CVE-2024-50848

An XML External Entity XXE vulnerability in the Import object and Translation Memory import functionalities of WorldServer v11.8.2 to access sensitive information and execute arbitrary commands via supplying a crafted .tmx file...

Rakuten Turbo 5G 操作系统命令注入漏洞

The Rakuten Turbo 5G is a home router from Rakuten that requires no construction and plugs into a power outlet. An operating system command injection vulnerability exists in Rakuten Turbo 5G V1.3.18 and earlier versions, which stems from the presence of operating system command injection, where a...

CVE-2024-50848

An XML External Entity XXE vulnerability in the Import object and Translation Memory import functionalities of WorldServer v11.8.2 to access sensitive information and execute arbitrary commands via supplying a crafted .tmx file...

ZTE NH8091 安全漏洞

ZTE NH8091 is a modem from ZTE Corporation ZTE, China. A security vulnerability exists in the ZTE NH8091 V1.8 version, which originates from improper control of the Web module interface privileges and can be exploited by an authenticated attacker to execute arbitrary commands...

The vulnerability of the SmartFabric OS10 network operating system, related to the failure to sanitize input data at the control level, allows a perpetrator to execute arbitrary commands.

The vulnerability of the SmartFabric OS10 network operating system is related to the lack of measures taken to sanitize input data at the control level. Exploiting this vulnerability can allow an attacker to execute arbitrary commands...

CVE-2021-34752

A vulnerability in the CLI of Cisco FTD Software could allow an authenticated, local attacker with administrative privileges to execute arbitrary commands with root privileges on the underlying operating system of an affected device. This vulnerability is due to insufficient validation of...

CVE-2021-1484

A vulnerability in the web UI of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to inject arbitrary commands on an affected system and cause a denial of service DoS condition. This vulnerability is due to improper input validation of user-supplied input to the device...

CVE-2023-20036

A vulnerability in the web UI of Cisco IND could allow an authenticated, remote attacker to execute arbitrary commands with administrative privileges on the underlying operating system of an affected device. This vulnerability is due to improper input validation when uploading a Device Pack. An...

CVE-2022-20655

A vulnerability in the implementation of the CLI on a device that is running ConfD could allow an authenticated, local attacker to perform a command injection attack. The vulnerability is due to insufficient validation of a process argument on an affected device. An attacker could exploit this...

CVE-2022-20655

A vulnerability in the implementation of the CLI on a device that is running ConfD could allow an authenticated, local attacker to perform a command injection attack. The vulnerability is due to insufficient validation of a process argument on an affected device. An attacker could exploit this...

CVE-2022-20655

A vulnerability in the implementation of the CLI on a device that is running ConfD could allow an authenticated, local attacker to perform a command injection attack. The vulnerability is due to insufficient validation of a process argument on an affected device. An attacker could exploit this...

CVE-2024-11120

CVE-2024-11120 is a pre-auth OS Command Injection affecting certain GeoVision EOL devices. Unauthenticated remote attackers can inject/execute commands, with active exploitation observed in the wild (Mirai-related activity via the /DateSetting.cgi endpoint and szSrvIpAddr parameter). Mitigations ...

The vulnerability of PostgreSQL database management system’s CREATE POLICY command for tables with row-level protection allows attackers to execute arbitrary commands.

The vulnerability of PostgreSQL database management system’s CREATE POLICY commands related to the lack of consistency between independent representations of the overall state. Exploiting this vulnerability allows an attacker, operating remotely, to execute arbitrary commands by repeatedly using...

Ubuntu: Security Advisory (USN-7109-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Dell SmartFabric OS10 Command Injection Vulnerability (CNVD-2025-02566)

Dell SmartFabric OS10 is a Debian Linux-based network operating system from Dell Networking designed to run on its PowerSwitch platform. A command injection vulnerability exists in Dell SmartFabric OS10 that stems from the system not filtering and validating user input at command execution. An...

Vulnerabilities fixed in Fortinet FortiClient

Fortinet has fixed vulnerabilities in FortiClient for Windows and macOS. A malicious party could exploit the vulnerabilities to grant themselves elevated privileges and execute arbitrary commands on the system. Fortinet has released updates to fix the vulnerabilities. See attached references for...

matrix-appservice-irc 安全漏洞

matrix-appservice-irc is a bridge for Matrix. This bridge passes all IRC messages to Matrix and all Matrix messages to IRC. A security vulnerability exists in matrix-appservice-irc versions prior to 3.0.3. An attacker can exploit this vulnerability to execute arbitrary IRC commands...

Security Bulletin: Multiple Vulnerabilities in IBM Event Streams

Summary Multiple vulnerabilities were addressed in IBM Event Streams version 11.5.1. Vulnerability Details CVEID:CVE-2024-45590 DESCRIPTION: expressjs body-parser is vulnerable to a denial of service, caused by a flaw when url encoding is enabled. By sending a specially crafted payload, a remote...

Microsoft Windows Multiple Vulnerabilities (KB5046633)

This host is missing an important security update according to Microsoft KB5046633 SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...

CVE-2024-52010

Zoraxy is a general purpose HTTP reverse proxy and forwarding tool. A command injection vulnerability in the Web SSH feature allows an authenticated attacker to execute arbitrary commands as root on the host. Zoraxy has a Web SSH terminal feature that allows authenticated users to connect to SSH...