CVE-2021-23399

This affects all versions of package wincred. If attacker-controlled user input is given to the getCredential function, it is possible for an attacker to execute arbitrary commands. This is due to use of the childprocess exec function without input sanitization...

CVE-2021-20745

Inkdrop versions prior to v5.3.1 allows an attacker to execute arbitrary OS commands on the system where it runs by loading a file or code snippet containing an invalid iframe into Inkdrop...

CVE-2021-20740

Hitachi Virtual File Platform Versions prior to 5.5.3-09 and Versions prior to 6.4.3-09, and NEC Storage M Series NAS Gateway Nh4a/Nh8a versions prior to FOS 5.5.3-08NEC2.5.4a and Nh4b/Nh8b, Nh4c/Nh8c versions prior to FOS 6.4.3-08NEC3.4.2 allow remote authenticated attackers to execute arbitrary...

Weidmueller Industrial WLAN devices operating system command injection vulnerability (CNVD-2021-48131)

Weidmueller Industrial WLAN devices is an industrial WIAN from Weidmueller, Germany. The Weidmueller Industrial WLAN devices operating system command injection vulnerability can be exploited by an attacker to take full control of the device via specially crafted network configuration information...

CVE-2021-23399: Improper Neutralization of Special Elements used in an OS Command

This affects all versions of package wincred. If attacker-controlled user input is given to the getCredential function, it is possible for an attacker to execute arbitrary commands. This is due to use of the childprocess exec function without input sanitization...

CVE-2020-17759

An issue was found in the Evernote client for Windows 10, 7, and 2008 in the protocol handler. This enables attackers for arbitrary command execution if the user clicks on a specially crafted URL. AKA: WINNOTE-19941...

CVE-2020-17759

CVE-2020-17759 affects the Evernote client for Windows 10, 7, and 2008 via the protocol handler. The vulnerability allows attackers to achieve arbitrary command execution when a user clicks a specially crafted URL. This is the root cause described across multiple connected sources (e.g., NVD entr...

CVE-2020-17759

An issue was found in the Evernote client for Windows 10, 7, and 2008 in the protocol handler. This enables attackers for arbitrary command execution if the user clicks on a specially crafted URL. AKA: WINNOTE-19941...

CVE-2021-28800: Improper Neutralization of Special Elements used in an OS Command

A command injection vulnerability has been reported to affect QNAP NAS running legacy versions of QTS. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. This issue affects: QNAP Systems Inc. QTS versions prior to 4.3.6.1663 Build 2021050...

PT-2021-17924

Name of the Vulnerable Software and Affected Versions: QNAP Systems Inc. QTS versions prior to 4.3.6.1663 Build 20210504 QNAP Systems Inc. QTS versions prior to 4.3.3.1624 Build 20210416 Description: A command injection issue has been reported to affect QNAP NAS running legacy versions of QTS. If...

CVE-2020-7862: Improper Input Validation

A vulnerability in agent program of HelpU remote control solution could allow an authenticated remote attacker to execute arbitrary commands This vulnerability is due to insufficient input santization when communicating customer process...

CVE-2020-17759: Improper Neutralization of Special Elements used in a Command

An issue was found in the Evernote client for Windows 10, 7, and 2008 in the protocol handler. This enables attackers for arbitrary command execution if the user clicks on a specially crafted URL. AKA: WINNOTE-19941...

PT-2021-10111

Name of the Vulnerable Software and Affected Versions: Evernote client for Windows versions 7, 10, and 2008 Description: The issue found in the Evernote client enables attackers to execute arbitrary commands if a user clicks on a specially crafted URL, due to a problem in the protocol handler...

CVE-2021-1571

CVE-2021-1571 affects Cisco Small Business 220 Series Smart Switches’ web-based management interface. The issue stems from improper checks of parameter values, enabling multiple vulnerabilities: session hijacking, potential arbitrary command execution as root, cross-site scripting (XSS), and HTML...

Cisco Small Business 220 Series Smart Switches Vulnerabilities

Multiple vulnerabilities in the web-based management interface of Cisco Small Business 220 Series Smart Switches could allow an attacker to do the following: Hijack a user session Execute arbitrary commands as a root user on the underlying operating system Conduct a cross-site scripting XSS attac...

PT-2021-3855

Name of the Vulnerable Software and Affected Versions FortiMail versions prior to 6.4.4 Description The issue is related to the improper neutralization of special elements used in an OS command in the administrative interface of FortiMail. This could allow a remote attacker to execute arbitrary...

Citrix Virtual Apps and Desktops multiple vulnerabilities (CTX285059)

The version of Citrix Virtual Apps and Desktops installed on the remote Windows host is prior to 7 2006 or prior to 1912 LTSR CU1. It is, therefore, affected by multiple vulnerabilities: - An authenticated user on a multi-session VDA can perform arbitrary command execution as SYSTEM. CVE-2020-826...

D-Link DIR-846 Router Arbitrary Command Execution

The vulnerability of the SetWizardConfig function in D-Link DIR-846 router microprogramming software is related to insufficient checking of arguments passed in commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands using a specially created request /HNAP1/...

CVE-2021-34546

NetSetMan Pro vulnerability CVE-2021-34546 affects NetSetMan Pro before 5.0 where the pre-logon profile switch button on the Windows logon screen, if enabled, allows an unauthenticated attacker with physical access to drop to an administrative shell and run commands as SYSTEM via the Save log to ...

CVE-2021-20731

The CVE-2021-20731 vulnerability affects Buffalo WSR-1166DHP3 (firmware up to v1.16) and WSR-1166DHP4 (firmware up to v1.02), where an unauthenticated network-adjacent attacker can inject and execute arbitrary OS commands with root privileges. The root cause is an OS command injection flaw in the...