Tp-link Tapo C200 Command Injection Vulnerability

A command injection vulnerability exists in Tp-link Tapo C200 1.1.15 and previous firmware versions, which is caused by the presence of a uhttpd binary file that runs as root by default and lacks filtering and escaping. An unauthenticated attacker could use this vulnerability to execute system...

CVE-2022-24408

A vulnerability has been identified in SINUMERIK MC All versions V1.15 SP1, SINUMERIK ONE All versions V6.15 SP1. The sc SUID binary on affected devices provides several commands that are used to execute system commands or modify system files. A specific set of operations using sc could allow loc...

CVE-2022-24408

CVE-2022-24408 affects Siemens SINUMERIK MC (all versions prior to v1.15 SP1) and SINUMERIK ONE (all versions prior to v6.15 SP1). The issue is due to the sc SUID binary, which exposes commands that can be used to execute system commands or modify files; this leads to improper privilege managemen...

Fortinet FortiWLM Command Injection Vulnerability

A command injection vulnerability exists in Fortinet FortiWLC, a wireless LAN controller from Fortinet, which stems from a failure to properly validate input data in the alert dashboard and controller configuration handler. HTTP requests and execute arbitrary operating system commands on the targ...

JetBrains TeamCity OS Command Injection Vulnerability Vulnerability

JetBrains TeamCity is a distributed build management and continuous integration tool from JetBrains Czech Republic. JetBrains TeamCity is vulnerable to an operating system command injection vulnerability that stems from a lack of filtering and escaping of system commands in the Agent Push feature...

PT-2022-8392

Name of the Vulnerable Software and Affected Versions Hicos citizen certificate client-side component affected versions not specified Description The Hicos citizen certificate client-side component does not filter special characters for command parameters in specific web URLs. An unauthenticated...

PT-2022-17182

Name of the Vulnerable Software and Affected Versions JetBrains TeamCity versions prior to 2021.2.3 Description The issue concerns an OS command injection vulnerability in the Agent Push feature configuration. This vulnerability allows for the execution of arbitrary system commands, potentially...

PT-2022-17113 · Jenkins · Jenkins Pipeline: Shared Groovy Libraries Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Pipeline: Shared Groovy Libraries Plugin versions 552.vd9cc05b8a2e1 and earlier Jenkins Pipeline: Shared Groovy Libraries Plugin version 2.18.1 Jenkins Pipeline: Shared Groovy Libraries Plugin version 2.21.1 Description: The issue...

The vulnerability of the software responsible for creating, monitoring, and orchestrating data processing scripts in Airflow lies in the failure to take measures to neutralize special elements used in the OS commands. This allows a malicious actor to execute arbitrary commands with superuser privileges.

The vulnerability of the software used for creating, monitoring, and orchestrating data processing scripts in Airflow is related to the lack of measures taken to neutralize special elements used in the OS commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary comman...

Joplin Vulnerable to Code Injection

Joplin prior to version 2.7.1 allows remote attackers to execute system commands through malicious code in user search results...

GHSA-8478-53PV-JXVM Joplin Vulnerable to Code Injection

Joplin prior to version 2.7.1 allows remote attackers to execute system commands through malicious code in user search results...

AlmaLinux 8 : spamassassin (ALSA-2021:4315)

The remote AlmaLinux 8 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2021:4315 advisory. - In Apache SpamAssassin before 3.4.5, malicious rule configuration .cf files can be configured to run system commands without any output or errors. With this,...

Design/Logic Flaw

Joplin 2.6.10 allows remote attackers to execute system commands through malicious code in user search results...

CVE-2022-23340

Joplin 2.6.10 allows remote attackers to execute system commands through malicious code in user search results...

CVE-2022-23340

Joplin 2.6.10 is affected by a remote code execution vulnerability where malicious code in user search results can execute system commands. Root cause cited across multiple sources is code injection in the HTML rendering/processing path (stripHtml/html entity handling) enabling command execution....

CVE-2022-23340

Joplin 2.6.10 allows remote attackers to execute system commands through malicious code in user search results...

CVE-2022-23340

Joplin 2.6.10 allows remote attackers to execute system commands through malicious code in user search results...

QEMU Monitor HMP migrate Command Execution Exploit

This Metasploit module uses QEMU's Monitor Human Monitor Interface HMP TCP server to execute system commands using the migrate command. This module has been tested successfully on QEMU version 6.2.0 on Ubuntu 20.04. This module requires Metasploit: https://metasploit.com/download Current source:...

PT-2022-15940

Name of the Vulnerable Software and Affected Versions Joplin versions 2.6.10 through 2.7.0 Joplin versions prior to 2.7.1 Description The issue allows remote attackers to execute system commands through malicious code in user search results. Recommendations For Joplin versions 2.6.10 through 2.7....

ELECOM lan 安全漏洞

ELECOM lan is a router from ELECOM Japan. A security vulnerability exists in ELECOM LAN routers that stems from a hidden function vulnerability in ELECOM LAN routers. The vulnerability can be exploited by an attacker to execute arbitrary operating system commands over an unspecified vector on a...