Privilege escalation

Improper privilege management vulnerability in default.cmd file in PowerPanel Business Local/Remote for Windows v4.8.6 and earlier, PowerPanel Business Management for Windows v4.8.6 and earlier, PowerPanel Business Local/Remote for Linux 32bit v4.8.6 and earlier, PowerPanel Business Local/Remote...

Design/Logic Flaw

White Rabbit Switch contains a vulnerability which makes it possible for an attacker to perform system commands under the context of the web application the default installation makes the webserver run as the root user...

CVE-2023-22581

CVE-2023-22581 affects White Rabbit Switch. The vulnerability enables an attacker to execute system commands within the web application context because the default installation runs the webserver as root. The CVSS 3.1 metrics indicate a Critical impact (HIGH for confidentiality, integrity, and av...

Cisco SD-WAN vManage Software Arbitrary File Deletion Vulnerability

A vulnerability in the CLI of Cisco SDWAN vManage Software could allow an authenticated, local attacker to delete arbitrary files. This vulnerability is due to improper filtering of directory traversal character sequences within system commands. An attacker with administrative privileges could...

CVE-2023-25759

OS Command Injection in TripleData Reporting Engine in Tripleplay Platform releases prior to Caveman 3.4.0 allows authenticated users to run unprivileged OS level commands via a crafted request payload...

PT-2023-20282 · Unknown · Tripledata Reporting Engine +1

Name of the Vulnerable Software and Affected Versions: Tripleplay Platform versions prior to 3.4.0 Description: The issue allows authenticated users to run unprivileged OS level commands via a crafted request payload. This is due to an OS Command Injection in the TripleData Reporting Engine...

Cisco SD-WAN vManage Software Arbitrary File Deletion (cisco-sa-sdwan-vmanage-wfnqmYhN)

According to its self-reported version, Cisco SD-WAN Viptela Software is affected by a vulnerability. - A vulnerability in the CLI of Cisco SDWAN vManage Software could allow an authenticated, local attacker to delete arbitrary files. This vulnerability is due to improper filtering of directory...

The vulnerability of the mySCADA myPRO industrial process visualization and control system lies in the lack of measures to neutralize special elements used in the operating system’s commands. This allows attackers to execute arbitrary commands.

The vulnerability of the mySCADA myPRO industrial process visualization and control system exists due to the failure to take measures to neutralize special elements used in the operating system’s commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remote...

PT-2023-2168 · Myscada · Myscada Mypro

Name of the Vulnerable Software and Affected Versions: mySCADA myPRO versions 8.26.0 and prior Description: The issue exists due to the lack of measures to neutralize special elements used in operating system commands. This could allow a remote attacker to execute arbitrary commands. An...

The vulnerability of the graphical and application software interface of the FortiTester hardware-based diagnostic and audit software exists due to the failure to take measures to neutralize the special elements used in the operating system’s command set. This allows attackers to execute arbitrary commands.

The vulnerability of the graphical and application software interface of the FortiTester hardware-based diagnostic and audit software exists due to the failure to take measures to neutralize the special elements used in the operating system command set. Exploiting this vulnerability allows a...

GLPI Cartography Plugin v6.0.0 - Unauthenticated Remote Code Execution Vulnerability

Exploit Title: GLPI Cartography Plugin v6.0.0 - Unauthenticated Remote Code Execution RCE Application: GLPI Cartography...

Command injection

The web configuration service of the affected device contains an authenticated command injection vulnerability. It can be used to execute system commands on the operating system OS from the device in the context of the user "root." If the attacker has credentials for the web service, then the...

CVE-2023-0432 CVE-2023-0432

The web configuration service of the affected device contains an authenticated command injection vulnerability. It can be used to execute system commands on the operating system OS from the device in the context of the user "root." If the attacker has credentials for the web service, then the...

CVE-2023-28726

Panasonic AiSEG2 versions 2.80F through 2.93A allows remote attackers to execute arbitrary OS commands...

Panasonic AiSEG2 操作系统命令注入漏洞

Panasonic AiSEG2 is a series of home IoT products from Panasonic Corporation Panasonic of Japan. A security vulnerability exists in Panasonic AiSEG2 version 2.80F through 2.93A. An attacker could exploit the vulnerability to execute arbitrary operating system commands...

CVE-2023-24837 HGiga PowerStation - Command Injection

HGiga PowerStation remote management function has insufficient filtering for user input. An authenticated remote attacker with general user privilege can exploit this vulnerability to inject and execute arbitrary system commands to perform arbitrary system operation or disrupt service...

CVE-2023-24837

CVE-2023-24837 describes a command-injection flaw in HGiga PowerStation’s remote management function. Insufficient input filtering lets an authenticated remote user with general privileges inject and execute arbitrary system commands, potentially taking arbitrary system actions or disrupting serv...

PT-2023-21858 · Pymedusa · Pymedusa

Name of the Vulnerable Software and Affected Versions: pymedusa versions prior to 1.0.12 Description: pymedusa is an automatic video library manager for TV Shows. An attacker with access to the web interface can update the git executable path in /config/general/ advanced settings with arbitrary O...

PT-2023-19815 · Softnext Technologies · Spam Sqr

Name of the Vulnerable Software and Affected Versions: Softnext Technologies Corp.’s SPAM SQR affected versions not specified Description: The issue concerns a Code Injection vulnerability within a specific function of the software. An authenticated remote attacker with administrator privilege ca...

CVE-2023-24837 HGiga PowerStation - Command Injection

HGiga PowerStation remote management function has insufficient filtering for user input. An authenticated remote attacker with general user privilege can exploit this vulnerability to inject and execute arbitrary system commands to perform arbitrary system operation or disrupt service...