CVE-2021-23359

CVE-2021-23359 affects all versions of port-killer. The root cause is unsanitized attacker-controlled input passed to Node.js child_process.exec, enabling arbitrary command execution. Documentation and related advisories (GHSA-2548-Q746-X5X6, OSV, Veracode, Snyk entry) describe a PoC where runnin...

CVE-2021-20678

SQL injection vulnerability in the Paid Memberships Pro versions prior to 2.5.6 allows remote authenticated attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2021-22860

EIC e-document system does not perform completed identity verification for sorting and filtering personnel data. The vulnerability allows remote attacker to obtain users’ credential information without logging in the system, and further acquire the privileged permissions and execute arbitrary...

CVE-2021-22860

EIC e-document system does not perform completed identity verification for sorting and filtering personnel data. The vulnerability allows remote attacker to obtain users’ credential information without logging in the system, and further acquire the privileged permissions and execute arbitrary...

CVE-2021-22860

EIC e-document system does not perform completed identity verification for sorting and filtering personnel data. The vulnerability allows remote attacker to obtain users’ credential information without logging in the system, and further acquire the privileged permissions and execute arbitrary...

Design/Logic Flaw

EIC e-document system does not perform completed identity verification for sorting and filtering personnel data. The vulnerability allows remote attacker to obtain users’ credential information without logging in the system, and further acquire the privileged permissions and execute arbitrary...

CVE-2021-22860

CVE-2021-22860 affects the EIC e-document system (Excellent Infotek Corporation). The vulnerability arises from incomplete identity verification when sorting and filtering personnel data, allowing a remote attacker to obtain user credentials without logging in and potentially gain privileged perm...

CVE-2021-22859 EIC e-document system - SQL Injection

The users’ data querying function of EIC e-document system does not filter the special characters which resulted in remote attackers can inject SQL syntax and execute arbitrary commands without privilege...

PT-2023-5640 · Cisco · Cisco Ios Xe

Name of the Vulnerable Software and Affected Versions: Cisco IOS XE Software affected versions not specified Description: A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to perform an injection attack against an affected device. This...

EPrints Command Injection (CVE-2021-26476)

A command injection vulnerability exists in EPrints. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

Npm ps-kill command injection vulnerability

Npm ps-kill is an application from Npm, Inc. Npm ps-kill is vulnerable to command injection, which can be exploited by attackers to execute arbitrary commands...

USN-4819-1: Leptonica vulnerabilities

It was discovered that Leptonica incorrectly handled path names. An attacker could possibly use this issue to obtain sensitive information. This issue only affected Ubuntu 16.04 ESM. CVE-2017-18196 It was discovered that Leptonica incorrectly handled certain input arguments. An attacker could...

USN-4771-1: HTCondor vulnerabilities

It was discovered that HTCondor incorrectly invoked the mailx utility. An attacker could use this vulnerability to execute arbitrary commands. This issue only affected Ubuntu 14.04 ESM. CVE-2014-8126 It was discovered that HTCondor mishandled certain crafted input. An attacker could use this...

CVE-2021-23356

This affects all versions of package kill-process-by-name. If attacker-controlled user input is given, it is possible for an attacker to execute arbitrary commands. This is due to use of the childprocess exec function without input sanitization in the index.js file...

Design/Logic Flaw

This affects all versions of package ps-kill. If attacker-controlled user input is given to the kill function, it is possible for an attacker to execute arbitrary commands. This is due to use of the childprocess exec function without input sanitization in the index.js file. PoC provided by...

CVE-2021-23356

CVE-2021-23356 affects all versions of the Node.js package kill-process-by-name. The root cause is use of child_process.exec without input sanitization in index.js, allowing attacker-controlled input to execute arbitrary commands. In practice, this enables arbitrary command execution with network...

D-Link DIR-3060 1.11b04 Command Injection Vulnerability

title: Authenticated Command Injection in D-Link DIR-3060 Web Interface vendor/product: D-Link DIR-3060 https://www.dlink.com/ vulnerable version: v1.11b04 & Below fixed version: v1.11b04 Hotfix 2 CVE number: CVE-2021-28144 impact: 8.8 high CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Vendor...

Cisco SD-WAN Solution Command Injection (cisco-sa-sdwclici-cvrQpH9v)

According to its self-reported version, Cisco SD-WAN Solution is affected by a command injection vulnerability due to insufficient input validation. An authenticated, local attacker can exploit this, by authenticating to the device and submitting crafted input to the CLI utility, in order to inje...

D-Link DIR-3060 Command Injection Vulnerability

The D-Link DIR-3060 is a router from China-based AUO D-Link. The D-Link DIR-3060 suffers from a command injection vulnerability that can be exploited by an attacker to remotely authenticate a user to inject arbitrary commands in the administrative or root environment...

Huawei EulerOS: Security Advisory for net-snmp (EulerOS-SA-2021-1660)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...