Imunify360 Arbitrary Command Execution

The vulnerability of the Ai-Boilt malware scanning service for Linux web servers running Imunify360 is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands using a specially created malware file...

Cisco Application Policy Infrastructure Controller Command Execution

The vulnerability of the Cisco Application Policy Infrastructure Controller’s web interface and API exists due to the lack of measures taken to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands...

Anker Eufy Homebase wifi_country_code_update Heap Buffer Overflow DoS

The vulnerability of the wifiCountryCodeUpdate function in Anker Eufy Homebase software exists because measures are not taken to neutralize the special commands used in the operating system. Exploiting this vulnerability allows a malicious actor to execute arbitrary operating system commands by...

Apache Log4j JNDI message lookup vulnerability

Added: 12/16/2021 Background Apache Log4j is a logging library used by many Java applications. Problem An attacker who is able to control log message content could embed a JNDI reference to an LDAP or RMI URL which downloads an executable Java class, leading to arbitrary command execution...

vBulletin Arbitrary Command Execution

The vulnerability of the commercial vBulletin web forum is related to errors in code generation. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands using a specially created parameter in the ajax/render/widgetphp script...

CVE-2021-34426 Arbitrary command execution in Keybase Client for Windows

A vulnerability was discovered in the Keybase Client for Windows before version 5.6.0 when a user executed the "keybase git lfs-config" command on the command-line. In versions prior to 5.6.0, a malicious actor with write access to a user's Git repository could leverage this vulnerability to...

CVE-2021-34426

A vulnerability was discovered in the Keybase Client for Windows before version 5.6.0 when a user executed the "keybase git lfs-config" command on the command-line. In versions prior to 5.6.0, a malicious actor with write access to a user's Git repository could leverage this vulnerability to...

CVE-2021-34426: Undefined Security Weakness

A vulnerability was discovered in the Keybase Client for Windows before version 5.6.0 when a user executed the "keybase git lfs-config" command on the command-line. In versions prior to 5.6.0, a malicious actor with write access to a user's Git repository could leverage this vulnerability to...

PT-2021-20525

Name of the Vulnerable Software and Affected Versions: Keybase Client for Windows versions prior to 5.6.0 Description: A vulnerability was discovered in the Keybase Client for Windows when a user executed the keybase git lfs-config command on the command-line. In versions prior to 5.6.0, a...

PT-2021-6098

Name of the Vulnerable Software and Affected Versions D-Link DIR 882 version DIR 882 FW1.30B06 Hotfix 02 Description The issue is related to a command injection vulnerability in the twsystem function. This allows attackers to execute arbitrary commands via a crafted HNAP1 POST request to the / AP...

@10yun/cv-mobile-ui (0.3.20), @aiot-toolkit/aiotpack (>=2.0.5-beta.11, <=2.0.5-widget-provider-beta.2) +184 more potentially affected by CVE-2020-7636 via adb-driver (>=0.0.1, <=0.1.8)

adb-driver NPM version =0.0.1, =2.0.5-beta.11, =1.0.0-beta.0, =1.0.0-beta.0, =2.0.0-26820200330001, =2.0.0-27520200518001, =2.0.0-26920200420001, =0.1.0, =1.0.0, =1.9.3, =1.9.3, =0.4.0-beta.0, =2.1.2-beta.1 and more Source cves: CVE-2020-7636 Source advisory: OSV:GHSA-4M6Q-RXHM-675W...

Command injection

A command execution vulnerability exists in the wificountrycodeupdate functionality of the homesecurity binary of Anker Eufy Homebase 2 2.1.6.9h. A specially-crafted set of network packets can lead to arbitrary command execution...

CVE-2021-23862

CVE-2021-23862 describes an authenticated command-injection flaw: a crafted configuration packet sent by an authenticated administrative user can execute arbitrary commands in the system context. Affected products include Bosch VRM, DIVAR IP, BVMS with VRM installed, and the VIDEOJET decoder (VJD...

CVE-2021-42132

A command Injection vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform arbitrary command execution...

CVE-2021-42129

A command injection vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform arbitrary command execution...

Command injection

A command Injection vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform arbitrary command execution...

Command injection

A command injection vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform arbitrary command execution...

CVE-2021-42129

CVE-2021-42129 affects Ivanti Avalanche prior to 6.3.3. Multiple connected sources describe a command injection/remote code execution vulnerability in Ivanti Avalanche components, with different root causes cited: NVD/NVD entry notes a command execution via Inforail Service; Red Hat advisory refe...

CVE-2021-42129: Improper Neutralization of Special Elements used in a Command

A command injection vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform arbitrary command execution...

CVE-2021-42132: Improper Neutralization of Special Elements used in a Command

A command Injection vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform arbitrary command execution...