Web Manager Arbitrary Command Execution

The vulnerability of the data loading function of the Web Manager application in the Lantronix PremierWave 2050 Wi-Fi module exists due to the failure to take measures to neutralize special elements used in the operating system’s command set. Exploiting this vulnerability allows a malicious actor...

FreeBSD : emacs -- arbitary shell command execution vulnerability of ctags (76e2fcce-92d2-11ed-a635-080027f5fec9)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 76e2fcce-92d2-11ed-a635-080027f5fec9 advisory. - GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a...

CVE-2022-46478

The RPC interface in datax-web v1.0.0 and v2.0.0 to v2.1.2 contains no permission checks by default which allows attackers to execute arbitrary commands via crafted Hessian serialized data...

PT-2023-1539

Name of the Vulnerable Software and Affected Versions TOTOLINK CA300-PoE version 6.2c.884 Description The issue is related to the lack of input sanitization in the NTPSyncWithHost function of the TOTOLINK CA300-PoE router's firmware. This can be exploited by a remote attacker to execute arbitrary...

CVE-2022-46478: Deserialization of Untrusted Data

The RPC interface in datax-web v1.0.0 and v2.0.0 to v2.1.2 contains no permission checks by default which allows attackers to execute arbitrary commands via crafted Hessian serialized data...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to arbitrary command execution in Git (CVE-2018-1000021)

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to arbitrary command execution in Git, caused by the failure to validate messages received from a Git server CVE-2018-1000021. Git is included in the base operating system used by IBM Watson Speech. Please read...

Cisco RV160 and RV260 have vulnerabilities in input validation.

Cisco Small Business is a switch from Cisco USA. A security vulnerability exists in the Cisco Small Business RV160, RV260 Series VPN Routers that stems from insufficient validation of user input. An attacker could exploit the vulnerability to execute arbitrary commands...

Linksys WRT54GL Buffer Overflow Vulnerability

The Linksys WRT54GL is a wireless router from Linksys USA. A buffer overflow vulnerability exists in the Linksys WRT54GL Wireless-G Broadband Router. The vulnerability stems from a boundary error in the StartEPI function in the httpd binary when handling untrusted input, and can be exploited by a...

CVE-2022-48253: Improper Limitation of a Pathname to a Restricted Directory

nhttpd in Nostromo before 2.1 is vulnerable to a path traversal that may allow an attacker to execute arbitrary commands on the remote server. The vulnerability occurs when the homedirs option is used...

CVE-2022-46603

An issue in Inkdrop v5.4.1 allows attackers to execute arbitrary commands via uploading a crafted markdown file...

Design/Logic Flaw

An issue in Inkdrop v5.4.1 allows attackers to execute arbitrary commands via uploading a crafted markdown file...

Inkdrop cross-site scripting vulnerability

Inkdrop is a note-taking application with a powerful Markdown editor by the Japanese individual developer Takuya. A security vulnerability exists in Inkdrop version v5.4.1. An attacker can exploit this vulnerability to execute arbitrary commands by uploading specially crafted markdown files...

Linksys WUMC710 Operating System Command Injection Vulnerability

The Linksys WUMC710 is a universal media connector from Linksys USA. A command injection vulnerability exists in the Linksys WUMC710 Wireless-AC Universal Media Connector version 1.0.02 build3 and prior versions. The vulnerability stems from the dosetNTP function in the httpd binary that uses...

CVE-2022-46603

An issue in Inkdrop v5.4.1 allows attackers to execute arbitrary commands via uploading a crafted markdown file...

CentOS Web Panel Login Command Execution

The vulnerability of the login/index.php implementation of the server management application for CentOS Web Panel is related to the failure to take measures to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a malicious actor to execute...

PT-2023-14962 · Inkdrop · Inkdrop

Name of the Vulnerable Software and Affected Versions: Inkdrop version 5.4.1 Description: An issue in Inkdrop allows attackers to execute arbitrary commands via uploading a crafted markdown file. Recommendations: For Inkdrop version 5.4.1, update to a version that contains a fix for this issue, a...

CVE-2022-43970: Buffer Copy without Checking Size of Input

A buffer overflow vulnerability exists in Linksys WRT54GL Wireless-G Broadband Router with firmware = 4.30.18.006. A stack-based buffer overflow in the StartEPI function within the httpd binary allows an authenticated attacker with administrator privileges to execute arbitrary commands on the...

CVE-2022-46603

Inkdrop, version 5.4.1, contains a vulnerability where attackers can run arbitrary commands by uploading a crafted Markdown file. The issue affects Inkdrop’s Markdown handling and root cause is described across multiple sources as a vulnerability in v5.4.1; remediation guidance is to update to a ...

CVE-2022-46603: Improper Neutralization of Input During Web Page Generation

An issue in Inkdrop v5.4.1 allows attackers to execute arbitrary commands via uploading a crafted markdown file...

CVE-2022-39073

There is a command injection vulnerability in ZTE MF286R, Due to insufficient validation of the input parameters, an attacker could use the vulnerability to execute arbitrary commands...