TRENDnet TEW-755AP Command Injection Vulnerability (CNVD-2023-18956)

The TRENDnet TEW-755AP is a router from TRENDnet. The TRENDnet TEW-755AP suffers from a command injection vulnerability that stems from the wpsstaenrolleepin parameter in the setstaenrolleepin5g function failing to correctly filter for constructed command special characters, commands, and so on. ...

TRENDnet TEW-755AP Command Injection Vulnerability

The TRENDnet TEW-755AP is a router from TRENDnet. The TRENDnet TEW-755AP suffers from a command injection vulnerability that stems from the sysservice parameter in the setupwizardmydlink sub4104B8 function failing to correctly filter the construct command special characters, commands, etc. An...

CVE-2022-43538

Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. Successful exploits could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complet...

CVE-2022-43537

Aruba ClearPass Policy Manager web-based management interface contains a vulnerability that allows remote authenticated users to execute arbitrary commands on the underlying OS with root privileges, potentially leading to full system compromise. Affected versions are ClearPass Policy Manager 6.10...

CVE-2022-43536

Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. Successful exploits could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complet...

CVE-2022-43536

Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. Successful exploits could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complet...

CVE-2022-44534

A vulnerability in the Aruba EdgeConnect Enterprise Orchestrator web-based management interface allows remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system...

CVE-2022-44534

The Aruba EdgeConnect Enterprise Orchestrator web-based management interface is affected. Remote authenticated users can execute arbitrary commands on the underlying host with root privileges, leading to full system compromise for affected versions (9.2.1.40179 and below; 9.1.4.40436 and below; 9...

CVE-2022-35845

Multiple improper neutralization of special elements used in an OS Command 'OS Command Injection' vulnerabilities CWE-78 in FortiTester 7.1.0, 7.0 all versions, 4.0.0 through 4.2.0, 2.3.0 through 3.9.1 may allow an authenticated attacker to execute arbitrary commands in the underlying shell...

Command injection

Multiple improper neutralization of special elements used in an OS Command 'OS Command Injection' vulnerabilities CWE-78 in FortiTester 7.1.0, 7.0 all versions, 4.0.0 through 4.2.0, 2.3.0 through 3.9.1 may allow an authenticated attacker to execute arbitrary commands in the underlying shell...

CVE-2022-35845

Multiple improper neutralization of special elements used in an OS Command 'OS Command Injection' vulnerabilities CWE-78 in FortiTester 7.1.0, 7.0 all versions, 4.0.0 through 4.2.0, 2.3.0 through 3.9.1 may allow an authenticated attacker to execute arbitrary commands in the underlying shell...

CVE-2022-35845

Multiple improper neutralization of special elements used in an OS Command 'OS Command Injection' vulnerabilities CWE-78 in FortiTester 7.1.0, 7.0 all versions, 4.0.0 through 4.2.0, 2.3.0 through 3.9.1 may allow an authenticated attacker to execute arbitrary commands in the underlying shell...

Cross site scripting

Out-of-bounds write vulnerability in Remote Desktop Functionality in Synology VPN Plus Server before 1.4.3-0534 and 1.4.4-0635 allows remote attackers to execute arbitrary commands via unspecified vectors...

CVE-2022-40740

Realtek GPON router has insufficient filtering for special characters. A remote attacker authenticated as an administrator can exploit this vulnerability to perform command injection attacks, to execute arbitrary system command, manipulate system or disrupt service...

CVE-2022-43931

Out-of-bounds write vulnerability in Remote Desktop Functionality in Synology VPN Plus Server before 1.4.3-0534 and 1.4.4-0635 allows remote attackers to execute arbitrary commands via unspecified vectors...

CVE-2022-46304 ChangingTec ServiSign - Command Injection

ChangingTec ServiSign component has insufficient filtering for special characters in the connection response parameter. An unauthenticated remote attacker can host a malicious website for the component user to access, which triggers command injection and allows the attacker to execute arbitrary...

PT-2023-14249 · Aruba · Aruba Clearpass Policy Manager

Name of the Vulnerable Software and Affected Versions: Aruba ClearPass Policy Manager versions 6.10.7 and below Aruba ClearPass Policy Manager versions 6.9.12 and below Description: The issue allows remote authenticated users to run arbitrary commands on the underlying host. Successful exploitati...

PT-2023-13671 · A+Hrd · A+Hrd

Name of the Vulnerable Software and Affected Versions: a+HRD affected versions not specified Description: The issue is related to inadequate filtering for a specific URL parameter in a+HRD, allowing an unauthenticated remote attacker to exploit this and send arbitrary HTTPs requests. This can lea...

ServiSign 操作系统命令注入漏洞

Changingtec ServiSign is a system from Changingtec Taiwan, China. The system provides a cross-platform solution for digital signatures and authentication. A security vulnerability exists in ServiSign that stems from insufficient filtering of special characters in connection response parameters. A...

Remote Code Execution (RCE)

topthink/framework is vulnerable to remote execution. The vulnerability exists because the lang parameter is not properly validated, which allows a remote attacker to inject and execute arbitrary commands...