CVE-2021-36100

Specially crafted string in OTRS system configuration can allow the execution of any system command...

Extensis Portfolio Multiple Vulnerabilities (CVE-2022-24251; CVE-2022-24252; CVE-2022-24253; CVE-2022-24254)

Multiple vulnerabilities exist in Extensis Portfolio. Successful exploitation of these vulnerabilities could allow a remote attacker to execute arbitrary commands on the affected system...

GHSA-F8XQ-Q7PX-WG8C Improper Neutralization of Formula Elements in a CSV File in Gradio Flagging

Impact The gradio library has a flagging functionality which saves input/output data into a CSV file on the developer's computer. This can allow a user to save arbitrary text into the CSV file, such as commands. If a program like MS Excel opens such a file, then it automatically runs these...

UBUNTU-CVE-2021-23556

The package guake before 3.8.5 are vulnerable to Exposed Dangerous Method or Function due to the exposure of executecommand and executecommandbyuuid methods via the d-bus interface, which makes it possible for a malicious user to run an arbitrary command via the d-bus method. Note: Exploitation...

guake 安全漏洞

guake is a python-based drop-down terminal designed for the GNOME desktop environment. A security vulnerability exists in guake that stems from guake exposing the executecommand and executecommandbyuuid methods via the d-bus interface, which allows a malicious user to run arbitrary commands via t...

Multiple TotoLink Product Command Injection Vulnerabilities (CNVD-2022-47974)

Totolink A830R/A3100R/A950RG/A800R/A3000RU/A810R products are one of the routers from Totolink China. A command injection vulnerability exists in several TotoLink products. The vulnerability stems from the failure of the hosttime parameter in the NTPSyncWithHost function to properly filter the...

Totolink X5000R Command Injection Vulnerability

Totolink X5000R is a router from China-based Jion Electronics Totolink. a command injection vulnerability exists in Totolink X5000R v9.1.0u.6118B20201102, which stems from a failure of the tz parameter in the setNtpCfg function to properly filter the special element of the constructed command. An...

Multiple TotoLink Product Command Injection Vulnerabilities (CNVD-2022-47968)

Totolink A830R/A3100R/A950RG/A800R/A3000RU/A810R products are one of the routers from Totolink China. Several TotoLink products have a command injection vulnerability, which can be exploited by attackers to execute arbitrary commands via crafted requests...

Multiple TotoLink Product Command Injection Vulnerabilities (CNVD-2022-47972)

Totolink A830R/A3100R/A950RG/A800R/A3000RU/A810R products are one of the routers from Totolink China. Several TotoLink products have a command injection vulnerability, which can be exploited by attackers to execute arbitrary commands via crafted requests...

Multiple TotoLink Product Command Injection Vulnerabilities (CNVD-2022-47975)

Totolink A830R/A3100R/A950RG/A800R/A3000RU/A810R and other products are one of the routers from Totolink China. A command injection vulnerability exists in several TotoLink products. The vulnerability stems from the failure of the deviceName parameter and deviceMac parameter in the...

openSUSE 15 Security Update : ansible (openSUSE-SU-2022:0081-1)

The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2022:0081-1 advisory. - A flaw was found in ansible. ansible.cfg is read from the current working directory which can be altered to make it point to a plugin or ...

CVE-2022-26997

Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the upnp function via the upnpttl parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2022-26998

Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the wps setting function via the wpsenroleepin parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2022-27000

Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the time and time zone function via the hprimaryntpserver, hbackupntpserver, and htimezone parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2022-27000

Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the time and time zone function via the hprimaryntpserver, hbackupntpserver, and htimezone parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2022-27003

Totolink routers s X5000R V9.1.0u.6118B20201102 and A7000R V9.1.0u.6115B20201022 were discovered to contain a command injection vulnerability in the Tunnel 6rd function via the relay6rd parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2022-27001

Arris TR3300 v1.0.13 were discovered to contain a command injection vulnerability in the dhcp function via the hostname parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2022-26207

Totolink A830R V5.9c.4729B20191112, A3100R V4.1.2cu.5050B20200504, A950RG V4.1.2cu.5161B20200903, A800R V4.1.2cu.5137B20200730, A3000RU V5.9c.5185B20201128, and A810R V4.1.2cu.5182B20201026 were discovered to contain a command injection vulnerability in the function setDiagnosisCfg, via the...

CVE-2022-26991

Arris routers SBR-AC1900P 1.0.7-B05, SBR-AC3200P 1.0.7-B05 and SBR-AC1200P 1.0.5-B05 were discovered to contain a command injection vulnerability in the ntp function via the TimeZone parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2022-26213

Totolink X5000RFirmware v9.1.0u.6118B20201102 was discovered to contain a command injection vulnerability in the function setNtpCfg, via the tz parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request...