CVE-2021-21875: Improper Neutralization of Special Elements used in an OS Command

A specially-crafted HTTP request can lead to arbitrary command execution in EC keypasswd parameter. An attacker can make an authenticated HTTP request to trigger this vulnerability...

PT-2021-14808 · Lantronix · Premierwave 2050 Firmware

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned. Description: A specially-crafted HTTP request can lead to arbitrary command execution in the keypasswd parameter. An attacker can make an authenticated HTTP request to trigger this issue. The...

PT-2021-6256

Name of the Vulnerable Software and Affected Versions NETGEAR R7900P versions prior to 1.4.2.84 NETGEAR R7960P versions prior to 1.4.2.84 NETGEAR R8000 versions prior to 1.0.4.74 NETGEAR R8000P versions prior to 1.4.2.84 NETGEAR MR60 versions prior to 1.0.6.110 NETGEAR RAX20 versions prior to...

PT-2021-6177

Name of the Vulnerable Software and Affected Versions NETGEAR R7900 versions prior to 1.0.4.38 NETGEAR R7900P versions prior to 1.4.2.84 NETGEAR R8000 versions prior to 1.0.4.68 NETGEAR R8000P versions prior to 1.4.2.84 NETGEAR RAX200 versions prior to 1.0.3.106 NETGEAR MR60 versions prior to...

Anker Eufy Homebase wifi_country_code_update Heap Buffer Overflow DoS

The vulnerability of the wifiCountryCodeUpdate function in Anker Eufy Homebase software exists because measures are not taken to neutralize the special commands used in the operating system. Exploiting this vulnerability allows a malicious actor to execute arbitrary operating system commands by...

Imunify360 Arbitrary Command Execution

The vulnerability of the Ai-Boilt malware scanning service for Linux web servers running Imunify360 is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands using a specially created malware file...

Garrett Metal Detectors: Path traversal vulnerability

Garrett Metal Detectors is a walk-in metal detector from Garrett U.S.A. Garrett Metal Detectors is vulnerable to a path traversal vulnerability that could be exploited by remote attackers to submit special requests and execute arbitrary commands in the application context...

Cisco Application Policy Infrastructure Controller Command Execution

The vulnerability of the Cisco Application Policy Infrastructure Controller’s web interface and API exists due to the lack of measures taken to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands...

vBulletin Arbitrary Command Execution

The vulnerability of the commercial vBulletin web forum is related to errors in code generation. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands using a specially created parameter in the ajax/render/widgetphp script...

Apache Log4j JNDI message lookup vulnerability

Added: 12/16/2021 Background Apache Log4j is a logging library used by many Java applications. Problem An attacker who is able to control log message content could embed a JNDI reference to an LDAP or RMI URL which downloads an executable Java class, leading to arbitrary command execution...

CVE-2021-34426 Arbitrary command execution in Keybase Client for Windows

A vulnerability was discovered in the Keybase Client for Windows before version 5.6.0 when a user executed the "keybase git lfs-config" command on the command-line. In versions prior to 5.6.0, a malicious actor with write access to a user's Git repository could leverage this vulnerability to...

CVE-2021-34426

A vulnerability was discovered in the Keybase Client for Windows before version 5.6.0 when a user executed the "keybase git lfs-config" command on the command-line. In versions prior to 5.6.0, a malicious actor with write access to a user's Git repository could leverage this vulnerability to...

PT-2021-20525

Name of the Vulnerable Software and Affected Versions: Keybase Client for Windows versions prior to 5.6.0 Description: A vulnerability was discovered in the Keybase Client for Windows when a user executed the keybase git lfs-config command on the command-line. In versions prior to 5.6.0, a...

CVE-2021-34426: Undefined Security Weakness

A vulnerability was discovered in the Keybase Client for Windows before version 5.6.0 when a user executed the "keybase git lfs-config" command on the command-line. In versions prior to 5.6.0, a malicious actor with write access to a user's Git repository could leverage this vulnerability to...

PT-2021-6098

Name of the Vulnerable Software and Affected Versions D-Link DIR 882 version DIR 882 FW1.30B06 Hotfix 02 Description The issue is related to a command injection vulnerability in the twsystem function. This allows attackers to execute arbitrary commands via a crafted HNAP1 POST request to the / AP...

GHSA-4M6Q-RXHM-675W OS Command Injection in adb-driver

adb-driver through 0.1.8 is vulnerable to Command Injection.It allows execution of arbitrary commands via the command function...

@10yun/cv-mobile-ui (0.3.20), @aiot-toolkit/aiotpack (>=2.0.5-beta.11, <=2.0.5-widget-provider-beta.2) +184 more potentially affected by CVE-2020-7636 via adb-driver (>=0.0.1, <=0.1.8)

adb-driver NPM version =0.0.1, =2.0.5-beta.11, =1.0.0-beta.0, =1.0.0-beta.0, =2.0.0-26820200330001, =2.0.0-27520200518001, =2.0.0-26920200420001, =0.1.0, =1.0.0, =1.9.3, =1.9.3, =0.4.0-beta.0, =2.1.2-beta.1 and more Source cves: CVE-2020-7636 Source advisory: OSV:GHSA-4M6Q-RXHM-675W...

CVE-2021-21954

A command execution vulnerability exists in the wificountrycodeupdate functionality of the homesecurity binary of Anker Eufy Homebase 2 2.1.6.9h. A specially-crafted set of network packets can lead to arbitrary command execution...

Command injection

A command execution vulnerability exists in the wificountrycodeupdate functionality of the homesecurity binary of Anker Eufy Homebase 2 2.1.6.9h. A specially-crafted set of network packets can lead to arbitrary command execution...

CVE-2021-23862

CVE-2021-23862 describes an authenticated command-injection flaw: a crafted configuration packet sent by an authenticated administrative user can execute arbitrary commands in the system context. Affected products include Bosch VRM, DIVAR IP, BVMS with VRM installed, and the VIDEOJET decoder (VJD...