CVE-2022-3874

A command injection flaw was found in foreman. This flaw allows an authenticated user with admin privileges on the foreman instance to transpile commands through CoreOS and Fedora CoreOS configurations in templates, possibly resulting in arbitrary command execution on the underlying operating...

The vulnerability of the ping.ccp component of the D-Link DIR820LA1 router’s microprogramming software allows a hacker to execute arbitrary commands.

The vulnerability of the ping.ccp component of the D-Link DIR820LA1 router’s microprogramming software exists due to the lack of measures taken to neutralize the special elements used in the operating system commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary...

CVE-2023-20865

VMware Aria Operations for Logs contains a command injection vulnerability. A malicious actor with administrative privileges in VMware Aria Operations for Logs can execute arbitrary commands as root...

PT-2023-2386 · Cisco · Cisco Industrial Network Director

Name of the Vulnerable Software and Affected Versions: Cisco Industrial Network Director affected versions not specified Description: The issue exists due to improper input validation when uploading a Device Pack, allowing an authenticated, remote attacker to execute arbitrary commands with...

Red Hat Satellite 操作系统命令注入漏洞

Red Hat Satellite is a system management platform from Red Hat. The platform can be used to extend Linux infrastructures and provide system management functions such as administration, configuration, and monitoring. A security vulnerability exists in Red Hat Satellite, which originates in the...

PT-2023-12125 · Laravel · Laravel

Name of the Vulnerable Software and Affected Versions: Laravel version 8.5.9 Description: A deserialization vulnerability in the destruct function allows attackers to execute arbitrary commands. Recommendations: For Laravel version 8.5.9, consider disabling the destruct function until a patch is...

CVE-2021-28254

A deserialization vulnerability in the destruct function of Laravel v8.5.9 allows attackers to execute arbitrary commands...

Laravel 代码问题漏洞

Laravel is a web application framework from the Laravel community. A security vulnerability exists in Laravel version v8.5.9 that stems from the presence of a deserialization vulnerability that allows an attacker to execute arbitrary commands...

Vulnerabilities fixed in IBM AIX

IBM has fixed vulnerabilities in AIX. The vulnerabilities allow a local, authenticated user to execute arbitrary execute commands on the system. Even those for which the malicious user is not initially authorized to do. IBM has released updates to fix the vulnerabilities in AIX. For more...

The vulnerability of NETGEAR Orbi Satellite RBS750’s microprogramming software allows a hacker to execute arbitrary commands.

The vulnerability of NETGEAR Orbi Satellite RBS750 router’s microprogramming software is related to the presence of undocumented commands. Exploiting this vulnerability could allow a remote attacker to execute arbitrary commands using a specially created package...

The vulnerability of the /etc/init.d/openfire file in the PBX server of the corporate IP telephony management system CoreDial sipXcom sipXopenfire allows a attacker to escalate their privileges or execute arbitrary commands.

The vulnerability of the /etc/init.d/openfire file in the CoreDial sipXcom sipXopenfire server of the corporate IP-telephony management system is related to improper privilege assignment. Exploiting this vulnerability could allow an attacker to enhance their privileges or execute arbitrary comman...

Cisco Small Business 输入验证错误漏洞

Cisco Small Business is a switch from Cisco. An input validation error vulnerability exists in Cisco Small Business that originates from allowing an attacker to execute arbitrary commands in the web-based management interface. Affected products and versions: Cisco Small Business Routers RV016,...

Vulnerability of the initializePlugin function in the sipXopenfire\presence-plugin\src\org\sipfoundry\openfire\plugin\presence\SipXOpenfirePlugin.java file. The PBX server of the corporate IP telephony management system CoreDial sipXcom sipXopenfire allows intruders to escalate their privileges or execute arbitrary commands.

The vulnerability lies in the function initializePlugin of the sipXopenfire\presence-plugin\src\org\sipfoundry\openfire\plugin\presence\SipXOpenfirePlugin.java file. In the PBX server of the corporate IP telephony management system, CoreDial sipXcom sipXopenfire relies on the implementation or...

AIX is vulnerable to arbitrary command execution

IBM SECURITY ADVISORY First Issued: Wed Apr 12 12:36:51 CDT 2023 The most recent version of this document is available here: https://aix.software.ibm.com/aix/efixes/security/librtsadvisory.asc Security Bulletin: AIX is vulnerable to arbitrary command execution CVE-2023-26286...

AIX is vulnerable to arbitrary command execution due to invscout

IBM SECURITY ADVISORY First Issued: Wed Apr 12 12:32:10 CDT 2023 The most recent version of this document is available here: https://aix.software.ibm.com/aix/efixes/security/invscoutadvisory4.asc Security Bulletin: AIX is vulnerable to arbitrary command execution due to invscout CVE-2023-28528...

Siemens SCALANCE W1750D Command Injection (CVE-2021-37724)

A remote arbitrary command execution vulnerability was discovered in Aruba Operating System Software versions: Prior to 8.7.1.2, 8.6.0.8, 8.5.0.12, 8.3.0.16. Aruba has released patches for ArubaOS that address this security vulnerability. This plugin only works with Tenable.ot. Please visit...

TOTOLINK A7100RU pppoeAcName Parameter Command Injection Vulnerability

The TOTOLINK A7100RU is a wireless router manufactured by China's Gion Electronics TOTOLINK, mainly used for home network connection. The TOTOLINK A7100RU suffers from a command injection vulnerability that originates from the pppoeAcName parameter of /setting/setWanIeCfg failing to correctly...

TOTOLINK A7100RU org Parameter Command Injection Vulnerability

The TOTOLINK A7100RU is a wireless router manufactured by China's Gion Electronics TOTOLINK, mainly used for home network connection. The TOTOLINK A7100RU suffers from a command injection vulnerability that stems from the org parameter in setting/delStaticDhcpRules failing to properly filter...

The vulnerability of the command-line interface of Cisco IOS XE SD-WAN software allows a attacker to execute arbitrary commands.

The vulnerability of the command-line interface of Cisco IOS XE SD-WAN software exists due to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to execute arbitrary commands...

Siemens SCALANCE W1750D Command Injection (CVE-2021-37730)

A remote arbitrary command execution vulnerability was discovered in HPE Aruba Instant IAP versions: Aruba Instant 6.4.x.x: 6.4.4.8-4.2.4.18 and below; Aruba Instant 6.5.x.x: 6.5.4.20 and below; Aruba Instant 8.5.x.x: 8.5.0.12 and below; Aruba Instant 8.6.x.x: 8.6.0.11 and below; Aruba Instant...