OESA-2022-1560 ghostscript security update

Ghostscript is an interpreter for PostScript™ and Portable Document Format PDF files. Ghostscript consists of a PostScript interpreter layer, and a graphics library. Security Fixes: A trivial sandbox enabled with the -dSAFER option escape flaw was found in the ghostscript interpreter by injecting...

CVE-2022-25597

ASUS RT-AC86U’s LPD service has insufficient filtering for special characters in the user request, which allows an unauthenticated LAN attacker to perform command injection attack, execute arbitrary commands and disrupt or terminate service...

HP LinuxKI Command Injection (CVE-2020-7209)

A command injection vulnerability exists in HP LinuxKI. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

The vulnerability of the built-in software of NETGEAR routers such as RBS50Y, RBR20, RBR40, RBR50, RBS20, RBS40, RBS50, RBK20, RBK40, RBK50 lies in the lack of measures for cleaning input data. This allows a hacker to execute arbitrary commands.

The vulnerability of the embedded software of NETGEAR RBS50Y, RBR20, RBR40, RBR50, RBS20, RBS40, RBS50, RBK20, RBK40, and RBK50 routers lies in the lack of measures for cleaning input data. Exploiting this vulnerability can allow a remote attacker to execute arbitrary commands...

The vulnerability of the embedded software of NETGEAR’s routers such as LAX20, MK62, MR60, MS60, R6400v2, R6700v3, R6900P, R7000, R7000P, R7850, R7900, R7900P, R7960P, R8000, R8000P, RAX15, RAX20, RAX200, RAX35v2, RAX40v2, RAX43, RAX45, RAX50, RAX75, RAX80, RS400, and XR1000 arises due to the lack of measures for cleaning input data. This allows a malicious actor to execute arbitrary commands.

The vulnerability of NETGEAR’s integrated router software, including models such as LAX20, MK62, MR60, MS60, R6400v2, R6700v3, R6900P, R7000, R7000P, R7850, R7900, R7900P, R7960P, R8000, R8000P, RAX15, RAX20, RAX200, RAX35v2, RAX40v2, RAX43, RAX45, RAX50, RAX75, RAX80, RS400, and XR1000, stems fr...

Command injection

There is remote authenticated OS command injection on TP-Link Archer C20i 0.9.1 3.2 v003a.0 Build 170221 Rel.55462n devices vie the XTPExternalIPv6Address HTTP parameter, allowing a remote attacker to run arbitrary commands on the router with root privileges...

SUSE-SU-2022:0733-1 Security update for zsh

This update for zsh fixes the following issues: - CVE-2021-45444: Fixed a vulnerability where arbitrary shell commands could be executed related to prompt expansion bsc1196435. - CVE-2019-20044: Fixed a vulnerability where shell privileges would not be properly dropped when unsetting the PRIVILEG...

The vulnerability of the embedded software of NETGEAR routers such as D7800, DM200, EX2700, EX6150v2, EX6200v2, EX6250, EX6400, EX6400v2, EX6410, EX6420, EX7300, EX7300v2, EX7320, R7500v2, R7800, R8900, R9000, RAX120, WN3000RPv2, WN3000RPv3, WNR2000v5, XR500, RBK20, RBR20, RBS20, RBK40, RBR40, and RBS40 lies in the absence of measures to clean incoming data. This allows a malicious actor to execute arbitrary commands.

The vulnerability of NETGEAR’s integrated routing software, including models such as D7800, DM200, EX2700, EX6150v2, EX6200v2, EX6250, EX6400, EX6400v2, EX6410, EX6420, EX7300, EX7300v2, EX7320, R7500v2, R7800, R8900, R9000, RAX120, WN3000RPv2, WN3000RPv3, WNR2000v5, XR500, RBK20, RBR20, RBS20,...

The vulnerability of the zsh shell’s command interface, related to the failure to take measures to neutralize special elements, allows a hacker to execute arbitrary commands.

The vulnerability of the zsh shell lies in the lack of measures taken to neutralize special elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

Microsoft Office Security Feature Bypass Vulnerability

A security feature bypass vulnerability exists when Microsoft Office improperly handles input. An attacker who successfully exploited the vulnerability could execute arbitrary commands...

Cisco Small Business Routers Improper Input Validation Vulnerability

A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an authenticated, remote attacker with administrative privileges on an affected device to execute arbitrary commands...

CVE-2021-4039

A command injection vulnerability in the web interface of the Zyxel NWA-1100-NH firmware could allow an attacker to execute arbitrary OS commands on the device...

Fortinet FortiWLM 操作系统命令注入漏洞

A command injection vulnerability exists in Fortinet FortiWLC, a wireless LAN controller from Fortinet, which stems from a failure to properly validate input data in the alert dashboard and controller configuration handler. HTTP requests and execute arbitrary operating system commands on the targ...

Zyxel Nwa-1100-Nh 操作系统命令注入漏洞

The Zyxel Nwa-1100-Nh is a remote Poe access point from China's Heqin Technology Zyxel. The Zyxel NWA-1100-NH suffers from an operating system command injection vulnerability that stems from a command injection vulnerability in the web interface of the Zyxel NWA-1100-NH firmware that could allow ...

C-DATA ONU4FERW OS Command Injection Vulnerability

C-DATA ONU4FERW is used for data management.C-DATA ONU4FERW is vulnerable to OS command injection, which can be exploited by attackers to execute arbitrary commands via the FormImportomCashell function...

Code Injection

Description Improper php function sanitization, lead to an ability to inject arbitrary PHP code and run arbitrary commands on file system. In the function "doleval" in file "dolibarr/htdocs/core/lib/functions.lib.php" dangerous PHP functions are sanitized using "strreplace" and can be bypassed...

Security Bulletin: Ansible vulnerability affects IBM Elastic Storage System (CVE-2021-3583)

Summary IBM Elastic Storage System is shipped with ansible, for which a fix is available for a security vulnerability. Vulnerability Details CVEID: CVE-2021-3583 DESCRIPTION: Ansible could allow a local authenticated attacker to execute arbitrary commands on the system, caused by template injecti...

TOTOLink A3000RU Command Injection Vulnerability

TOTOLink A3000RU is a wireless router from TotoLink, China.TOTOLink A3000RU V5.9c.2280B20180512 is vulnerable to command injection, which can be exploited by attackers to execute arbitrary commands via the QUERYSTRING parameter...

TOTOLink A800R Command Injection Vulnerability

TOTOLink A800R is a wireless router from TotoLink, China.TOTOLink A800R V4.1.2cu.5137B20200730 is vulnerable to command injection, which can be exploited by attackers to execute arbitrary commands via the QUERYSTRING parameter...

TOTOLink T10 Command Injection Vulnerability

TOTOLink T10 is a wireless network system router from TotoLink, China.TOTOLink T10 V5.9c.5061B20200511 is vulnerable to command injection, which can be exploited by attackers to execute arbitrary commands via the QUERYSTRING parameter...