CVE-2022-43537

Aruba ClearPass Policy Manager web-based management interface contains a vulnerability that allows remote authenticated users to execute arbitrary commands on the underlying OS with root privileges, potentially leading to full system compromise. Affected versions are ClearPass Policy Manager 6.10...

CVE-2022-43536

Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. Successful exploits could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complet...

CVE-2022-43536

Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. Successful exploits could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complet...

CVE-2022-44534

A vulnerability in the Aruba EdgeConnect Enterprise Orchestrator web-based management interface allows remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system...

CVE-2022-44534

The Aruba EdgeConnect Enterprise Orchestrator web-based management interface is affected. Remote authenticated users can execute arbitrary commands on the underlying host with root privileges, leading to full system compromise for affected versions (9.2.1.40179 and below; 9.1.4.40436 and below; 9...

CVE-2022-35845

Multiple improper neutralization of special elements used in an OS Command 'OS Command Injection' vulnerabilities CWE-78 in FortiTester 7.1.0, 7.0 all versions, 4.0.0 through 4.2.0, 2.3.0 through 3.9.1 may allow an authenticated attacker to execute arbitrary commands in the underlying shell...

Command injection

Multiple improper neutralization of special elements used in an OS Command 'OS Command Injection' vulnerabilities CWE-78 in FortiTester 7.1.0, 7.0 all versions, 4.0.0 through 4.2.0, 2.3.0 through 3.9.1 may allow an authenticated attacker to execute arbitrary commands in the underlying shell...

CVE-2022-35845

Multiple improper neutralization of special elements used in an OS Command 'OS Command Injection' vulnerabilities CWE-78 in FortiTester 7.1.0, 7.0 all versions, 4.0.0 through 4.2.0, 2.3.0 through 3.9.1 may allow an authenticated attacker to execute arbitrary commands in the underlying shell...

CVE-2022-35845

Multiple improper neutralization of special elements used in an OS Command 'OS Command Injection' vulnerabilities CWE-78 in FortiTester 7.1.0, 7.0 all versions, 4.0.0 through 4.2.0, 2.3.0 through 3.9.1 may allow an authenticated attacker to execute arbitrary commands in the underlying shell...

Cross site scripting

Out-of-bounds write vulnerability in Remote Desktop Functionality in Synology VPN Plus Server before 1.4.3-0534 and 1.4.4-0635 allows remote attackers to execute arbitrary commands via unspecified vectors...

CVE-2022-40740

Realtek GPON router has insufficient filtering for special characters. A remote attacker authenticated as an administrator can exploit this vulnerability to perform command injection attacks, to execute arbitrary system command, manipulate system or disrupt service...

CVE-2022-43931

Out-of-bounds write vulnerability in Remote Desktop Functionality in Synology VPN Plus Server before 1.4.3-0534 and 1.4.4-0635 allows remote attackers to execute arbitrary commands via unspecified vectors...

CVE-2022-46304 ChangingTec ServiSign - Command Injection

ChangingTec ServiSign component has insufficient filtering for special characters in the connection response parameter. An unauthenticated remote attacker can host a malicious website for the component user to access, which triggers command injection and allows the attacker to execute arbitrary...

PT-2023-13671 · A+Hrd · A+Hrd

Name of the Vulnerable Software and Affected Versions: a+HRD affected versions not specified Description: The issue is related to inadequate filtering for a specific URL parameter in a+HRD, allowing an unauthenticated remote attacker to exploit this and send arbitrary HTTPs requests. This can lea...

PT-2023-14249 · Aruba · Aruba Clearpass Policy Manager

Name of the Vulnerable Software and Affected Versions: Aruba ClearPass Policy Manager versions 6.10.7 and below Aruba ClearPass Policy Manager versions 6.9.12 and below Description: The issue allows remote authenticated users to run arbitrary commands on the underlying host. Successful exploitati...

ServiSign 操作系统命令注入漏洞

Changingtec ServiSign is a system from Changingtec Taiwan, China. The system provides a cross-platform solution for digital signatures and authentication. A security vulnerability exists in ServiSign that stems from insufficient filtering of special characters in connection response parameters. A...

Remote Code Execution (RCE)

topthink/framework is vulnerable to remote execution. The vulnerability exists because the lang parameter is not properly validated, which allows a remote attacker to inject and execute arbitrary commands...

Debian: Security Advisory (DLA-3257-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Security Bulletin: Multiple vulnerabilities in OpenSSL affect IBM Tivoli Netcool System Service Monitors/Application Service Monitors

Summary OpenSSL is used by IBM Tivoli Netcool System Service Monitors/Application Service Monitors for Network Transport. CVE-2022-2068 and CVE-2022-2097 are identified as potential risks for products using older versions of OpenSLL. These potential risks are resolved by updating IBM Tivoli Netco...

Cisco Identity Services Engine Vulnerabilities (cisco-sa-ise-7Q4TNYUx)

According to its self-reported version, Cisco Identity Services Engine is affected by multiple vulnerabilities. - A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to inject arbitrary commands on the underlying operating system...