Wavestore VMS 6.48.809 Remote Code Execution

Wavestore VMS version 6.48.809 contains a command injection vulnerability in the venusd /simple/export endpoint. An authenticated remote attacker can inject shell metacharacters into the user parameter, which is URL-decoded and passed without sanitization to a command executed through popen...

Wavestore VMS 6.48.809 Remote Code Execution

Wavestore VMS version 6.48.809 contains a command injection vulnerability in the venusd /simple/export endpoint. An authenticated remote attacker can inject shell commands through the user parameter, resulting in arbitrary command execution with root-equivalent privileges. The included proof of...