TIBCO JasperReports Server 8.0.2 Community Edition Code Execution

Advisory ID: SYSS-2022-041 Product: JasperReports Server Manufacturer: TIBCO Software Inc. Tested Versions: 8.0.2 Community Edition Vulnerability Type: CWE-502: Deserialization of Untrusted Data Risk Level: High Solution Status: Fixed Manufacturer Notification: 2022-06-10 Solution Date: 2022-08-1...

CVE-2022-38094

OS command injection vulnerability in the telnet function of CentreCOM AR260S V2 firmware versions prior to Ver.3.3.7 allows a remote authenticated attacker to execute an arbitrary OS command...

Planex Holding SmaCam CS-QR10和SmaCam Night Vision CS-QR20 授权问题漏洞

Planex Holding SmaCam CS-QR10 and Planex Holding SmaCam Night Vision CS-QR20 are both products of Planex Holding, Japan.Planex Holding SmaCam CS-QR10 is a networked smart camera. Holding SmaCam Night Vision CS-QR20 is a network camera. A security vulnerability exists in all versions of the SmaCam...

CVE-2021-28398

A privileged attacker in GeoNetwork before 3.12.0 and 4.x before 4.0.4 can use the directory harvester before-script to execute arbitrary OS commands remotely on the hosting infrastructure. A User Administrator or Administrator account is required to perform this. This occurs in the runBeforeScri...

The vulnerability of the KDDI Home Spot Cube2 router’s microprogramming software lies in the lack of measures to neutralize the special elements used in the operating system’s command set, allowing attackers to execute arbitrary operating system commands.

The vulnerability of the microprogrammed software of the KDDI Home Spot Cube2 relates to the failure to take measures to neutralize special elements used in the operating system’s commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands of the operating syste...

CVE-2022-2234

An authenticated mySCADA myPRO 8.26.0 user may be able to modify parameters to run commands directly in the operating system...

Movable Type 代码注入漏洞

Six Apart Movable Type MT is a blogging system from Six Apart USA. The system includes features such as multiple users, comments, quotes, and topics. A code injection vulnerability exists in Movable Type that originates from a specially crafted message that can be sent to the Movable Type XMLRPC...

CVE-2022-35733

Missing authentication for critical function vulnerability in UNIMO Technology digital video recorders UDR-JA1004/JA1008/JA1016 firmware versions v1.0.20.13 and earlier, and UDR-JA1016 firmware versions v2.0.20.13 and earlier allows a remote unauthenticated attacker to execute an arbitrary OS...

mySCADA myPRO 操作系统命令注入漏洞

mySCADA myPRO is a software application. myPRO is a professional HMI/SCADA system designed for the visualization and control of industrial processes. An operating system command injection vulnerability exists in versions of mySCADA myPRO prior to 8.26.0. The vulnerability stems from an improper...

The vulnerability of the Reolink RLC-410W camera’s microprogramming software arises from the lack of measures taken to neutralize the special elements used in the operating system’s command set. This allows a intruder to execute arbitrary commands.

The vulnerability of the Reolink RLC-410W IP camera’s microprogramming software exists due to the lack of measures taken to neutralize the special elements used in the operating system’s commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

The vulnerability of the Reolink RLC-410W IP camera’s microprogramming software arises from the lack of measures taken to neutralize the special elements used in the operating system’s command set. This vulnerability allows a intruder to execute arbitrary commands.

The vulnerability of the Reolink RLC-410W IP camera’s microprogramming software exists due to the lack of measures taken to neutralize the special elements used in the operating system’s commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

PT-2022-4991 · Planex · Planex Mzk-Dp150N

Name of the Vulnerable Software and Affected Versions: Planex MZK-DP150N versions 1.42 through 1.43 Description: The issue is related to insecure permissions in the administration interface, allowing attackers to execute system commands as root via the etc ro/web/syscmd.asp file. This can be...

F5 BIG-IP iControl REST Session Expiration Time Insufficient Vulnerability Vulnerability

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, remote access policy management, etc. A session expiration time insufficient vulnerability exists in F5 BIG-IP iControl REST, which stems from the fact that after...

Nintendo Wi-Fi Network Adaptor WAP-001 操作系统命令注入漏洞

The Nintendo Wi-Fi Network Adaptor WAP-001 is a network adapter from Nintendo of Japan. A security vulnerability exists in the Nintendo Wi-Fi Network Adaptor WAP-001 that could allow a user with access to the product management page to execute arbitrary operating system commands...

openSUSE 15 Security Update : phpPgAdmin (openSUSE-SU-2022:10065-1)

The remote SUSE Linux SUSE15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-SU-2022:10065-1 advisory. - phppgadmin through 7.12.1 allows sensitive actions to be performed without validating that the request originated from the application. One such...

CVE-2022-27483

A improper neutralization of special elements used in an os command 'os command injection' in Fortinet FortiManager version 7.0.0 through 7.0.3, 6.4.0 through 6.4.7, 6.2.x and 6.0.x and FortiAnalyzer version 7.0.0 through 7.0.3, version 6.4.0 through 6.4.7, 6.2.x and 6.0.x allows attacker to...

The vulnerability of the Standard Operation and Monitoring function in distributed control systems such as CENTUM VP and CENTUM VP Entry Class allows attackers to execute arbitrary commands.

The vulnerability of the Standard Operation and Monitoring function in distributed control systems such as CENTUM VP and CENTUM VP Entry Class exists due to the lack of measures taken to neutralize special elements used in the operating system commands. Exploiting this vulnerability can allow...

The vulnerability of the modular interface between web servers and web applications in Rack, related to improper neutralization of special elements used in operating system commands, allows attackers to execute arbitrary shell commands on the target system.

The vulnerability of the modular interface between web servers and Rack web applications is related to improper input validation during data processing, as transmitted through the intermediate software Rack Lint and CommonLogger. Exploiting this vulnerability allows a remote attacker to send...

CVE-2022-31137

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Versions prior to 6.1.1.0 are subject to a remote code execution vulnerability. System commands can be run remotely via the subprocessexecute function without processing the inputs received from the user in the...

CVE-2022-22555

Dell EMC PowerStore, contains an OS command injection Vulnerability. A locally authenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the PowerStore underlying OS, with the privileges of the vulnerable application. Exploitation ma...