Design/Logic Flaw

An arbitrary file upload vulnerability in Web@rchiv 1.0 allows attackers to execute arbitrary commands via a crafted PHP file...

CVE-2022-28695

On F5 BIG-IP AFM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions prior to 13.1.5, an authenticated attacker with high privileges can upload a maliciously crafted file to the BIG-IP AFM Configuration utility, which allows...

USN-5402-1: OpenSSL vulnerabilities

Elison Niven discovered that OpenSSL incorrectly handled the crehash script. A local attacker could possibly use this issue to execute arbitrary commands when crehash is run. CVE-2022-1292 Raul Metsma discovered that OpenSSL incorrectly verified certain response signing certificates. A remote...

Apache Struts's DebuggingInterceptor component allows remote code execution in developer mode

The DebuggingInterceptor component in Apache Struts before 2.3.1.1, when developer mode is used, allows remote attackers to execute arbitrary commands via unspecified vectors. NOTE: the vendor characterizes this behavior as not "a security vulnerability itself."...

Cisco Small Business RV Series Routers 操作系统命令注入漏洞

Cisco Small Business RV Series Routers is an RV series router from Cisco, U.S. A command injection vulnerability exists in Cisco Small Business RV Series Routers, which can be exploited by attackers to inject and execute arbitrary commands on the underlying operating system of the affected device...

Cisco Small Business RV Series Routers 操作系统命令注入漏洞

The Cisco Small Business RV Series Routers is an RV Series router from Cisco. The Cisco Small Business RV340 and RV345 Routers are vulnerable to an operating system command injection vulnerability that arises from insufficient validation of user-supplied input in the web-based management interfac...

CVE-2022-1292

A flaw was found in OpenSSL. The crehash script does not properly sanitize shell meta-characters to prevent command injection. Some operating systems distribute this script in a manner where it is automatically executed. This flaw allows an attacker to execute arbitrary commands with the privileg...

Vulnerability in OpenSSL - The c_rehash script allows command injection

The crehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the...

CVE-2022-28573

D-Link DIR-823-Pro v1.0.2 was discovered to contain a command injection vulnerability in the function SetNTPserverSeting. This vulnerability allows attackers to execute arbitrary commands via the systemtimetimezone parameter...

Improper input validation in Mort Bay Jetty

Mort Bay Jetty 6.x through 6.1.22 and 7.0.0 writes backtrace data without sanitizing non-printable characters, which might allow remote attackers to modify a window's title, or possibly execute arbitrary commands or overwrite files, via an HTTP request containing an escape sequence for a terminal...

GHSA-3CQW-PXGR-JHRM TYPO3 Backend Command Injection via Shell Metacharacters in Uploaded File Name

The Backend subcomponent in TYPO3 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10, and 4.3.x before 4.3beta2, when the DAM extension or ftp upload is enabled, allows remote authenticated users to execute arbitrary commands via shell metacharacters in a filename...

GHSA-74W6-WW7W-45J9 Indexed Search Engine for TYPO3 Command Execution via Metacharacter Injection

The Indexed Search Engine indexedsearch system extension in TYPO3 4.0.0 through 4.0.9, 4.1.0 through 4.1.7, and 4.2.0 through 4.2.3 allows remote attackers to execute arbitrary commands via a crafted filename containing shell metacharacters, which is not properly handled by the command-line index...

Indexed Search Engine for TYPO3 Command Execution via Metacharacter Injection

The Indexed Search Engine indexedsearch system extension in TYPO3 4.0.0 through 4.0.9, 4.1.0 through 4.1.7, and 4.2.0 through 4.2.3 allows remote attackers to execute arbitrary commands via a crafted filename containing shell metacharacters, which is not properly handled by the command-line index...

D-Link DIR-820L Command Injection (CVE-2022-26258)

A command injection vulnerability exists in D-Link DIR-820L. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

TOTOLink A3000R Command Injection (CVE-2022-25075)

A command injection vulnerability exists in TOTOLink A3000R. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

TOTOLink A3100R Command Injection (CVE-2022-25077)

A command injection vulnerability exists in TOTOLink A3100R. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

Draytek Vigor Command Injection (CVE-2021-43118)

A command injection vulnerability exists in Draytek Vigor. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

TP-LINK TL-WR840N Command Injection (CVE-2022-25060)

A command injection vulnerability exists in TP-LINK TL-WR840N. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

USN-5376-3 git regression

USN-5376-1 fixed vulnerabilities in Git, some patches were missing to properly fix the issue. This update fixes the problem. Original advisory details: 俞晨东 discovered that Git incorrectly handled certain repository paths in platforms with multiple users support. An attacker could possibly use thi...

USN-5376-3: Git regression

USN-5376-1 fixed vulnerabilities in Git, some patches were missing to properly fix the issue. This update fixes the problem. Original advisory details: 俞晨东 discovered that Git incorrectly handled certain repository paths in platforms with multiple users support. An attacker could possibly use thi...