8816 matches found
CVE-2022-4221
Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Asus NAS-M25 allows an unauthenticated attacker to inject arbitrary OS commands via unsanitized cookie values.This issue affects NAS-M25: through 1.0.1.7...
CVE-2022-4221
Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Asus NAS-M25 allows an unauthenticated attacker to inject arbitrary OS commands via unsanitized cookie values.This issue affects NAS-M25: through 1.0.1.7...
Command injection
Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Asus NAS-M25 allows an unauthenticated attacker to inject arbitrary OS commands via unsanitized cookie values.This issue affects NAS-M25: through 1.0.1.7...
CVE-2022-4221 OS command injection in ASUS M25 NAS
Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Asus NAS-M25 allows an unauthenticated attacker to inject arbitrary OS commands via unsanitized cookie values.This issue affects NAS-M25: through 1.0.1.7...
CVE-2022-4221 OS command injection in ASUS M25 NAS
Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Asus NAS-M25 allows an unauthenticated attacker to inject arbitrary OS commands via unsanitized cookie values.This issue affects NAS-M25: through 1.0.1.7...
ASB-A-253344080
Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code...
ASUS NAS-M25: Operating System Command Injection Vulnerability
The ASUS NAS-M25 is a storage server from Asus China. A security vulnerability exists in ASUS NAS-M25 version 1.0.1.7 and prior versions, which stems from an improperly neutralized special element used OS Command Injection vulnerability that allows an unauthenticated attacker to inject arbitrary...
PT-2022-26313 · Asus · Asus Nas-M25
Name of the Vulnerable Software and Affected Versions: Asus NAS-M25 versions through 1.0.1.7 Description: The issue is related to an improper neutralization of special elements used in an OS command, allowing an unauthenticated attacker to inject arbitrary OS commands via unsanitized cookie value...
CVE-2022-4221: Improper Neutralization of Special Elements used in an OS Command
Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Asus NAS-M25 allows an unauthenticated attacker to inject arbitrary OS commands via unsanitized cookie values.This issue affects NAS-M25: through 1.0.1.7...
CVE-2022-4034
The Appointment Hour Booking Plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.3.72. This makes it possible for unauthenticated attackers to embed untrusted input into content during booking creation that may be exported as a CSV file when a site's...
WordPress plugin Simple:Press cross-site scripting vulnerabilities
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A reflective cross-site...
CVE-2022-3603
The Export customers list csv for WooCommerce, WordPress users csv, export Guest customer list WordPress plugin before 2.0.69 does not validate data when outputting it back in a CSV file, which could lead to CSV injection...
WordPress plugin: Exports customer list in CSV format for WooCommerce – Security vulnerabilities
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. WordPress Export customers...
Remote code execution
Remote code execution vulnerability can be achieved by using cookie values as paths to a file by this builder program. A remote attacker could exploit the vulnerability to execute or inject malicious code...
OESA-2022-2115 golang security update
The Go Programming Language. Security Fixes: Due to unsanitized NUL values, attackers may be able to maliciously set environment variables on Windows. In syscall.StartProcess and os/exec.Cmd, invalid environment variable values containing NUL values are not properly checked for. A malicious...
PT-2022-25687 · Eyoom Co. +1 · Eyoom Builder
Name of the Vulnerable Software and Affected Versions: Builder program affected versions not specified Description: The issue allows for remote code execution by utilizing cookie values as paths to a file. This can be exploited by a remote attacker to execute or inject malicious code...
CVE-2022-2721
In affected versions of Octopus Server it is possible for target discovery to print certain values marked as sensitive to log files in plaint-text in when verbose logging is enabled...
PT-2022-18297 · Unknown · Octopus Server
Name of the Vulnerable Software and Affected Versions: Octopus Server affected versions not specified Description: The issue allows target discovery to print certain sensitive values to log files in plain-text when verbose logging is enabled. Recommendations: At the moment, there is no informatio...
CVE-2022-41158: Improper Limitation of a Pathname to a Restricted Directory
Remote code execution vulnerability can be achieved by using cookie values as paths to a file by this builder program. A remote attacker could exploit the vulnerability to execute or inject malicious code...