EulerOS 2.0 SP5 : spamassassin (EulerOS-SA-2021-2230)

According to the version of the spamassassin package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - In Apache SpamAssassin before 3.4.5, malicious rule configuration .cf files can be configured to run system commands without any output or...

CVE-2021-28634

Acrobat Reader DC versions 2021.005.20054 and earlier, 2020.004.30005 and earlier and 2017.011.30197 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command. An authenticated attacker could leverage this vulnerability to achieve arbitrary code execution on...

Aruba ClearPass Policy Manager Command Injection Vulnerability (CNVD-2021-50187)

Aruba ClearPass Policy Manager is an application from Aruba, Inc. that provides a wireless network security access management system. Aruba ClearPass Policy Manager suffers from a command injection vulnerability that originates from the product not doing security checks on user input data, which...

Aruba ClearPass Policy Manager Command Injection Vulnerability (CNVD-2021-50186)

Aruba ClearPass Policy Manager is an application from Aruba, Inc. that provides a wireless network security access management system. Aruba ClearPass Policy Manager suffers from a command injection vulnerability that originates from the product not doing security checks on user input data, which...

QSAN Storage Manager Hardcoded Credentials Vulnerability

QSAN Storage Manager is a NAS operating system from Quantium Technologies Incorporated QSAN. A hard-coded credentials vulnerability exists in QSAN Storage Manager version 3.3.1 build 202101041800 and prior versions. An attacker can exploit this vulnerability to open the control interface via the...

Arbitrary File Write Vulnerability in ZengCMS

ZengCMS is a backend management system based on the latest TP6.0.x framework and Layui 2.5.x. ZengCMS suffers from an arbitrary file write vulnerability, which can be exploited by an attacker to write malicious files on the server and execute system commands...

The vulnerability of FortiWeb web applications’ network firewalls arises from the failure to take measures to neutralize special elements used in the operating system’s command set. This vulnerability allows attackers to execute arbitrary commands.

The vulnerability of FortiWeb web applications’ network firewalls exists due to the lack of measures taken to neutralize special elements used in the operating system’s command set. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely, using the SAML serve...

The vulnerability of Adobe After Effects’ video and dynamic image editing software lies in the lack of measures taken to neutralize special elements used in operating system commands, allowing a perpetrator to execute arbitrary OS commands on the target system.

The vulnerability of Adobe After Effects video and dynamic image editing software relates to the lack of measures taken to neutralize special elements used in operating system commands. Exploiting this vulnerability allows a malicious actor to remotely execute arbitrary OS commands on the target...

EulerOS 2.0 SP8 : velocity (EulerOS-SA-2021-1990)

According to the version of the velocity package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as...

Command injection

In Weidmueller Industrial WLAN devices in multiple versions an exploitable command injection vulnerability exists in the hostname functionality. A specially crafted entry to network configuration information can cause execution of arbitrary system commands, resulting in full control of the device...

CVE-2021-33534 WEIDMUELLER: WLAN devices affected by OS Command Injection vulnerability

In Weidmueller Industrial WLAN devices in multiple versions an exploitable command injection vulnerability exists in the hostname functionality. A specially crafted entry to network configuration information can cause execution of arbitrary system commands, resulting in full control of the device...

CVE-2021-35049

Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the web interface. The vulnerability could allow a specially crafted HTTP request to execute system commands on the CommandPost and return results in an HTTP response in an authenticated...

Command injection

Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the web interface. The vulnerability could allow a specially crafted HTTP request to execute system commands on the CommandPost and return results in an HTTP response in an authenticated...

The vulnerability of the node-notifier package, related to the failure to take measures to neutralize special elements used in operating system commands, allows a perpetrator to execute arbitrary code.

The vulnerability of the node-notifier package is related to the failure to take measures to neutralize special elements used in operating system commands. Exploiting this vulnerability allows an attacker to execute arbitrary code...

MyQ X 操作系统命令注入漏洞

MyQ X is an application of myq-solution. It neatly organizes past and active projects in one place and centralizes their management in one interface. A security vulnerability exists in MyQ X Smart versions prior to 8.2, which can be exploited by an attacker to inject arbitrary OS commands via the...

Include Me <= 1.2.1 - Authenticated Remote Code Execution (RCE) via LFI log poisoning

The plugin is vulnerable to path traversal / local file inclusion, which can lead to Remote Code Execution RCE of the system due to log poisoning and therefore potentially a full compromise of the underlying structure RCE through chaining LFI with log poisoning 1. Path Traversal / Local File...

Command Execution Vulnerability in TamronOS IPTV/VOD Systems

Weifang Home Station Electronic Technology Co., Ltd. is a professional technology company specializing in Linux routing, authentication billing, caching system, IPTV system, VOD system development. A command execution vulnerability exists in the TamronOS IPTV/VOD system, which can be exploited by...

Command Execution Vulnerability in NETSYS of Shenzhen Network Domain Technology Co. Ltd (CNVD-2021-43932)

Founded in 2004, Shenzhen Domain Technology Co., Ltd. is a national high-tech enterprise specializing in the research and development, production, sales and service of products in the field of network information security. A command execution vulnerability exists in Shenzhen NETSYS Technology Co...

FortiWeb OS Command Injection Vulnerability

FortiWeb is a Web Application Firewall WAF that protects hosted web applications from attacks targeting known and unknown vulnerabilities. An OS command injection vulnerability exists in the management interface of FortiWeb. A remote authenticated attacker could exploit this vulnerability to...

VulnCheck KEV: CVE-2020-24581

An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU2.31V1.1.47ae55. It contains an executecmd.cgi feature that is not reachable via the web user interface that lets an authenticated user execute Operating System commands...