Command injection

A vulnerability was discovered in the Keybase Client for Windows before version 5.6.0 when a user executed the "keybase git lfs-config" command on the command-line. In versions prior to 5.6.0, a malicious actor with write access to a user's Git repository could leverage this vulnerability to...

PT-2021-24073 · Sap · Sap Netweaver As Abap

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver AS ABAP versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756 Description: The issue allows an attacker with high privileges and direct access to the SAP System to inject code when executing a certai...

KB5008271: Windows Server 2008 Security Update (December 2021)

The remote Windows host is missing security update 5008271 or cumulative update 5008274. It is, therefore, affected by multiple vulnerabilities: - An elevation of privilege vulnerability. An attacker can exploit this to gain elevated privileges. CVE-2021-41333, CVE-2021-43207, CVE-2021-43226,...

CVE-2021-39065

IBM Spectrum Copy Data Management 2.2.13 and earlier is affected by an input-validation vulnerability in the Admin Console login and uploadcertificate function that could enable remote command execution. The root cause is improper validation of user-supplied input, allowing an attacker to inject ...

CVE-2021-39065

IBM Spectrum Copy Data Management 2.2.13 and earlier could allow a remote attacker to execute arbitrary commands on the system, caused by improper validation of user-supplied input by the Spectrum Copy Data Management Admin Console login and uploadcertificate function . A remote attacker could...

The vulnerability of the Cisco NX-OS operating system in Cisco Nexus 9000 Series switches allows a perpetrator to execute arbitrary commands.

The vulnerability of the Cisco NX-OS operating system for Cisco Nexus 9000 Series switches exists due to the lack of measures taken to neutralize the special elements used in the operating system’s commands. Exploiting this vulnerability can allow attackers to increase their privileges...

ExifTool Remote Code Execution (CVE-2021-22204)

A remote code execution vulnerability exists in ExifTool. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

GHSA-F78F-353M-CF4J Code Injection in node-rules

node-rules including 3.0.0 and prior to 5.0.0 allows injection of arbitrary commands. The argument rules of function "fromJSON" can be controlled by users without any sanitization...

Security Bulletin: Vulnerabilities in the Linux Kernel, Docker, Python, and NGINX affect IBM Spectrum Protect Plus

Summary Vulnerabilities in the Linux Kernel, Docker, Python, and NGINX such as directory traversal, execution of arbitrary commands, obtaining sensitive information, elevated privileges, bypassing security restrictions, and denial of service, may affect IBM Spectrum Protect Plus. Vulnerability...

Apache Log4j < 2.15.0 Remote Code Execution (Windows)

The version of Apache Log4j on the remote host is 2.x 2.15.0. It is, therefore, affected by a remote code execution vulnerability in the JNDI parser due to improper log validation. An unauthenticated, remote attacker can exploit this to bypass authentication and execute arbitrary commands. Log4j...

OS Command Injection in adb-driver

adb-driver through 0.1.8 is vulnerable to Command Injection.It allows execution of arbitrary commands via the command function...

Command Injection in compass-compile

compass-compile through 0.0.1 is vulnerable to Command Injection. It allows execution of arbitrary commands via the options argument...

Fortinet FortiWeb Command Injection Vulnerability (CNVD-2021-99770)

Fortinet FortiWeb is a web application layer firewall from Fortinet that blocks threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks, secures web applications and protects sensitive database content.Fortinet FortiWeb A command injection...

CVE-2021-23862

A crafted configuration packet sent by an authenticated administrative user can be used to execute arbitrary commands in system context. This issue also affects installations of the VRM, DIVAR IP, BVMS with VRM installed, the VIDEOJET decoder VJD-7513 and VJD-8000...

Design/Logic Flaw

A crafted configuration packet sent by an authenticated administrative user can be used to execute arbitrary commands in system context. This issue also affects installations of the VRM, DIVAR IP, BVMS with VRM installed, the VIDEOJET decoder VJD-7513 and VJD-8000...

CVE-2021-36195

Multiple command injection vulnerabilities in the command line interpreter of FortiWeb versions 6.4.1, 6.4.0, 6.3.0 through 6.3.15, 6.2.0 through 6.2.6, and 6.1.0 through 6.1.2 may allow an authenticated attacker to execute arbitrary commands on the underlying system shell via specially crafted...

CVE-2021-41063

SQL injection vulnerability was discovered in Aanderaa GeoView Webservice prior to version 2.1.3 that could allow an unauthenticated attackers to execute arbitrary commands...

Fortinet FortiWeb 操作系统操作系统命令注入漏洞

Fortinet FortiWeb is a web application layer firewall from Fortinet that blocks threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks, secures web applications and protects sensitive database content.Fortinet FortiWeb A command injection...

多款Bosch产品操作系统命令注入漏洞

Bosch Access Professional Edition and others are products of Bosch, Germany.Bosch Access Professional Edition is an enterprise access control and security management solution.Bosch VRM is an application.Bosch BVMS is an application... Bosch BVMS is an application software. An operating system...

Fortinet FortiWLC 访问控制错误漏洞

The Fortinet FortiWLC is a wireless LAN controller from Fortinet. An access control error vulnerability exists in the Fortinet FortiWLC, which arises from the product's GUI restrictions not validating the user's identity. The vulnerability can be exploited to execute arbitrary commands. The...