12706 matches found
ZTE MF286R Command Injection Vulnerability (CNVD-2023-99925)
The ZTE MF286R is a wireless router from China's ZTE Corporation ZTE. A command injection vulnerability exists in the ZTE MF286R CRLVWRGBMF286RV1.0.0B04 version, which originates from an application that fails to properly filter constructed command special characters, commands, and so on. An...
PYSEC-2023-161
GitPython is a python library used to interact with Git repositories. When resolving a program, Python/Windows look for the current working directory, and after that the PATH environment. GitPython defaults to use the git command, if a user runs GitPython from a repo has a git.exe or git...
CVE-2023-1997
An OS Command Injection vulnerability exists in SIMULIA 3DOrchestrate from Release 3DEXPERIENCE R2021x through Release 3DEXPERIENCE R2023x. A specially crafted HTTP request can lead to arbitrary command execution...
Command injection
An OS Command Injection vulnerability exists in SIMULIA 3DOrchestrate from Release 3DEXPERIENCE R2021x through Release 3DEXPERIENCE R2023x. A specially crafted HTTP request can lead to arbitrary command execution...
CVE-2023-1997 OS Command Injection vulnerability affecting SIMULIA 3DOrchestrate from Release 3DEXPERIENCE R2021x through Release 3DEXPERIENCE R2023x
An OS Command Injection vulnerability exists in SIMULIA 3DOrchestrate from Release 3DEXPERIENCE R2021x through Release 3DEXPERIENCE R2023x. A specially crafted HTTP request can lead to arbitrary command execution...
CVE-2023-40590: Untrusted Search Path
GitPython is a python library used to interact with Git repositories. When resolving a program, Python/Windows look for the current working directory, and after that the PATH environment. GitPython defaults to use the git command, if a user runs GitPython from a repo has a git.exe or git...
CVE-2023-1997: Improper Neutralization of Special Elements used in an OS Command
An OS Command Injection vulnerability exists in SIMULIA 3DOrchestrate from Release 3DEXPERIENCE R2021x through Release 3DEXPERIENCE R2023x. A specially crafted HTTP request can lead to arbitrary command execution...
IBM InfoSphere Information Server security vulnerabilities
IBM InfoSphere Information Server is a set of data integration platforms from International Business Machines IBM. The platform can be used to integrate data information obtained from various sources. A CSV injection vulnerability exists in IBM InfoSphere Information Server version 11.7, which...
PT-2023-18745
Name of the Vulnerable Software and Affected Versions IBM InfoSphere Information Server version 11.7 Description A remote attacker could execute arbitrary commands on the system due to improper validation of csv file contents, potentially allowing for CSV Injection. This issue could be exploited ...
CVE-2023-32757
e-Excellence U-Office Force file uploading function does not restrict upload of file with dangerous type. An unauthenticated remote attacker without logging the service can exploit this vulnerability to upload arbitrary files to perform arbitrary command or disrupt service...
CVE-2023-32757 e-Excellence U-Office Force - Arbitrary File Upload
e-Excellence U-Office Force file uploading function does not restrict upload of file with dangerous type. An unauthenticated remote attacker without logging the service can exploit this vulnerability to upload arbitrary files to perform arbitrary command or disrupt service...
CVE-2023-25649: Improper Neutralization of Special Elements used in a Command
There is a command injection vulnerability in a mobile internet product of ZTE. Due to insufficient validation of SETDEVICELED interface parameter, an authenticated attacker could use the vulnerability to execute arbitrary commands...
D-Link DAR-8000 Operating System Command Injection Vulnerability
D-Link DAR-8000 is the Internet Behavior Audit Gateway from China AUO D-Link. The D-Link DAR-8000-10 version suffers from an operating system command injection vulnerability, which originates from the parameter id of the file /app/sys1.php failing to correctly filter construct command special...
CVE-2023-32757: Unrestricted Upload of File with Dangerous Type
e-Excellence U-Office Force file uploading function does not restrict upload of file with dangerous type. An unauthenticated remote attacker without logging the service can exploit this vulnerability to upload arbitrary files to perform arbitrary command or disrupt service...
Arbitrary Command Injection
shescape is vulnerable to Arbitrary Command Injection. The vulnerability exists in threaded contexts on Windows, which results in improper escaping of shells, which allows an attacker to bypass shell sanitization...
CVE-2023-37469: Improper Neutralization of Special Elements used in a Command
CasaOS is an open-source personal cloud system. Prior to version 0.4.4, if an authenticated user using CasaOS is able to successfully connect to a controlled SMB server, they are able to execute arbitrary commands. Version 0.4.4 contains a patch for the issue...
CVE-2023-40144
The CVE-2023-40144 entry concerns an OS command injection in CBC CBC products. The vulnerability allows a remote authenticated attacker to execute arbitrary OS commands on the device or alter its settings. Affected models include CBC AMERICA NR-4M/NR-8M/NR-16M/NR-4F/NR-8F/NR-16F series and DR-16M...
PT-2023-5555 · Nagios +3 · Nagios +3
Name of the Vulnerable Software and Affected Versions: Nagios nagios-plugins version 2.4.5 Description: The issue concerns arbitrary command execution via ProxyCommand, LocalCommand, and PermitLocalCommand with $IFS in the check by ssh component of Nagios nagios-plugins. This allows a remote...
CVE-2023-24517
Unrestricted Upload of File with Dangerous Type vulnerability in the Pandora FMS File Manager component, allows an attacker to make make use of this issue unrestricted file upload to execute arbitrary system commands. This issue affects Pandora FMS v767 version and prior versions on all platforms...
