Parallels Remote Application Server security vulnerabilities

Parallels Remote Application Server RAS is an application delivery and VDI Virtual Desktop Infrastructure solution from Parallels, Inc. in the United States. A security vulnerability exists in Parallels Remote Application Server version v18.0 that stems from the vulnerability of the web client to...

CVE-2022-44808: Improper Neutralization of Special Elements used in an OS Command

A command injection vulnerability has been found on D-Link DIR-823G devices with firmware version 1.02B03 that allows an attacker to execute arbitrary operating system commands through well-designed /HNAP1 requests. Before the HNAP API function can process the request, the system function execute...

xterm: Arbitrary Code Execution

Background xterm is a terminal emulator for the X Window system. Description xterm does not correctly handle control characters related to OSC 50 font ops sequence handling. Impact The vulnerability allows text written to the terminal to write text to the terminal's command line. If the terminal'...

PT-2022-25595 · Parallels · Parallels Remote Application Server

Name of the Vulnerable Software and Affected Versions: Parallels Remote Application Server version 18.0 Description: The issue allows attackers to execute arbitrary commands via a crafted payload injected into the Host header, which is a result of a Host Header Injection attack. This enables...

CVE-2022-40870

The Web Client of Parallels Remote Application Server v18.0 is vulnerable to Host Header Injection attacks. This vulnerability allows attackers to execute arbitrary commands via a crafted payload injected into the Host header...

CVE-2022-40870: Improper Encoding or Escaping of Output

The Web Client of Parallels Remote Application Server v18.0 is vulnerable to Host Header Injection attacks. This vulnerability allows attackers to execute arbitrary commands via a crafted payload injected into the Host header...

Sourcegraph security vulnerabilities

Sourcegraph is an open source code search and navigation tool from Sourcegraph, Inc. A security vulnerability exists in Sourcegraph versions prior to 4.1.0, which can be exploited to execute arbitrary commands on the Gitserver when a site administrator enables the experimental "customGitFetch"...

D-link DIR-823G SetNetworkTomographySettings Command Execution

The vulnerability of the SetNetworkTomographySettings function implementation in D-link DIR-823G router microprogramming software is related to insufficient cleaning of input data used in commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands by sending...

CVE-2022-41943: Incorrect Default Permissions

sourcegraph is a code intelligence platform. As a site admin it was possible to execute arbitrary commands on Gitserver when the experimental customGitFetch feature was enabled. This experimental feature has now been disabled by default. This issue has been patched in version 4.1.0...

Apache Airflow operating system command injection vulnerability

Apache Airflow is an open source platform for creating, managing, and monitoring workflows from the Apache Foundation. The platform features scalable and dynamic monitoring. Apache Airflow is vulnerable to an operating system command injection vulnerability, which stems from an improper...

CVE-2022-41943 Incorrect default permissions found in Sourcegraph

sourcegraph is a code intelligence platform. As a site admin it was possible to execute arbitrary commands on Gitserver when the experimental customGitFetch feature was enabled. This experimental feature has now been disabled by default. This issue has been patched in version 4.1.0...

CVE-2022-45461

The Java Admin Console in Veritas NetBackup through 10.1 and related Veritas products on Linux and UNIX allows authenticated non-root users that have been explicitly added to the auth.conf file to execute arbitrary commands as root...

CVE-2022-44000

An issue was discovered in BACKCLICK Professional 5.9.63. Due to an exposed internal communications interface, it is possible to execute arbitrary system commands on the server...

BACKCLICK security vulnerabilities

BACKCLICK is a marketing software from BACKCLICK Germany that helps organizations create, implement, evaluate, and run web-based email campaigns. A security vulnerability exists in BACKCLICK Professional 5.9.63, which stems from its publicly available internal communication interface that allows ...

CVE-2022-44000

An issue was discovered in BACKCLICK Professional 5.9.63. Due to an exposed internal communications interface, it is possible to execute arbitrary system commands on the server...

BACKCLICK Access Control Vulnerability

BACKCLICK is a marketing software from BACKCLICK, Germany, that helps organizations create, implement, evaluate, and run web-based email campaigns. A security vulnerability exists in BACKCLICK Professional version 5.9.63, which stems from its publicly available CORBA management service that allow...

CVE-2022-40847

In Tenda AC1200 Router model W15Ev2 V15.11.0.101576, there exists a command injection vulnerability in the function formSetFixTools. This vulnerability allows attackers to run arbitrary commands on the server via the hostname parameter...

CVE-2022-40127

A vulnerability in Example Dags of Apache Airflow allows an attacker with UI access who can trigger DAGs, to execute arbitrary commands via manually provided runid parameter. This issue affects Apache Airflow Apache Airflow versions prior to 2.4.0...

Tenda AC1200 Operating System Command Injection Vulnerability

The Tenda AC1200 is a wireless router from Tenda, China. A security vulnerability exists in the Tenda AC1200 version 15.11.0.10, which is caused by a command injection vulnerability in the function formSetFixTools. The vulnerability allows an attacker to run arbitrary commands on the server via...

CVE-2022-40127: Improper Control of Generation of Code

A vulnerability in Example Dags of Apache Airflow allows an attacker with UI access who can trigger DAGs, to execute arbitrary commands via manually provided runid parameter. This issue affects Apache Airflow Apache Airflow versions prior to 2.4.0...