CVE-2022-2354

The WP-DBManager WordPress plugin before 2.80.8 does not prevent administrators from running arbitrary commands on the server in multisite installations, where only super-administrators should...

CVE-2022-2354

The WP-DBManager WordPress plugin before 2.80.8 does not prevent administrators from running arbitrary commands on the server in multisite installations, where only super-administrators should...

D-Link DAP-1860 Command Injection (CVE-2019-19597)

A command injection vulnerability exists in D-Link DAP-1860. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

Aviatrix Gateway 授权问题漏洞

Aviatrix Gateway is a single common platform for multi-cloud networks from Aviatrix USA. A security vulnerability in Aviatrix Gateway versions prior to 6.6.5712 and 6.7.x prior to 6.7.1376 stems from an API function that improperly handles authentication, allowing an authenticated VPN user to...

SQL Injection

loopback-connector-postgresql is vulnerable to sql injection attacks. The vulnerability exists in buildExpression function in postgresql.js because the user provided inputs for contains loopback filter are not properly sanitized which allows an attacker to inject and execute arbitrary sql command...

Weblizar School Management Pro plugin backdoor

Added: 08/12/2022 CVE: CVE-2022-1609 Background Weblizar School Management is a WordPress plugin for management of school operations. Problem The license checking code in School Management Pro contains a backdoor which allows remote attackers to execute arbitrary commands. Resolution Upgrade to t...

Weblizar School Management Pro plugin backdoor

Added: 08/12/2022 CVE: CVE-2022-1609 Background Weblizar School Management is a WordPress plugin for management of school operations. Problem The license checking code in School Management Pro contains a backdoor which allows remote attackers to execute arbitrary commands. Resolution Upgrade to t...

Tenable Nessus 8.x < 8.15.6 Multiple Vulnerabilities (TNS-2022-16)

According to its self-reported version, the Tenable Nessus application running on the remote host is 8.x prior to 8.15.6. It is, therefore, affected by multiple vulnerabilities, including: - An authenticated attacker could create an audit file that bypasses PowerShell cmdlet checks and executes...

Medium: openssl

Issue Overview: A flaw was found in OpenSSL. The issue in CVE-2022-1292 did not find other places in the crehash script where it possibly passed the file names of certificates being hashed to a command executed through the shell. Some operating systems distribute this script in a manner where it ...

Apache Hadoop Parameter Injection Vulnerability

Apache Hadoop is an open source distributed system infrastructure from the Apache Foundation. The product is capable of distributed processing of large amounts of data and is highly reliable, scalable, and fault-tolerant. Apache Hadoop has a security vulnerability that stems from its...

Medium: git

Issue Overview: A vulnerability was found in Git. This flaw occurs due to Git not checking the ownership of directories in a local multi-user system when running commands specified in the local repository configuration. This issue allows the owner of the repository to cause arbitrary commands to ...

Design/Logic Flaw

Apache Hadoop's FileUtil.unTarFile, File API does not escape the input file name before being passed to the shell. An attacker can inject arbitrary commands. This is only used in Hadoop 3.3 InMemoryAliasMap.completeBootstrapTransfer, which is only ever run by a local user. It has been used in...

openssl: the c_rehash script allows command injection

A flaw was found in OpenSSL. The issue in CVE-2022-1292 did not find other places in the crehash script where it possibly passed the file names of certificates being hashed to a command executed through the shell. Some operating systems distribute this script in a manner where it is automatically...

Command Injection

monorepo-build is vulnerable to command injection. The vulnerability exists in the publish function in index.js which allows an attacker to inject and execute arbitrary commands...

CVE-2022-27616

Improper neutralization of special elements used in an OS command 'OS Command Injection' vulnerability in webapi component in Synology DiskStation Manager DSM before 7.0.1-42218-3 allows remote authenticated users to execute arbitrary commands via unspecified vectors...

Command injection

Improper neutralization of special elements used in an OS command 'OS Command Injection' vulnerability in webapi component in Synology DiskStation Manager DSM before 7.0.1-42218-3 allows remote authenticated users to execute arbitrary commands via unspecified vectors...

F5 BIG-IP 代码问题漏洞

F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, remote access policy management, etc. A session expiration time insufficient vulnerability exists in F5 BIG-IP iControl REST, which stems from the fact that after...

TOTOLINK EX300_V2 suffers from a command injection vulnerability (CNVD-2022-60974)

EX300V2 is a repeater from Gion Electronics Shenzhen Co. TOTOLINK EX300V2 suffers from a command injection vulnerability that can be exploited by an attacker to execute arbitrary commands...

Input validation

Shescape is a simple shell escape package for JavaScript. Affected versions were found to have insufficient escaping of white space when interpolating output. This issue only impacts users that use the escape or escapeAll functions with the interpolation option set to true. The result is that if ...

The vulnerability of the “Main” function in the microprogramming system of the TOTOLink T6 mesh system allows a intruder to execute arbitrary commands.

The vulnerability of the “Main” function in the microprogramming system of the TOTOLink T6 mesh system is related to the lack of measures for cleaning input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands through the QUERYSTRING parameter...