CVE-2021-20696

DAP-1880AC firmware version 1.21 and earlier allows a remote authenticated attacker to execute arbitrary OS commands by sending a specially crafted request to a specific CGI program...

Command Execution Vulnerability in Firewall Gateway Management System of Shenzhen Hechen Communication Technology Co.

Yoyo is a registered trademark of Shenzhen Hechen Communication Technology Co., Ltd, founded in 1998, the main products are Mailgard Yoyo series mail servers, mail archiving, spam filtering gateway, mail gateway, global mail gateway, mail load balancing gateway, firewalls, VPNs, etc. Yoyo is the...

Command Execution Vulnerability in the Media Server of Zhejiang YUV Technology Co.

Founded in 2011, Zhejiang Yusi Technology Co., Ltd Yusi is a global solution provider for public safety and intelligent transportation. A command execution vulnerability exists in the media server of Zhejiang YUV Technology Co. Ltd, which can be exploited by an attacker to execute system commands...

Command Execution Vulnerability in Apache Axis

Apache Axis2 is a core support engine for Web services. A command execution vulnerability exists in Apache Axis. An attacker can exploit the vulnerability to execute arbitrary system commands...

The vulnerability of the DestIP parameter in the microprogramming software for industrial Ethernet switches Moxa MGate 5105-MB-EIP allows a hacker to enhance their privileges or execute arbitrary code.

The vulnerability of the DestIP parameter in the microprogrammed industrial Ethernet switch Moxa MGate 5105-MB-EIP relates to the lack of measures to neutralize special elements used in the operating system commands. Exploiting this vulnerability can allow a remote attacker to increase their...

Symantec Security Analytics Web UI 操作系统命令注入漏洞

Symantec Security Analytics Web UI is an application from Symantec Corporation, USA. Symantec Security Analytics suffers from an operating system command injection vulnerability that results from improper input validation. An unauthenticated, remote attacker could use this vulnerability to send...

Updated velocity packages fix security vulnerability

An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify velocity templates running Apache...

Updated spamassassin packages fix security vulnerability

In Apache SpamAssassin before 3.4.5, malicious rule configuration .cf files can be configured to run system commands without any output or errors. With this, exploits can be injected in a number of scenarios. In addition to upgrading to SA version 3.4.5, users should only use update channels or 3...

PT-2021-14497 · Grav · Grav Admin Plugin

Name of the Vulnerable Software and Affected Versions: Grav Admin Plugin versions 1.10.7 and earlier Description: The issue allows an unauthenticated user to execute certain methods of the administrator controller without credentials, resulting in arbitrary YAML file creation or modification. Thi...

The vulnerability of the Accellion FTA security management system, which stems from the failure to remove special elements used in the operating system’s command set, allows attackers to execute arbitrary commands and gain unauthorized access to protected information.

The vulnerability of the Accellion FTA File Transfer Application security system lies in the lack of measures to neutralize special elements used in the operating system’s commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely and gain unauthorized...

Okta Access Gateway 操作系统命令注入漏洞

Okta Access Gateway is an application gateway from Okta UK. It addresses this issue by effectively protecting access to local applications on the same platform that protects your cloud applications, infrastructure and APIs. A security vulnerability exists in Okta Access Gateway before 2020.9.3,...

Fedora: Security Advisory for busybox (FEDORA-2021-2024803354)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2021-25924

In GoCD, versions 19.6.0 to 21.1.0 are vulnerable to Cross-Site Request Forgery due to missing CSRF protection at the /go/api/config/backup endpoint. An attacker can trick a victim to click on a malicious link which could change backup configurations or execute system commands in the...

CVE-2021-25924

In GoCD, versions 19.6.0 to 21.1.0 are vulnerable to Cross-Site Request Forgery due to missing CSRF protection at the /go/api/config/backup endpoint. An attacker can trick a victim to click on a malicious link which could change backup configurations or execute system commands in the...

Cross site request forgery (csrf)

In GoCD, versions 19.6.0 to 21.1.0 are vulnerable to Cross-Site Request Forgery due to missing CSRF protection at the /go/api/config/backup endpoint. An attacker can trick a victim to click on a malicious link which could change backup configurations or execute system commands in the...

CVE-2021-25924

In GoCD, versions 19.6.0 to 21.1.0 are vulnerable to Cross-Site Request Forgery due to missing CSRF protection at the /go/api/config/backup endpoint. An attacker can trick a victim to click on a malicious link which could change backup configurations or execute system commands in the...

Code execution vulnerability exists in SEACMS (CNVD-2021-26197)

SEACMS is a video-on-demand system designed for webmasters with different needs. A code execution vulnerability exists in SEACMS. An attacker can exploit this vulnerability to inject malicious code, execute system commands, and obtain system privileges...

[SECURITY] Fedora 33 Update: busybox-1.32.1-1.fc33

Busybox is a single binary which includes versions of a large number of system commands, including a shell. This package can be very useful for recovering from certain types of system failures, particularly those involving broken shared libraries...

Aruba Access Points 操作系统命令注入漏洞

Aruba Instant is a cloud-hosted controller-less wireless access point. A command injection vulnerability exists in the command line interface of Aruba Instant, which can be exploited by an attacker to execute arbitrary commands in the underlying operating system...

Apache SpamAssassin Injection Vulnerability

Apache SpamAssassin is an open source spam filter from the Apache USA Foundation. The product provides system administrators with a filter and support for categorizing email to block spam. An injection vulnerability exists in Apache SpamAssassin versions prior to 3.4.5 that allows configuration o...