Aruba ClearPass Policy Manager command injection vulnerability

HPE Aruba ClearPass Policy Manager is a Network Access Control NAC solution.A remote command injection vulnerability exists in HPE Aruba ClearPass Policy Manager. An attacker can exploit this vulnerability to execute arbitrary commands...

CVE-2021-40995: Improper Neutralization of Special Elements used in a Command

A remote arbitrary command execution vulnerability was discovered in Aruba ClearPass Policy Manager versions: ClearPass Policy Manager 6.10.x prior to 6.10.2 - - ClearPass Policy Manager 6.9.x prior to 6.9.7-HF1 - - ClearPass Policy Manager 6.8.x prior to 6.8.9-HF1. Aruba has released patches for...

CVE-2021-40994: Improper Neutralization of Special Elements used in a Command

A remote arbitrary command execution vulnerability was discovered in Aruba ClearPass Policy Manager versions: ClearPass Policy Manager 6.10.x prior to 6.10.2 - - ClearPass Policy Manager 6.9.x prior to 6.9.7-HF1 - - ClearPass Policy Manager 6.8.x prior to 6.8.9-HF1. Aruba has released patches for...

Schneider Electric CNM

1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low attack complexity Vendor: Schneider Electric Equipment: ConneXium Network Manager CNM Software Vulnerability: Improper Privilege Management 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to execute arbitrary...

Schneider Electric ConneXium Network Manager Software security vulnerabilities

Schneider Electric ConneXium Network Manager Software Schneider Electric Cnm is an industrial Ethernet network management software from Schneider Electric France. A security vulnerability exists in Schneider Electric ConneXium Network Manager Software that stems from a privilege management issue...

Command injection

A remote arbitrary command execution vulnerability was discovered in HPE Aruba Instant IAP versions: 6.4.x.x: 6.4.4.8-4.2.4.18 and below; Aruba Instant 6.5.x.x: 6.5.4.20 and below; Aruba Instant 8.5.x.x: 8.5.0.12 and below; Aruba Instant 8.6.x.x: 8.6.0.11 and below; Aruba Instant 8.7.x.x: 8.7.1.3...

CVE-2021-37727

CVE-2021-37727 describes a remote command injection in HPE Aruba Instant (IAP) CLI/Web UI. Root cause: improper neutralization of special elements used in a command. Impact: unauthenticated remote arbitrary command execution with high risk, as documented (CVSSv3 base 7.2). Affected: Aruba Instant...

CVE-2021-33733

A vulnerability has been identified in SINEC NMS All versions V1.0 SP2 Update 1. A privileged authenticated attacker could execute arbitrary commands in the local database by sending crafted requests to the webserver of the affected application...

CVE-2021-33733

CVE-2021-33733 affects Siemens SINEC NMS (versions prior to 1.0 SP2 Update 1). The vulnerability is an SQL injection in the web server that, when combined with authenticated access, could allow an attacker to execute arbitrary commands in the local database by sending crafted requests. Impact is ...

CVE-2021-33729

CVE-2021-33729 affects Siemens SINEC NMS, all versions prior to 1.0 SP2 Update 1. It is described as an SQL Injection vulnerability that, when exploited by an authenticated attacker, could allow execution of arbitrary commands in the local database. The connected sources consistently identify thi...

CVE-2021-38180: Improper Neutralization of Formula Elements in a CSV File

SAP Business One - version 10.0, allows an attacker to inject formulas when exporting data to Excel CSV injection due to improper sanitation during the data export. An attacker could thereby execute arbitrary commands on the victim's computer but only if the victim allows to execute macros while...

PT-2021-21989

Name of the Vulnerable Software and Affected Versions: SAP Business One version 10.0 Description: The issue allows an attacker to inject formulas when exporting data to Excel due to improper sanitation during the data export, which can lead to the execution of arbitrary commands on the victim's...

SAP Business One security vulnerabilities

SAP Business One is a suite of enterprise management software from SAP, a German company. SAP Business One version 10.0 is vulnerable to CSV injection, which can be exploited by attackers to execute arbitrary commands on a victim's computer...

CVE-2021-37727: Improper Neutralization of Special Elements used in an OS Command

A remote arbitrary command execution vulnerability was discovered in HPE Aruba Instant IAP versions: 6.4.x.x: 6.4.4.8-4.2.4.18 and below; Aruba Instant 6.5.x.x: 6.5.4.20 and below; Aruba Instant 8.5.x.x: 8.5.0.12 and below; Aruba Instant 8.6.x.x: 8.6.0.11 and below; Aruba Instant 8.7.x.x: 8.7.1.3...

PT-2021-21841

Name of the Vulnerable Software and Affected Versions: HPE Aruba Instant IAP versions 6.4.x.x: 6.4.4.8 through 4.2.4.18 and below HPE Aruba Instant IAP versions 6.5.x.x: 6.5.4.20 and below HPE Aruba Instant IAP versions 8.5.x.x: 8.5.0.12 and below HPE Aruba Instant IAP versions 8.6.x.x: 8.6.0.11...

PT-2021-21846

Name of the Vulnerable Software and Affected Versions: HPE Aruba Instant IAP versions 6.4.x.x: 6.4.4.8 through 4.2.4.17 and below HPE Aruba Instant IAP versions 6.5.x.x: 6.5.4.18 and below HPE Aruba Instant IAP versions 8.5.x.x: 8.5.0.11 and below HPE Aruba Instant IAP versions 8.6.x.x: 8.6.0.6 a...

PT-2021-21844

Name of the Vulnerable Software and Affected Versions: HPE Aruba Instant IAP versions 6.4.4.8 through 6.4.4.18 and below HPE Aruba Instant IAP versions 6.5.4.20 and below HPE Aruba Instant IAP versions 8.5.0.12 and below HPE Aruba Instant IAP versions 8.6.0.11 and below HPE Aruba Instant IAP...

Emerson WirelessHART Gateway operating system command injection vulnerability

The Emerson WirelessHART Gateway is a wireless gateway from Emerson USA. The Emerson WirelessHART Gateway suffers from an operating system command injection vulnerability that originates from incorrect validation of input in a password phrase. An attacker could exploit this vulnerability to pass...

PT-2021-20467

Name of the Vulnerable Software and Affected Versions: QVR versions prior to 5.1.5 build 20210902 Description: A command injection issue has been reported, potentially allowing remote attackers to execute arbitrary commands on QNAP devices running QVR. Recommendations: For versions prior to 5.1.5...

PT-2021-7222

Name of the Vulnerable Software and Affected Versions MCE Systems affected versions not specified Description The vulnerability in the MCE Systems mobile device lifecycle management system's WebView component is related to the failure to neutralize special elements used in the operating system...