2615 matches found
The vulnerability of the microprogrammed software of the cloud-controlled switch Ruijie Reyee series RG-ES200 allows a intruder to execute arbitrary code.
The vulnerability of the microprogrammed cloud-controlled switch Ruijie Reyee series RG-ES200 is related to the lack of measures taken to neutralize special elements used in the OS command. Exploiting this vulnerability can allow a remote attacker to execute arbitrary code...
GHSA-X9R9-48RM-4XM6 FitNesse allows execution of arbitrary OS commands
FitNesse all releases allows a remote authenticated attacker to execute arbitrary OS commands...
CVE-2024-28254 SpEL Injection in `GET /api/v1/events/subscriptions/validation/condition/<expr>` in OpenMetadata
OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration. The AlertUtil::validateExpression method evaluates an SpEL expression using getValue which by default uses the...
Fluid Security Vulnerability
Fluid is an open source Kubernetes native distributed dataset orchestrator and gas pedal from the Cloud Native Computing Foundation Foundation for data-intensive applications such as big data and AI applications. A security vulnerability exists in versions of Fluid prior to v0.9.3. An attacker...
CVE-2023-42286
There is a PHP file inclusion vulnerability in the template configuration of eyoucms v1.6.4, allowing attackers to execute code or system commands through a carefully crafted malicious payload...
CVE-2023-42286
There is a PHP file inclusion vulnerability in the template configuration of eyoucms v1.6.4, allowing attackers to execute code or system commands through a carefully crafted malicious payload...
CVE-2023-42286
Summary: CVE-2023-42286 affects eyoucms v1.6.4 and is a PHP file inclusion vulnerability in the template configuration that can lead to code execution or command execution when a crafted payload is processed. The CVSSv3.1 score is 9.8 (CRITICAL), with network attack vector, no privileges required...
CVE-2023-42286
There is a PHP file inclusion vulnerability in the template configuration of eyoucms v1.6.4, allowing attackers to execute code or system commands through a carefully crafted malicious payload...
BIT-ESPOCRM-2022-38844
CSV Injection in Create Contacts in EspoCRM 7.1.8 allows remote authenticated users to run system commands via creating contacts with payloads capable of executing system commands. Admin user exporting contacts in CSV file may end up executing the malicious system commands on his system...
CVE-2024-27889
Multiple SQL Injection vulnerabilities exist in the reporting application of the Arista Edge Threat Management - Arista NG Firewall NGFW. A user with advanced report application access rights can exploit the SQL injection, allowing them to execute commands on the underlying operating system with...
Cross-site Request Forgery (CSRF)
phpPgAdmin is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability is due to insufficient validation of the request source in the "database.php" area of phpPgAdmin. This allows sensitive actions to be performed without proper verification of the request's origin. A remote attacker can...
The vulnerability of the File Transfer Protocol (FTP) implementation in the microprogrammed networking devices of ZyXEL USG FLEX, USG FLEX 50(W)/USG20(W)-VPN, USG FLEX H, and ATP allows a perpetrator to execute arbitrary commands.
The vulnerability of the File Transfer Protocol FTP implementation in microprogrammed network devices such as ZyXEL USG FLEX, USG FLEX 50W/USG20W-VPN, USG FLEX H, and ATP lies in the lack of measures to neutralize special elements used in operating system commands during the loading of binary...
The vulnerability of the FontForge font editing software lies in its lack of measures to neutralize special elements used in operating system commands, allowing attackers to execute arbitrary commands.
The vulnerability of the FontForge font editing software exists because measures to neutralize special elements have not been taken. Exploiting this vulnerability allows an attacker to execute arbitrary commands...
The vulnerability of the FontForge font editing software lies in its lack of measures to neutralize special elements used in operating system commands, allowing attackers to execute arbitrary commands.
The vulnerability of the FontForge font editing software exists because measures to neutralize special elements have not been taken. Exploiting this vulnerability allows an attacker to execute arbitrary commands...
CVE-2023-49959
In Indo-Sol PROFINET-INspektor NT through 2.4.0, a command injection vulnerability in the gedtupdater service of the firmware allows remote attackers to execute arbitrary system commands with root privileges via a crafted filename parameter in POST requests to the /api/updater/ctrl/startupdate...
Command injection
In Indo-Sol PROFINET-INspektor NT through 2.4.0, a command injection vulnerability in the gedtupdater service of the firmware allows remote attackers to execute arbitrary system commands with root privileges via a crafted filename parameter in POST requests to the /api/updater/ctrl/startupdate...
PT-2024-13841 · Indo Sol · Indo-Sol Profinet-Inspektor Nt
Name of the Vulnerable Software and Affected Versions: Indo-Sol PROFINET-INspektor NT versions 2.4.0 and earlier Description: A command injection issue in the gedtupdater service of the firmware allows remote attackers to execute arbitrary system commands with root privileges. This is achieved vi...
CVE-2023-49959
In Indo-Sol PROFINET-INspektor NT through 2.4.0, a command injection vulnerability in the gedtupdater service of the firmware allows remote attackers to execute arbitrary system commands with root privileges via a crafted filename parameter in POST requests to the /api/updater/ctrl/startupdate...