Design/Logic Flaw

An issue was discovered in CALDERA 2.8.1. It contains multiple startup "requirements" that execute commands when starting the server. Because these commands can be changed via the REST API, an authenticated user can insert arbitrary commands that will execute when the server is restarted...

CVE-2021-42559

CVE-2021-42559 : CALDERA 2.8.1 and earlier contains multiple startup “requirements” that execute commands when starting the server. The commands can be modified via the REST API, allowing an authenticated user to insert arbitrary commands that will execute on restart. This is a command-injection ...

EUVD-2021-29529

An issue was discovered in CALDERA 2.8.1. When activated, the Human plugin passes the unsanitized name parameter to a python "os.system" function. This allows attackers to use shell metacharacters e.g., backticks "" or dollar parenthesis "$" in order to escape the current command and execute...

CVE-2021-42559: Improper Neutralization of Special Elements used in a Command

An issue was discovered in CALDERA 2.8.1. It contains multiple startup "requirements" that execute commands when starting the server. Because these commands can be changed via the REST API, an authenticated user can insert arbitrary commands that will execute when the server is restarted...

TP-Link TL-WR802N Router Command Injection

The vulnerability of TP-Link TL-WR802N router’s microprogramming software exists due to the lack of measures taken to neutralize the special elements used in the operating system’s commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

CVE-2021-44458

Linux users running Lens 5.2.6 and earlier could be compromised by visiting a malicious website. The malicious website could make websocket connections from the victim's browser to Lens and so operate the local terminal feature. This would allow the attacker to execute arbitrary commands as the...

PT-2022-1556

Name of the Vulnerable Software and Affected Versions D-Link DI-7200G V2.E1 version 21.04.09E1 Description The issue is related to insufficient input validation in the urlrd opt.asp file of the D-Link DI-7200G V2.E1 router's firmware, specifically with the url en parameter. This allows a remote...

PT-2022-1560

Name of the Vulnerable Software and Affected Versions D-Link DI-7200G versions V2.E1 Description The issue is related to insufficient input data cleaning in the upgrade filter function of the D-Link DI-7200G router's firmware, specifically affecting the path and time parameters. This allows a...

CVE-2021-44458: Improper Authentication

Linux users running Lens 5.2.6 and earlier could be compromised by visiting a malicious website. The malicious website could make websocket connections from the victim's browser to Lens and so operate the local terminal feature. This would allow the attacker to execute arbitrary commands as the...

PT-2022-12122 · Lens · Lens

Name of the Vulnerable Software and Affected Versions: Lens versions 5.2.6 and earlier Description: The issue allows attackers to execute arbitrary commands as the Lens user by making websocket connections from the victim's browser to Lens, enabling operation of the local terminal feature, when a...

PT-2022-2096

Name of the Vulnerable Software and Affected Versions CENTUM CS 3000 versions from R3.08.10 to R3.09.00 CENTUM VP versions from R4.01.00 to R4.03.00 CENTUM VP versions from R5.01.00 to R5.04.20 CENTUM VP versions from R6.01.00 to R6.08.00 Exaopc versions from R3.72.00 to R3.79.00 Description The...

GHSA-756H-R2C9-QP5J An authenticated user can execute arbitrary command in Gerapy

Impact An authenticated user can execute arbitrary command, see more in https://github.com/Gerapy/Gerapy/issues/211. Patches Fixed in 0.9.9...

An authenticated user can execute arbitrary command in Gerapy

Impact An authenticated user can execute arbitrary command, see more in https://github.com/Gerapy/Gerapy/issues/211. Patches Fixed in 0.9.9...

PT-2021-7480

Name of the Vulnerable Software and Affected Versions Moxa OnCell G3150A-LTE versions affected versions not specified Moxa OnCell G3470A-LTE versions affected versions not specified Moxa WDR-3124A versions affected versions not specified Moxa AWK-3131A versions affected versions not specified Mox...

Lantronix PremierWave 2050 Buffer Overflow Vulnerability

The Lantronix PremierWave 2050 is an embedded enterprise Wi-Fi module from Lantronix, Inc. The Lantronix PremierWave 2050 version 8.9.0.0R4 is vulnerable to a buffer overflow vulnerability that could be exploited by an attacker to send specially designed HTTP requests for arbitrary command...

Lantronix PremierWave 2050 OS Command Injection Vulnerability (CNVD-2022-04974)

The Lantronix PremierWave 2050 is an embedded Wi-Fi module manufactured by Lantronix.The Web Manager FsTFtp feature of the Lantronix PremierWave 2050 8.9.0.0R4 is vulnerable to an operating system command injection vulnerability that could be exploited by an attacker with a specially crafted HTTP...

Lantronix PremierWave 2050 OS Command Injection Vulnerability (CNVD-2022-04973)

The PremierWave 2050 is an embedded Wi-Fi module manufactured by Lantronix.The Web Manager SslGenerateCSR feature of the Lantronix PremierWave 2050 8.9.0.0R4 is vulnerable to OS command injection, which can be exploited by attackers to cause arbitrary command execution with the help of specially...

Lantronix PremierWave 2050 OS Command Injection Vulnerability (CNVD-2022-04975)

The Lantronix PremierWave 2050 is an embedded Wi-Fi module manufactured by Lantronix. The Lantronix PremierWave 2050 is vulnerable to an operating system command injection vulnerability that could be exploited by an attacker to cause arbitrary command execution in the "EC keypasswd" parameter wit...

PT-2021-5843

Name of the Vulnerable Software and Affected Versions NETGEAR RBR50 versions prior to 2.7.3.22 NETGEAR RBS50 versions prior to 2.7.3.22 NETGEAR RBK50 versions prior to 2.7.3.22 Description The issue is related to the disclosure of sensitive information in certain NETGEAR devices. Exploitation of...

Netgear RBR750 and NETGEAR have command injection vulnerabilities

Netgear RBR750 and NETGEAR are both products of Netgear, Inc.RBR750 is a home WiFi system.NETGEAR is a router. A hardware device that connects two or more networks and acts as a gateway between networks. NETGEAR suffers from a command injection vulnerability that arises from a network system or...