The vulnerability in the web interface of Supermicro’s BMC IPMI servers allows a perpetrator to execute arbitrary commands.

The vulnerability of the BMC IPMI server web interface of Supermicro is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands using a specially crafted request...

Microsoft Windows Multiple Vulnerabilities (KB5035845)

This host is missing an important security update according to Microsoft KB5035845 SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...

Microsoft Windows Multiple Vulnerabilities (KB5035854)

This host is missing an important security update according to Microsoft KB5035854 SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...

The vulnerability of the QTS, QuTS hero, and QuTScloud operating systems for QNAP network devices stems from the lack of measures to neutralize special elements, allowing attackers to execute arbitrary commands.

The vulnerability of the QTS, QuTS hero, and QuTScloud operating systems for QNAP network devices is related to the lack of measures taken to neutralize specific elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

Security Updates for Microsoft SharePoint Server 2016 (March 2024)

The Microsoft SharePoint Server 2016 installation on the remote host is missing a security update. It is, therefore, affected by A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute unauthorized arbitrary commands. %NASLMINLEVEL 70300 C Tenable,...

Cisco Firepower Management Center < 6.6.7.1 - Authenticated RCE

Exploit Title: Cisco Firepower Management Center Google Dork: non Date: 12/06/2023 Exploit Author: Abdualhadi khalifa Version: 6.2.3.18", "6.4.0.16", "6.6.7.1 CVE : CVE-2023-20048 import requests import json set the variables for the URL, username, and password for the FMC web services interface...

The vulnerability of the QTS, QuTS Hero, QuTScloud, and myQNAPcloud operating systems exists due to the lack of measures to neutralize special elements, allowing attackers to execute arbitrary commands.

The vulnerability of the QTS, QuTS Hero, QuTScloud, and myQNAPcloud operating systems exists due to the lack of measures taken to neutralize specific elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

SOY CMS Security Vulnerability

SOY CMS is a content management system CMS. A security vulnerability exists in SOY CMS versions prior to 3.14.2 that originates from allowing arbitrary operating system commands to be executed via specially crafted filenames containing semicolons, which can affect jpegoptim functionality...

OS Command Injection

paddlepaddle is vulnerable to OS Command Injection. The vulnerability is due to insufficient URL encoding in the scraping command implemented, allowing potential attackers to execute arbitrary commands on the host system, resulting in Command Injection...

Command Execution Vulnerability in UFIDA NC (CNVD-2024-18070)

UFIDA NC is an integrated financial management software designed to provide companies with a comprehensive financial management solution. A command execution vulnerability exists in UFIDA NC, which can be exploited by an attacker to execute arbitrary commands...

QNAP QTS quick.cgi command execution

Added: 03/08/2024 Background QNAP is an operating system for Network Attached Storage NAS devices. QTS QNAP Turbo NAS System is the Turbo NAS Operating System for entry and mid-level QNAP NAS. Problem A vulnerability in the quick.cgi component in uninitialized QNAP NAS devices allows remote...

BIT-GITLAB-2022-0751

Inaccurate display of Snippet files containing special characters in all versions of GitLab CE/EE allows an attacker to create Snippets with misleading content which could trick unsuspecting users into executing arbitrary commands...

BIT-AIRFLOW-2022-40127 Apache Airflow <2.4.0 has an RCE in a bash example

A vulnerability in Example Dags of Apache Airflow allows an attacker with UI access who can trigger DAGs, to execute arbitrary commands via manually provided runid parameter. This issue affects Apache Airflow Apache Airflow versions prior to 2.4.0...

BIT-LARAVEL-2021-28254

A deserialization vulnerability in the destruct function of Laravel v8.5.9 allows attackers to execute arbitrary commands...

BIT-INFLUXDB-2022-36640

influxData influxDB before v1.8.10 contains no authentication mechanism or controls, allowing unauthenticated attackers to execute arbitrary commands. NOTE: the CVE ID assignment is disputed because the vendor's documentation states "If InfluxDB is being deployed on a publicly accessible endpoint...

K000138827: OpenSSH vulnerability CVE-2023-51385

Security Advisory Description In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, and this name is referenced by an expansion token in certain situations. For example, an untrusted Git repository can have a submodule with shell...

ClamAV Command Execution Vulnerability

ClamAV Clam AntiVirus is a free and open source antivirus program from the ClamAV team. The software is used to detect Trojans, viruses, malware and other malicious threats. A command execution vulnerability exists in ClamAV versions prior to 1.3.0, which stems from insecure handling of filenames...

The vulnerability of the MSSQL Database Storage Backend component in the platform for archiving corporate information, HashiCorp Vault and Vault Enterprise, allows a perpetrator to execute arbitrary SQL commands.

The vulnerability of the MSSQL Database Storage Backend component in the HashiCorp Vault and Vault Enterprise archiving platforms relates to the lack of security measures for SQL query structures. Exploiting this vulnerability allows attackers to execute arbitrary SQL commands...

CVE-2024-25613

Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system...

CVE-2024-25612

Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system...