CVE-2022-22684

Improper neutralization of special elements used in an OS command 'OS Command Injection' vulnerability in task management component in Synology DiskStation Manager DSM before 6.2.4-25553 allows remote authenticated users to execute arbitrary commands via unspecified vectors...

Command injection

In Veritas NetBackup, the NetBackup Client allows arbitrary command execution from any remote host that has access to a valid host-id NetBackup certificate/private key from the same domain. The affects 9.0.x through 9.0.0.1 and 9.1.x through 9.1.0.1...

Security Bulletin: OpenSSL for IBM i is vulnerable to arbitrary command execution (CVE-2022-2068)

Summary OpenSSL is vulnerable to arbitrary command execution due to improper validation of input by creshash script as described in the vulnerability details section. IBM i has addressed the vulnerability in OpenSSL with a fix as described in the remediation/fixes section. Vulnerability Details...

CVE-2022-36956: Undefined Security Weakness

In Veritas NetBackup, the NetBackup Client allows arbitrary command execution from any remote host that has access to a valid host-id NetBackup certificate/private key from the same domain. The affects 9.0.x through 9.0.0.1 and 9.1.x through 9.1.0.1...

PT-2022-23703 · Veritas · Netbackup

Name of the Vulnerable Software and Affected Versions: Veritas NetBackup versions 9.0.0.1 through 9.1.0.1 Description: The issue allows arbitrary command execution from any remote host that has access to a valid host-id NetBackup certificate/private key from the same domain. Recommendations: For...

Airflow Arbitrary Command Execution

The vulnerability of the software used for creating, monitoring, and orchestrating data processing scripts in Airflow is related to the lack of protective measures taken for the website structure. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

Webmin Package Updates RCE

This module exploits an arbitrary command injection in Webmin versions prior to 1.997. Webmin uses the OS package manager apt, yum, etc. to perform package updates and installation. Due to a lack of input sanitization, it is possibe to inject arbitrary command that will be concatenated to the...

CVE-2022-35131

Joplin v2.8.8 allows attackers to execute arbitrary commands via a crafted payload injected into the Node titles...

CVE-2022-35131

Joplin v2.8.8 allows attackers to execute arbitrary commands via a crafted payload injected into the Node titles...

CVE-2022-35131

Joplin v2.8.8 allows attackers to execute arbitrary commands via a crafted payload injected into the Node titles...

CVE-2022-35131

Joplin v2.8.8 allows attackers to execute arbitrary commands via a crafted payload injected into the Node titles...

CVE-2022-35131

CVE-2022-35131 affects Joplin v2.8.8, enabling arbitrary command execution via a crafted payload injected into Node titles. The root cause is unsafe handling of user input in the UI, specifically unescaped input passed to dangerouslySetInnerHTML in GotoAnything.tsx. Several sources corroborate an...

CVE-2022-34571: Direct Request

An access control issue in Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 allows attackers to obtain the system key information and execute arbitrary commands via accessing the page syslog.shtml...

PT-2022-8885 · Unknown · Git-Archive

Name of the Vulnerable Software and Affected Versions: git-archive versions all Description: The issue concerns Command Injection via the exports function. This allows for potential execution of arbitrary commands. Recommendations: For all versions, consider disabling the exports function as a...

VPN Router Config Rollback Arbitrary Command Execution

The vulnerability of the configrollback function implementation in the Robustel R1510 VPN router software lies in the lack of measures taken to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands b...

CVE-2022-20857

Multiple vulnerabilities in Cisco Nexus Dashboard could allow an unauthenticated, remote attacker to execute arbitrary commands, read or upload container image files, or perform a cross-site request forgery attack. For more information about these vulnerabilities, see the Details section of this...

CVE-2022-20857: Missing Authentication for Critical Function

Multiple vulnerabilities in Cisco Nexus Dashboard could allow an unauthenticated, remote attacker to execute arbitrary commands, read or upload container image files, or perform a cross-site request forgery attack. For more information about these vulnerabilities, see the Details section of this...

CVE-2022-20861: Missing Authentication for Critical Function

Multiple vulnerabilities in Cisco Nexus Dashboard could allow an unauthenticated, remote attacker to execute arbitrary commands, read or upload container image files, or perform a cross-site request forgery attack. For more information about these vulnerabilities, see the Details section of this...

CVE-2022-20858: Missing Authentication for Critical Function

Multiple vulnerabilities in Cisco Nexus Dashboard could allow an unauthenticated, remote attacker to execute arbitrary commands, read or upload container image files, or perform a cross-site request forgery attack. For more information about these vulnerabilities, see the Details section of this...

CVE-2022-34866

CVE-2022-34866 affects Passage Drive and Passage Drive for Box: vulnerable components are interprocess communication data verification in Passage Drive v1.4.0–v1.5.1.0 and Passage Drive for Box v1.0.0. Root cause is insufficient data verification for IPC, allowing a malicious program to execute a...