9152 matches found
PT-2022-24702 · Unknown · Rava Certificate Validation System
Name of the Vulnerable Software and Affected Versions: RAVA certificate validation system affected versions not specified Description: The issue is related to insufficient filtering for a special parameter of the web page input field in the RAVA certificate validation system. A remote attacker wi...
CVE-2022-41751
Jhead 3.06.0.1 allows attackers to execute arbitrary OS commands by placing them in a JPEG filename and then using the regeneration -rgt50 option...
UBUNTU-CVE-2022-41751
Jhead 3.06.0.1 allows attackers to execute arbitrary OS commands by placing them in a JPEG filename and then using the regeneration -rgt50 option...
PT-2022-25670 · Mitre · Mitre Caldera
Name of the Vulnerable Software and Affected Versions: MITRE CALDERA version 4.1.0 Description: The issue allows stored XSS via the app.contact.gist field, also known as the gist contact configuration field, leading to the execution of arbitrary commands on agents. Recommendations: For MITRE...
CVE-2021-27406 PerFact OpenVPN-Client
An attacker can take leverage on PerFact OpenVPN-Client versions 1.4.1.0 and prior to send the config command from any application running on the local host machine to force the back-end server into initializing a new open-VPN instance with arbitrary open-VPN configuration. This could result in t...
The vulnerability of the web administration interface of the microprogramming software for the portable wireless module PLANEX MZK-DP150N allows a perpetrator to execute arbitrary commands.
The vulnerability of the web administration interface of the microprogramming software for the portable wireless module PLANEX MZK-DP150N is related to errors in the use of standard permissions. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands using a specially...
Puppet puppetlabs-apt module command injection vulnerability
Puppet is a client/server C/S architecture-based configuration management tool from Puppet Labs that can be used to manage configuration files, users, cron tasks, packages, system services, etc. A command injection vulnerability exists in versions of Puppet Puppetlabs-apt module prior to 9.0.0. T...
Puppet command injection vulnerability
Puppet is a set of client/server C/S architecture-based configuration management tools from Puppet Labs in the United States, which can be used to manage configuration files, users, cron tasks, packages, system services, etc. A command injection vulnerability exists in puppet puppetlabs-mysql...
Kubernetes: Ingress nginx annotation injection causes arbitrary command execution
A vulnerability was found where arbitrary commands could be executed on the Kubernetes cluster. Through annotation injection on the ingress resource, additional locations could be added to the nginx configuration, allowing commands to be passed and executed via the lua scripting engine on the...
Generex UPS Adapter CS141 Command Execution Vulnerability
Generex UPS Adapter CS141 is a UPS Uninterruptible Power System adapter from Generex, a German company.A command execution vulnerability exists in Generex UPS Adapter CS141 versions prior to 2.08, which originates from the web of runupdate in /usr/bin/gxservice -update.sh interface fails to...
TOTOLINK NR1800X UploadFirmwareFile Command Injection Vulnerability
TOTOLINK NR1800X is an outstanding 5G NR indoor Wi-Fi and SIP CPE from China's TOTOLINK. designed to provide fast and easy deployment of NR fixed data services in homes and offices. A command injection vulnerability exists in TOTOLINK NR1800X version V9.1.0u.6279B20210910, which originates from t...
TOTOLINK A860R Command Injection Vulnerability
TOTOLINK A860R is a wireless router from China Gion Electronics TOTOLINK.TOTOLINK A860R version V4.1.2cu.5182B20201027 is vulnerable to command injection, which stems from the component /cgi-bin/downloadFile.cgi failing to properly filter the construct command special characters, commands, etc. A...
CVE-2022-37890
Unauthenticated buffer overflow vulnerabilities exist within the Aruba InstantOS and ArubaOS 10 web management interface. Successful exploitation results in the execution of arbitrary commands on the underlying operating system of Aruba InstantOS 6.4.x: 6.4.4.8-4.2.4.20 and below; Aruba InstantOS...
CVE-2022-37890
CVE-2022-37890 describes unauthenticated buffer overflow vulnerabilities in Aruba InstantOS and ArubaOS 10 web management interfaces. Exploitation can execute arbitrary commands on the underlying Aruba InstantOS/OS, with affected versions including InstantOS 6.4.x (6.4.4.8-4.2.4.20 and below), 6....
TOTOLINK NR1800X 操作系统命令注入漏洞
TOTOLINK NR1800X is a 5G NR indoor Wi-Fi and SIP CPE broadband access device from China's Gion Electronics TOTOLINK, which is mainly used for the deployment of NR fixed data services in homes and offices to support 5G NR network connectivity. The TOTOLINK NR1800X suffers from a command injection...
Generex UPS Adapter CS141 安全漏洞
Generex UPS Adapter CS141 is a UPS Uninterruptible Power System adapter from Generex, a German company.A command execution vulnerability exists in Generex UPS Adapter CS141 versions prior to 2.08, which originates from the web of runupdate in /usr/bin/gxservice -update.sh interface fails to...
CVE-2022-40764
Snyk CLI before 1.996.0 allows arbitrary command execution, affecting Snyk IDE plugins and the snyk npm package. Exploitation could follow from the common practice of viewing untrusted files in the Visual Studio Code editor, for example. The original demonstration was with shell metacharacters in...
CVE-2022-40764
Snyk CLI before 1.996.0 allows arbitrary command execution, affecting Snyk IDE plugins and the snyk npm package. Exploitation could follow from the common practice of viewing untrusted files in the Visual Studio Code editor, for example. The original demonstration was with shell metacharacters in...
CVE-2022-40764
CVE-2022-40764 affects Snyk CLI and related IDE plugins; before 1.996.0, it allowed arbitrary command execution, potentially via viewing untrusted files in VS Code. The original demonstration involved shell metacharacters in the vendor.json ignore field, affecting snyk-go-plugin before 1.19.1 and...
CVE-2022-40764
Snyk CLI before 1.996.0 allows arbitrary command execution, affecting Snyk IDE plugins and the snyk npm package. Exploitation could follow from the common practice of viewing untrusted files in the Visual Studio Code editor, for example. The original demonstration was with shell metacharacters in...