CVE-2023-40531

Archer AX6000 firmware versions prior to 'Archer AX6000JPV11.3.0 Build 20221208' allows a network-adjacent authenticated attacker to execute arbitrary OS commands...

GitPython Command Execution

The vulnerability of the Python library for interacting with git repositories, GitPython, is related to the use of an unreliable search path. Exploiting this vulnerability allows an attacker to execute arbitrary commands...

D-Link DAR-8000 OS Command Injection Vulnerability

D-Link DAR-8000 is the Internet Behavior Audit Gateway from China AUO D-Link. The D-Link DAR-8000-10 suffers from an operating system command injection vulnerability that originates from the file parameter of /log/decodmail.php failing to correctly filter constructed command special characters,...

Thinkreed F-RevoCRM Operating System Command Injection Vulnerability

Thinkreed F-RevoCRM is an open source customer relationship management software from Thinkreed Japan. A security vulnerability exists in Thinkreed F-RevoCRM that stems from the ability to execute any command on the operating system where F-RevoCRM operates...

Android btm_ble_gap.cc Arbitrary Command Execution Information Disclosure

The vulnerability of the btmblegap.cc component in the Android operating system is related to reading data beyond the buffer boundaries in memory. Exploiting this vulnerability allows an attacker to execute arbitrary commands and gain access to sensitive information...

MXSecurity SQL Injection Unauthorized Access

The vulnerability of the MXSecurity software platform for managing security in industrial networks stems from the lack of protective measures for SQL query structures. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands and gain unauthorized access to protected...

CVE-2023-1523

Using the TIOCLINUX ioctl request, a malicious snap could inject contents into the input of the controlling terminal which could allow it to cause arbitrary commands to be executed outside of the snap sandbox after the snap exits. Graphical terminal emulators like xterm, gnome-terminal and others...

D-Link DAR-8000 Operating System Command Injection Vulnerability

D-Link DAR-8000 is the Internet Behavior Audit Gateway from China AUO D-Link. The D-Link DAR-8000-10 suffers from an operating system command injection vulnerability that originates from the file parameter of /log/decodmail.php failing to correctly filter constructed command special characters,...

CVE-2023-34392

The CVE-2023-34392 entry describes a Missing Authentication for Critical Function flaw in Schweitzer Engineering Laboratories SEL-5037 SEL Grid Configurator, enabling an attacker to execute arbitrary commands on managed devices via an authorized operator. Affected software is SEL-5037 Grid Config...

CVE-2023-41636

A SQL injection vulnerability in the Data Richiesta dal parameter of GruppoSCAI RealGimm v1.1.37p38 allows attackers to access the database and execute arbitrary commands via a crafted SQL query...

Synology Router Manager operating system command injection vulnerability

Synology Router Manager SRM is a software used to configure and manage Synology routers from Synology Inc. in China. An operating system command injection vulnerability exists in Synology Router Manager versions prior to 1.3 1.3.1-9346-6, which stems from an incorrect neutralization of special...

CVE-2023-34392: Missing Authentication for Critical Function

A Missing Authentication for Critical Function vulnerability in the Schweitzer Engineering Laboratories SEL-5037 SEL Grid Configurator could allow an attacker to run arbitrary commands on managed devices by an authorized device operator. See Instruction Manual Appendix A and Appendix E dated...

CVE-2023-40592

In Splunk Enterprise versions below 9.1.1, 9.0.6, and 8.2.12, an attacker can craft a special web request that can result in reflected cross-site scripting XSS on the “/app/search/table” web endpoint. Exploitation of this vulnerability can lead to the execution of arbitrary commands on the Splunk...

Tenda AC6: Operating System Command Injection Vulnerability

Tenda AC6 is a dual-band wireless router from Tenda that supports 2.4GHz and 5GHz bands with a maximum transmission rate of 1167Mbps and dual-band all-in-one functionality. The Tenda AC6 suffers from a command execution vulnerability that stems from the subADF3C function failing to properly filte...

Tenda AC6: Operating System Command Injection Vulnerability

Tenda AC6 is a dual-band wireless router from Tenda that supports 2.4GHz and 5GHz bands with a maximum transmission rate of 1167Mbps and dual-band all-in-one functionality. The Tenda AC6 suffers from a command execution vulnerability that stems from the sub3A1D0 function failing to properly filte...

CVE-2023-40592: Improper Neutralization of Input During Web Page Generation

In Splunk Enterprise versions below 9.1.1, 9.0.6, and 8.2.12, an attacker can craft a special web request that can result in reflected cross-site scripting XSS on the “/app/search/table” web endpoint. Exploitation of this vulnerability can lead to the execution of arbitrary commands on the Splunk...

ZTE MF286R Command Injection Vulnerability (CNVD-2023-99925)

The ZTE MF286R is a wireless router from China's ZTE Corporation ZTE. A command injection vulnerability exists in the ZTE MF286R CRLVWRGBMF286RV1.0.0B04 version, which originates from an application that fails to properly filter constructed command special characters, commands, and so on. An...

D-Link DAR-8000-10 Operating System Command Injection Vulnerability

D-Link DAR-8000 is the Internet Behavior Audit Gateway from China AUO D-Link. The D-Link DAR-8000-10 version suffers from an operating system command injection vulnerability, which originates from the parameter id of the file /app/sys1.php failing to correctly filter construct command special...

PYSEC-2023-161

GitPython is a python library used to interact with Git repositories. When resolving a program, Python/Windows look for the current working directory, and after that the PATH environment. GitPython defaults to use the git command, if a user runs GitPython from a repo has a git.exe or git...

CVE-2023-1997

An OS Command Injection vulnerability exists in SIMULIA 3DOrchestrate from Release 3DEXPERIENCE R2021x through Release 3DEXPERIENCE R2023x. A specially crafted HTTP request can lead to arbitrary command execution...