CVE-2021-27201

Endian Firewall Community aka EFW 3.3.2 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in a backup comment...

CVE-2021-27201

Endian Firewall Community aka EFW 3.3.2 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in a backup comment...

Design/Logic Flaw

Endian Firewall Community aka EFW 3.3.2 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in a backup comment...

CVE-2021-27201

Endian Firewall Community aka EFW 3.3.2 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in a backup comment...

CVE-2020-11920

An issue was discovered in Svakom Siime Eye 14.1.00000001.3.330.0.0.3.14. A command injection vulnerability resides in the HOST/IP section of the NFS settings menu in the webserver running on the device. By injecting Bash commands via shell metacharacters here, the device executes arbitrary code...

Command injection

The Patient Portal of OpenEMR 5.0.2.1 is affected by a Command Injection vulnerability in /interface/main/backup.php. To exploit the vulnerability, an authenticated attacker can send a POST request that executes arbitrary OS commands via shell metacharacters...

CVE-2021-25310

The administration web interface on Belkin Linksys WRT160NL 1.0.04.002US20130619 devices allows remote authenticated attackers to execute system commands with root privileges via shell metacharacters in the uilanguage POST parameter to the apply.cgi form endpoint. This occurs in doupgradepost in...

CVE-2021-25310

The administration web interface on Belkin Linksys WRT160NL 1.0.04.002US20130619 devices allows remote authenticated attackers to execute system commands with root privileges via shell metacharacters in the uilanguage POST parameter to the apply.cgi form endpoint. This occurs in doupgradepost in...

Belkin LINKSYS WRT160NL 操作系统命令注入漏洞

The Belkin LINKSYS WRT160NL is a wireless router from Belkin USA. A security vulnerability exists in Belkin Linksys WRT160NL 1.0.04.002US20130619, which stems from a failure to properly filter special characters, commands, etc. within it. A remote authenticated attacker could execute system...

OS Command Injection in async-git

The async-git package before 1.13.2 for Node.js allows OS Command Injection via shell metacharacters, as demonstrated by git.reset and git.tag. This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. Ensure to sanitize untrusted us...

GHSA-6C3F-P5WP-34MH OS Command Injection in async-git

The async-git package before 1.13.2 for Node.js allows OS Command Injection via shell metacharacters, as demonstrated by git.reset and git.tag. This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. Ensure to sanitize untrusted us...

CVE-2013-2512

The ftpd gem 0.2.1 for Ruby allows remote attackers to execute arbitrary OS commands via shell metacharacters in a LIST or NLST command argument within FTP protocol traffic...

CVE-2013-2512

The CVE-2013-2512 entry concerns the ftpd gem for Ruby (version 0.2.1). Affected component: the FTP command handling (LIST/NLST) that accepts arguments containing shell metacharacters. Root cause: improper sanitization allows remote attackers to execute arbitrary OS commands through crafted FTP t...

CVE-2021-3190

The async-git package before 1.13.2 for Node.js allows OS Command Injection via shell metacharacters, as demonstrated by git.reset and git.tag...

CVE-2021-3190

The async-git package before 1.13.2 for Node.js allows OS Command Injection via shell metacharacters, as demonstrated by git.reset and git.tag...

Command injection

The async-git package before 1.13.2 for Node.js allows OS Command Injection via shell metacharacters, as demonstrated by git.reset and git.tag...

CVE-2020-35576

A Command Injection issue in the traceroute feature on TP-Link TL-WR841N V13 JP with firmware versions prior to 201216 allows authenticated users to execute arbitrary code as root via shell metacharacters, a different vulnerability than CVE-2018-12577...

Omrilotan async-git OS Command Injection Vulnerability

Omrilotan async-git is a Javascript-based codebase from the individual developers of Omrilotan that supports interaction with git repositories. Omrilotan async-git package before 1.13.2 contains an operating system command injection vulnerability that allows injection of operating system commands...

CVE-2020-35576

A Command Injection issue in the traceroute feature on TP-Link TL-WR841N V13 JP with firmware versions prior to 201216 allows authenticated users to execute arbitrary code as root via shell metacharacters, a different vulnerability than CVE-2018-12577...

Command Injection

Overview async-git is a 👾 Retrieve data from current git repository Affected versions of this package are vulnerable to Command Injection via shell metacharacters, as demonstrated by git.reset and git.tag. POC git.reset'; touch HACKED '; // file "HACKED" was created git.tag'; touch HACKED '; //...