The vulnerability of the AADI GeoView Webservice, a software tool for meteorological observations, lies in the lack of protection for the SQL query structure, allowing attackers to execute arbitrary SQL commands.

The vulnerability of the AADI GeoView Webservice software for meteorological observations lies in the lack of protection for the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL commands remotely...

The vulnerability of the integrated management module (IMM) of IBM System x3550 M3 and IBM System x3650 M3 allows a hacker to execute arbitrary operating system commands.

The vulnerability of the Integrated Management Module IMM of IBM System x3550 M3 and IBM System x3650 M3 exists due to the lack of measures taken to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary...

Security Bulletin: Miscellaneous security vulnerabilities in IBM Spectrum Copy Data Management

Summary IBM Spectrum Copy Data Management uses weaker than expected cryptographic algorithms, authentication, and password rules. In addition, IBM Spectrum Copy Data Management is vulnerable to execution of arbitrary commands on the system, obtaining sensitive information, and clickjacking...

WordPress Duplicate Post Plugin SQL Injection (CVE-2021-43408)

An SQL injection vulnerability exists in WordPress Duplicate Post Plugin. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system...

CVE-2021-34426

A vulnerability was discovered in the Keybase Client for Windows before version 5.6.0 when a user executed the "keybase git lfs-config" command on the command-line. In versions prior to 5.6.0, a malicious actor with write access to a user's Git repository could leverage this vulnerability to...

CVE-2021-34426

A vulnerability was discovered in the Keybase Client for Windows before version 5.6.0 when a user executed the "keybase git lfs-config" command on the command-line. In versions prior to 5.6.0, a malicious actor with write access to a user's Git repository could leverage this vulnerability to...

Command injection

A vulnerability was discovered in the Keybase Client for Windows before version 5.6.0 when a user executed the "keybase git lfs-config" command on the command-line. In versions prior to 5.6.0, a malicious actor with write access to a user's Git repository could leverage this vulnerability to...

PT-2021-24073 · Sap · Sap Netweaver As Abap

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver AS ABAP versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756 Description: The issue allows an attacker with high privileges and direct access to the SAP System to inject code when executing a certai...

KB5008271: Windows Server 2008 Security Update (December 2021)

The remote Windows host is missing security update 5008271 or cumulative update 5008274. It is, therefore, affected by multiple vulnerabilities: - An elevation of privilege vulnerability. An attacker can exploit this to gain elevated privileges. CVE-2021-41333, CVE-2021-43207, CVE-2021-43226,...

CVE-2021-39065

IBM Spectrum Copy Data Management 2.2.13 and earlier is affected by an input-validation vulnerability in the Admin Console login and uploadcertificate function that could enable remote command execution. The root cause is improper validation of user-supplied input, allowing an attacker to inject ...

CVE-2021-39065

IBM Spectrum Copy Data Management 2.2.13 and earlier could allow a remote attacker to execute arbitrary commands on the system, caused by improper validation of user-supplied input by the Spectrum Copy Data Management Admin Console login and uploadcertificate function . A remote attacker could...

The vulnerability of the Cisco NX-OS operating system in Cisco Nexus 9000 Series switches allows a perpetrator to execute arbitrary commands.

The vulnerability of the Cisco NX-OS operating system for Cisco Nexus 9000 Series switches exists due to the lack of measures taken to neutralize the special elements used in the operating system’s commands. Exploiting this vulnerability can allow attackers to increase their privileges...

ExifTool Remote Code Execution (CVE-2021-22204)

A remote code execution vulnerability exists in ExifTool. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

GHSA-F78F-353M-CF4J Code Injection in node-rules

node-rules including 3.0.0 and prior to 5.0.0 allows injection of arbitrary commands. The argument rules of function "fromJSON" can be controlled by users without any sanitization...

Security Bulletin: Vulnerabilities in the Linux Kernel, Docker, Python, and NGINX affect IBM Spectrum Protect Plus

Summary Vulnerabilities in the Linux Kernel, Docker, Python, and NGINX such as directory traversal, execution of arbitrary commands, obtaining sensitive information, elevated privileges, bypassing security restrictions, and denial of service, may affect IBM Spectrum Protect Plus. Vulnerability...

Apache Log4j < 2.15.0 Remote Code Execution (Windows)

The version of Apache Log4j on the remote host is 2.x 2.15.0. It is, therefore, affected by a remote code execution vulnerability in the JNDI parser due to improper log validation. An unauthenticated, remote attacker can exploit this to bypass authentication and execute arbitrary commands. Log4j...

OS Command Injection in adb-driver

adb-driver through 0.1.8 is vulnerable to Command Injection.It allows execution of arbitrary commands via the command function...

Command Injection in compass-compile

compass-compile through 0.0.1 is vulnerable to Command Injection. It allows execution of arbitrary commands via the options argument...

Fortinet FortiWeb Command Injection Vulnerability (CNVD-2021-99770)

Fortinet FortiWeb is a web application layer firewall from Fortinet that blocks threats such as cross-site scripting, SQL injection, cookie poisoning, schema poisoning and other attacks, secures web applications and protects sensitive database content.Fortinet FortiWeb A command injection...

CVE-2021-23862

A crafted configuration packet sent by an authenticated administrative user can be used to execute arbitrary commands in system context. This issue also affects installations of the VRM, DIVAR IP, BVMS with VRM installed, the VIDEOJET decoder VJD-7513 and VJD-8000...