI commands on an affected device. For more information about these vulnerabilities, see the Details sectio...

SUSE: Security Advisory (SUSE-SU-2019:2666-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

UBUNTU-CVE-2021-3144

In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration. They might be used to run command against the salt master or minions...

CVE-2021-1257 Cisco DNA Center Cross-Site Request Forgery Vulnerability

A vulnerability in the web-based management interface of Cisco DNA Center Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack to manipulate an authenticated user into executing malicious actions without their awareness or consent. The...

Command Execution Vulnerability in Ocean CMS (CNVD-2020-69482)

Ocean CMS seacms, Ocean Video Management System is a video-on-demand system designed for webmasters with different needs. A command execution vulnerability exists in the background of Ocean CMS. Attackers can use this vulnerability to write malicious code to execute system commands and obtain...

Siemens License Management Utility (LMU) Elevation of Privilege Vulnerability

License Management Utility LMU is a unified license management system for Siemens Building Automation products such as Desigo CC and ABT. An elevation of privilege vulnerability exists in Siemens License Management Utility LMU. This allows a locally authenticated attacker to execute arbitrary...