CVE-2023-4856

A format string vulnerability was identified in SMM/SMM2 and FPC that could allow an authenticated user to execute arbitrary commands on a specific API endpoint...

CVE-2023-4856

A format string vulnerability was identified in SMM/SMM2 and FPC that could allow an authenticated user to execute arbitrary commands on a specific API endpoint...

CVE-2024-1655 ASUS WiFi Router - OS Command Injection

Certain ASUS WiFi routers models has an OS Command Injection vulnerability, allowing an authenticated remote attacker to execute arbitrary system commands by sending a specially crafted request...

CVE-2023-33806

Insecure default configurations in Hikvision Interactive Tablet DS-D5B86RB/B V2.3.0 build220119, allows attackers to execute arbitrary commands...

PT-2024-22740

Name of the Vulnerable Software and Affected Versions BentoML affected versions not specified Description An insecure deserialization vulnerability exists in the BentoML framework, allowing remote code execution RCE by sending a specially crafted POST request. By exploiting this vulnerability,...

CVE-2023-33806

Insecure default configurations in Hikvision Interactive Tablet DS-D5B86RB/B V2.3.0 build220119, allows attackers to execute arbitrary commands...

Buffalo wireless LAN routers 安全漏洞

Buffalo wireless LAN routers is a series of routers from Buffalo Japan. A security vulnerability exists in Buffalo wireless LAN routers. An attacker could exploit the vulnerability to execute arbitrary operating system commands...

Planet IGS-4215-16T2S IP address feature command injection vulnerability

The Planet IGS-4215-16T2S is an industrial grade switching device. The Planet IGS-4215-16T2S suffers from a command injection vulnerability that can be exploited by an attacker to execute arbitrary commands on the host via the IP address...

CVE-2023-33806

The CVE-2023-33806 issue concerns Hikvision Interactive Tablet DS-D5B86RB/B, version 2.3.0 build220119, with insecure default configurations that allow an attacker to execute arbitrary commands. The connected sources (Red Hat and CNNVD/NVD/CVE lists, and PT-Security note) confirm the product and ...

Planex MZK-MF300N 命令注入漏洞

The Planex MZK-MF300N is a world's smallest wireless LAN multi-pocket router from Planex Japan. An operating system command injection vulnerability exists in the Planex MZK-MF300N. An attacker could exploit this vulnerability to execute arbitrary commands by sending specially crafted requests to...

Exploit for Improper Input Validation in Paloaltonetworks Pan-Os

PAN-OS Firewall Exploit Script This script is designed to demo...

Command Execution Vulnerability in Internet Behavior Management and Audit System of Beijing StarNet Ruijie Network Technology Co. Ltd (CNVD-2024-22513)

Beijing StarNet Ruijie Network Technology Co., Ltd. is an ICT infrastructure and industry solutions provider. A command execution vulnerability exists in the Internet Behavior Management and Audit System of Beijing StarNet Ruijie Network Technology Company Limited, which can be exploited by...

Siemens Scalance W1750D Improper Neutralization of Special Elements used in a Command (CVE-2023-45625)

Multiple authenticated command injection vulnerabilities exist in the command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system. This plugin only works with Tenable.ot. Pleas...

Command Injection

github.com/go-skynet/localai is vulnerable to command injection. The vulnerability is due to the lack of sanitization of user-supplied filenames before passing them to ffmpeg via a shell command in the audioToWav function, allowing attackers to execute arbitrary commands on the host system...

SUSE SLES12 Security Update : texlive-specs-k (SUSE-SU-2024:1203-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:1203-1 advisory. CVE-2016-10243: Fixed arbitrary code execution via mpost during TeX document compilation bsc1028271 Tenable has extracted the preceding...

CVE-2024-22722

Server Side Template Injection SSTI vulnerability in Form Tools 3.1.1 allows attackers to run arbitrary commands via the Group Name field under the add forms section of the application...

CVE-2024-22722

Server Side Template Injection SSTI vulnerability in Form Tools 3.1.1 allows attackers to run arbitrary commands via the Group Name field under the add forms section of the application...

Planet IGS-4215-16T2S 安全漏洞

The Planet IGS-4215-16T2S is an industrial grade switching device. The Planet IGS-4215-16T2S suffers from a command injection vulnerability that can be exploited by an attacker to execute arbitrary commands on the host via the IP address...

CVE-2024-22722

Server Side Template Injection SSTI vulnerability in Form Tools 3.1.1 allows attackers to run arbitrary commands via the Group Name field under the add forms section of the application...

CVE-2024-22722

CVE-2024-22722 is a Server-Side Template Injection (SSTI) vulnerability in Form Tools 3.1.1. Affected component is the form-creation workflow, specifically the Group Name field under Add Forms, where SSTI can lead to arbitrary command execution. Publicly available exploit(s) exist: a GitHub proje...