12975 matches found
Security Bulletin: AIX is vulnerable to arbitrary command execution due to invscout (CVE-2023-28528)
Summary A vulnerability in the AIX invscout command could allow a non-privileged local user to execute arbitrary commands CVE-2023-28528. Vulnerability Details CVEID:CVE-2023-28528 DESCRIPTION: IBM AIX could allow a non-privileged local user to exploit a vulnerability in the invscout command to...
emacs: command injection vulnerability in org-mode
A flaw was found in the Emacs text editor. Processing a specially crafted org-mode code with the function org-babel-execute:latex in ob-latex.el can result in arbitrary command execution...
emacs: command injection vulnerability in org-mode
A flaw was found in the Emacs text editor. Processing a specially crafted org-mode code with the function org-babel-execute:latex in ob-latex.el can result in arbitrary command execution...
CVE-2023-1731: Unrestricted Upload of File with Dangerous Type
In Meinbergs LTOS versions prior to V7.06.013, the configuration file upload function would not correctly validate the input, which would allow an remote authenticated attacker with high privileges to execute arbitrary commands...
TOTOLINK X18 setOpModeCfg function injection vulnerability
TOTOLINK X18 is an AX1800-grade Wi-Fi6 Mesh router system launched by TOTOLINK of China. The TOTOLINK X18 has a command injection vulnerability, which stems from the fact that the host name parameter in the setOpModeCfg function fails to properly filter special characters and commands. Attackers...
TOTOLINK X18 setTracerouteCfg function injection vulnerability
TOTOLINK X18 is an AX1800-grade Wi-Fi6 Mesh router system launched by TOTOLINK of China. The TOTOLINK X18 has a command injection vulnerability, which stems from improper filtering of special characters and commands within the setTracerouteCfg function. Attackers can exploit this vulnerability to...
IBM AIX security vulnerabilities
IBM AIX Advanced Interactive eXecutive is a UNIX operating system developed by IBM. An elevation of privilege vulnerability exists in IBM AIX, which can be exploited by an attacker to execute arbitrary commands...
CVE-2023-25507
NVIDIA DGX-1 BMC contains a vulnerability in the SPX REST API, where an attacker with the appropriate level of authorization can inject arbitrary shell commands, which may lead to code execution, denial of service, information disclosure, and data tampering...
CVE-2023-30621
Gipsy is a multi-purpose discord bot which aim to be as modular and user-friendly as possible. In versions prior to 1.3 users can run command on the host machine with sudoer permission. The !ping command when provided with an IP or hostname used to run a bash ping without verification that the IP...
Command injection
Gipsy is a multi-purpose discord bot which aim to be as modular and user-friendly as possible. In versions prior to 1.3 users can run command on the host machine with sudoer permission. The !ping command when provided with an IP or hostname used to run a bash ping without verification that the IP...
CVE-2023-30621 OS command injection in Gipsy
Gipsy is a multi-purpose discord bot which aim to be as modular and user-friendly as possible. In versions prior to 1.3 users can run command on the host machine with sudoer permission. The !ping command when provided with an IP or hostname used to run a bash ping without verification that the IP...
CVE-2023-30621
Gipsy (Curiosity Open Source)
CVE-2023-30621: Improper Neutralization of Special Elements used in an OS Command
Gipsy is a multi-purpose discord bot which aim to be as modular and user-friendly as possible. In versions prior to 1.3 users can run command on the host machine with sudoer permission. The !ping command when provided with an IP or hostname used to run a bash ping without verification that the IP...
CVE-2022-36963: Improper Control of Generation of Code
The SolarWinds Platform was susceptible to the Command Injection Vulnerability. This vulnerability allows a remote adversary with a valid SolarWinds Platform admin account to execute arbitrary commands...
CVE-2022-3874
A command injection flaw was found in foreman. This flaw allows an authenticated user with admin privileges on the foreman instance to transpile commands through CoreOS and Fedora CoreOS configurations in templates, possibly resulting in arbitrary command execution on the underlying operating...
CVE-2023-20865
VMware Aria Operations for Logs contains a command injection vulnerability. A malicious actor with administrative privileges in VMware Aria Operations for Logs can execute arbitrary commands as root...
D-Link DIR820LA1 ping.ccp Command Execution
The vulnerability of the ping.ccp component of the D-Link DIR820LA1 router’s microprogramming software exists due to the lack of measures taken to neutralize the special elements used in the operating system commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary...
PT-2023-2386 · Cisco · Cisco Industrial Network Director
Name of the Vulnerable Software and Affected Versions: Cisco Industrial Network Director affected versions not specified Description: The issue exists due to improper input validation when uploading a Device Pack, allowing an authenticated, remote attacker to execute arbitrary commands with...
Red Hat Satellite operating system command injection vulnerability
Red Hat Satellite is a system management platform from Red Hat. The platform can be used to extend Linux infrastructures and provide system management functions such as administration, configuration, and monitoring. A security vulnerability exists in Red Hat Satellite, which originates in the...