CVE-2024-2692

SiYuan version 3.0.3 allows executing arbitrary commands on the server. This is possible because the application is vulnerable to Server Side XSS...

CVE-2024-26258

OS command injection vulnerability in ELECOM wireless LAN routers allows a network-adjacent attacker with credentials to execute arbitrary OS commands by sending a specially crafted request to the product...

PT-2024-22796

Name of the Vulnerable Software and Affected Versions: gotortc versions 1.8.5 and prior Description: The issue concerns a camera streaming application. It allows modification of the existing configuration with user-supplied values through the /api/config endpoint. Although this API only allows...

CVE-2024-29949

There is a command injection vulnerability in some Hikvision NVRs. This could allow an authenticated user with administrative rights to execute arbitrary commands...

CVE-2024-29949

There is a command injection vulnerability in some Hikvision NVRs. This could allow an authenticated user with administrative rights to execute arbitrary commands...

CVE-2024-29949

CVE-2024-29949 concerns Hikvision NVRs with a command injection vulnerability. The available documents consistently state that an authenticated user with administrative rights can execute arbitrary commands on affected devices. The vulnerability is tied to Hikvision’s advisories for NVR devices, ...

OS Command Injection

gtkwave is vulnerable to OS Command Injection. The vulnerability is due to insufficient input validation in the decompression functionality in vcdrecordermain, allowing attackers to execute arbitrary commands by crafting a specially crafted wave file...

OS Command Injection

gtkwave is vulnerable to OS Command Injection. The vulnerability is due to inadequate input validation in the decompression functionality in vcdmain, enabling attackers to execute arbitrary commands through a specially crafted wave file...

OS Command Injection

gtkwave is vulnerable to OS Command Injection. The vulnerability is due to insufficient input validation in the decompression functionality in the vcd2lxt utility, which allows attackers to execute arbitrary commands by exploiting a specially crafted wave file...

OS Command Injection

gtkwave is vulnerable to OS Command Injection. The vulnerability is due to inadequate input validation in the decompression functionality in the vcd2lxt2 utility, allowing attackers to execute arbitrary commands by crafting a specially crafted wave file...

OS Command Injection

gtkwave is vulnerable to OS Command Injection. The vulnerability is due to inadequate input validation in the decompression functionality in the vcd2vzt utility, allowing attackers to execute arbitrary commands by exploiting a specially crafted wave file...

CVE-2024-29435

An issue discovered in Alldata v0.4.6 allows attacker to run arbitrary commands via the processId parameter...

CVE-2024-29435

An issue discovered in Alldata v0.4.6 allows attacker to run arbitrary commands via the processId parameter...

CVE-2024-29433

A deserialization vulnerability in the FASTJSON component of Alldata v0.4.6 allows attackers to execute arbitrary commands via supplying crafted data...

CVE-2024-29435

Summary : CVE-2024-29435 affects Alldata v0.4.6, enabling an attacker to execute arbitrary commands via the processId parameter. Affected software : Alldata version 0.4.6. Impact : arbitrary command execution (described as high-risk functionality exposure in multiple sources); CVSS 3.1 base score...

CVE-2024-29433

CVE-2024-29433 affects Alldata v0.4.6 via a deserialization vulnerability in the FASTJSON component, allowing attackers to execute arbitrary commands by supplying crafted data. Documents confirm the vulnerable software/version and the underlying cause; no details on exploitation methods beyond th...

CVE-2024-29435

An issue discovered in Alldata v0.4.6 allows attacker to run arbitrary commands via the processId parameter...

CVE-2024-29433

A deserialization vulnerability in the FASTJSON component of Alldata v0.4.6 allows attackers to execute arbitrary commands via supplying crafted data...

CVE-2024-29433

A deserialization vulnerability in the FASTJSON component of Alldata v0.4.6 allows attackers to execute arbitrary commands via supplying crafted data...

CVE-2023-41724

A command injection vulnerability in Ivanti Sentry prior to 9.19.0 allows unauthenticated threat actor to execute arbitrary commands on the underlying operating system of the appliance within the same physical or logical network...