JVN#29739718: Multiple vulnerabilities in Aterm WF1200CR, Aterm WG1200CR, Aterm WG2600HS, and Aterm WX3000HP

Aterm WF1200CR, Aterm WG1200CR, Aterm WG2600HS, and Aterm WX3000HP provided by NEC Corporation contain multiple vulnerabilities listed below. Aterm WF1200CR, Aterm WG1200CR, and Aterm WG2600HS OS Command Injection CWE-78 - CVE-2021-20708 Version| Vector| Score ---|---|--- CVSS v3|...

CVE-2021-1485

A vulnerability in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to inject arbitrary commands that are executed with root privileges on the underlying Linux operating system OS of an affected device. This vulnerability is due to insufficient input validation of...

Arbitrary Command Injection in portprocesses

Impact An Arbitrary Command Injection vulnerability was reported in portprocesses impacting versions = 1.0.4. Example Proof of Concept The following example demonstrates the vulnerability and will run touch success therefore creating a file named success. js const portprocesses =...

GHSA-VM67-7VMG-66VM Arbitrary Command Injection in portprocesses

Impact An Arbitrary Command Injection vulnerability was reported in portprocesses impacting versions = 1.0.4. Example Proof of Concept The following example demonstrates the vulnerability and will run touch success therefore creating a file named success. js const portprocesses =...

The vulnerability of the Cisco IOS XE SD-WAN’s command-line interface allows a hacker to elevate their privileges to the root level.

The vulnerability of the Cisco IOS XE SD-WAN software’s command-line interface is related to resource management errors. Exploiting this vulnerability allows an attacker to execute arbitrary commands on the underlying operating system...

The vulnerability of the CLI component in Cisco IOS XE routers for Cisco IOS XE SD-WAN allows a attacker to execute arbitrary commands with superuser privileges.

The vulnerability of Cisco IOS XE operating system-based routers in Cisco IOS XE SD-WAN solutions exists due to insufficient validation of input data. Exploiting this vulnerability can allow attackers to execute arbitrary commands with superuser privileges...

CVE-2021-29996

Mark Text through 0.16.3 allows attackers arbitrary command execution. This could lead to Remote Code Execution RCE by opening .md files containing a mutation Cross Site Scripting XSS payload...

CVE-2021-29996

Mark Text through 0.16.3 allows attackers arbitrary command execution. This could lead to Remote Code Execution RCE by opening .md files containing a mutation Cross Site Scripting XSS payload...

PT-2021-7653 · Qnap · Qts +1

Name of the Vulnerable Software and Affected Versions: QTS versions prior to 4.5.2.1566 Build 20210202 QTS versions prior to 4.5.1.1495 Build 20201123 QTS versions prior to 4.3.6.1620 Build 20210322 QTS versions prior to 4.3.4.1632 Build 20210324 QTS versions prior to 4.3.3.1624 Build 20210416 QT...

CVE-2021-28940

Because of a incorrect escaped exec command in MagpieRSS in 0.72 in the /extlib/Snoopy.class.inc file, it is possible to add a extra command to the curl binary. This creates an issue on the /scripts/magpiedebug.php and /scripts/magpiesimple.php page that if you send a specific https url in the RS...

MagpieRSS 安全漏洞

A security vulnerability exists in MagpieRSS in 0.72, which originates from a command escape error in /extlib/Snoopy.class.inc and can be exploited by an attacker to execute arbitrary commands...

Debian DLA-2615-1 : spamassassin security update

Damian Lukowski discovered a flaw in spamassassin, a Perl-based spam filter using text analysis. Malicious rule configuration files, possibly downloaded from an updates server, could execute arbitrary commands under multiple scenarios. For Debian 9 stretch, this problem has been fixed in version...

PT-2021-17994 · Magpierss · Magpierss

Name of the Vulnerable Software and Affected Versions: MagpieRSS version 0.72 Description: The issue arises from an incorrectly escaped exec command in the /extlib/Snoopy.class.inc file. This allows an attacker to add an extra command to the curl binary, creating a problem on the /scripts/magpie...

Arbitrary Command Injection

portprocesses is vulnerable to arbitrary command injection. The vulnerability exists through the lack of validation on the value of pid used in exec...

Rockwell Automation FactoryTalk AssetCentre 操作系统命令注入漏洞

Rockwell Automation FactoryTalk AssetCentre is an asset management software tool from Rockwell Automation that allows manufacturers and industrial companies to centrally manage controllers and other automation-related assets. An OS command injection vulnerability exists in Rockwell Automation...

Rockwell Automation FactoryTalk AssetCentre 代码问题漏洞

Rockwell Automation FactoryTalk AssetCentre is an asset management software tool from Rockwell Automation that allows manufacturers and industrial companies to centrally manage controllers and other automation-related assets. A security vulnerability exists in Rockwell Automation FactoryTalk...

GLSA-202103-01 : Salt: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202103-01 Salt: Multiple vulnerabilities Multiple vulnerabilities have been discovered in Salt. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could possibly execute arbitrary commands v...

CVE-2021-23363 Arbitrary Command Injection

This affects the package kill-by-port before 0.0.2. If attacker-controlled user input is given to the killByPort function, it is possible for an attacker to execute arbitrary commands. This is due to use of the childprocess exec function without input sanitization...

CVE-2021-23363

The CVE affects the npm package kill-by-port (before v0.0.2). The root cause is unsanitized attacker-controlled input passed to child_process.exec, enabling Arbitrary Command Injection. Documented impact is arbitrary command execution via input to killByPort, with examples and a PoC in Snyk data ...

CVE-2021-23363

This affects the package kill-by-port before 0.0.2. If attacker-controlled user input is given to the killByPort function, it is possible for an attacker to execute arbitrary commands. This is due to use of the childprocess exec function without input sanitization...