11426 matches found
CVE-2023-22496
Netdata is an open source option for real-time infrastructure monitoring and troubleshooting. An attacker with the ability to establish a streaming connection can execute arbitrary commands on the targeted Netdata agent. When an alert is triggered, the function "healthalarmexecute" is called. Thi...
CVE-2023-22496
Netdata is an open source option for real-time infrastructure monitoring and troubleshooting. An attacker with the ability to establish a streaming connection can execute arbitrary commands on the targeted Netdata agent. When an alert is triggered, the function healthalarmexecute is called. This...
PT-2023-18547
Name of the Vulnerable Software and Affected Versions Netdata agent versions prior to 1.37 stable and 1.36.0-409 nightly Description An issue exists where an attacker can execute arbitrary commands on a targeted Netdata agent by establishing a streaming connection and providing a specially crafte...
CVE-2023-22496: Improper Input Validation
Netdata is an open source option for real-time infrastructure monitoring and troubleshooting. An attacker with the ability to establish a streaming connection can execute arbitrary commands on the targeted Netdata agent. When an alert is triggered, the function healthalarmexecute is called. This...
Updated ctags packages fix security vulnerability
A flaw was found in Exuberant Ctags in the way it handles the "-o" option. This option specifies the tag filename. A crafted tag filename specified in the command line or in the configuration file results in arbitrary command execution because the externalSortTags in sort.c calls the system3...
CVE-2022-46478
The RPC interface in datax-web v1.0.0 and v2.0.0 to v2.1.2 contains no permission checks by default which allows attackers to execute arbitrary commands via crafted Hessian serialized data...
CVE-2022-46478: Deserialization of Untrusted Data
The RPC interface in datax-web v1.0.0 and v2.0.0 to v2.1.2 contains no permission checks by default which allows attackers to execute arbitrary commands via crafted Hessian serialized data...
CVE-2022-46478
The RPC interface in datax-web v1.0.0 and v2.0.0 to v2.1.2 contains no permission checks by default which allows attackers to execute arbitrary commands via crafted Hessian serialized data...
PT-2023-1539
Name of the Vulnerable Software and Affected Versions TOTOLINK CA300-PoE version 6.2c.884 Description The issue is related to the lack of input sanitization in the NTPSyncWithHost function of the TOTOLINK CA300-PoE router's firmware. This can be exploited by a remote attacker to execute arbitrary...
Web Manager Arbitrary Command Execution
The vulnerability of the data loading function of the Web Manager application in the Lantronix PremierWave 2050 Wi-Fi module exists due to the failure to take measures to neutralize special elements used in the operating system’s command set. Exploiting this vulnerability allows a malicious actor...
FreeBSD : emacs -- arbitary shell command execution vulnerability of ctags (76e2fcce-92d2-11ed-a635-080027f5fec9)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 76e2fcce-92d2-11ed-a635-080027f5fec9 advisory. - GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a...
Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to arbitrary command execution in Git (CVE-2018-1000021)
Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to arbitrary command execution in Git, caused by the failure to validate messages received from a Git server CVE-2018-1000021. Git is included in the base operating system used by IBM Watson Speech. Please read...
Cisco RV160 and RV260 have vulnerabilities in input validation.
Cisco Small Business is a switch from Cisco USA. A security vulnerability exists in the Cisco Small Business RV160, RV260 Series VPN Routers that stems from insufficient validation of user input. An attacker could exploit the vulnerability to execute arbitrary commands...
Linksys WRT54GL Buffer Overflow Vulnerability
The Linksys WRT54GL is a wireless router from Linksys USA. A buffer overflow vulnerability exists in the Linksys WRT54GL Wireless-G Broadband Router. The vulnerability stems from a boundary error in the StartEPI function in the httpd binary when handling untrusted input, and can be exploited by a...
CVE-2022-48253: Improper Limitation of a Pathname to a Restricted Directory
nhttpd in Nostromo before 2.1 is vulnerable to a path traversal that may allow an attacker to execute arbitrary commands on the remote server. The vulnerability occurs when the homedirs option is used...
CVE-2022-46603
An issue in Inkdrop v5.4.1 allows attackers to execute arbitrary commands via uploading a crafted markdown file...
Design/Logic Flaw
An issue in Inkdrop v5.4.1 allows attackers to execute arbitrary commands via uploading a crafted markdown file...
CentOS Web Panel Login Command Execution
The vulnerability of the login/index.php implementation of the server management application for CentOS Web Panel is related to the failure to take measures to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a malicious actor to execute...
CVE-2022-43970: Buffer Copy without Checking Size of Input
A buffer overflow vulnerability exists in Linksys WRT54GL Wireless-G Broadband Router with firmware = 4.30.18.006. A stack-based buffer overflow in the StartEPI function within the httpd binary allows an authenticated attacker with administrator privileges to execute arbitrary commands on the...
