ASUS BMC Firmware OS Command Injection Vulnerability

ASUS BMC Firmware is a firmware from Asus China. A security signature issue vulnerability exists in the ASUS BMC's firmware Web management page, which can be exploited by remote attackers to execute arbitrary commands after gaining administrator privileges...

Command Injection

systeminformation is vulnerable to command injection. An attacker is able to pass a string as an array to bypass validation and execute arbitrary commands through the following functions: inetLatency, inetChecksite, services, processLoad...

QNAP QTS 4.5.x Command Injection Vulnerability (CVE-2020-2509)

This VT has been deprecated and replaced by the VT SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2021-28203

The Web Set Media Image function in ASUS BMC’s firmware Web management page does not filter the specific parameter. As obtaining the administrator permission, remote attackers can launch command injection to execute command arbitrary...

Command injection

The specific function in ASUS BMC’s firmware Web management page Modify user’s information function does not filter the specific parameter. As obtaining the administrator permission, remote attackers can launch command injection to execute command arbitrary...

D-Link DIR-846 OS Command Injection Vulnerability

The D-Link DIR-846 is a 6-antenna 1200M full Gigabit dual-band MU-MIMO wireless router. An OS command injection vulnerability exists in the D-Link DIR-846 version A1100.26. A remote attacker can exploit this vulnerability to execute arbitrary commands via shell metacharacters in the ssid0 or ssid...

ASUS BMC Firmware 操作系统命令注入漏洞

ASUS BMC Firmware is a firmware from Asus China. An operating system command injection vulnerability exists in the ASUS BMC Firmware Web management page, which can be exploited by a remote attacker to initiate command injection and execute arbitrary commands after obtaining administrator privileg...

The vulnerability of the Accellion FTA security management system, which stems from the failure to remove special elements used in the operating system’s command set, allows attackers to execute arbitrary commands and gain unauthorized access to protected information.

The vulnerability of the Accellion FTA File Transfer Application security system lies in the lack of measures taken to neutralize special elements used in the operating system’s commands. Exploiting this vulnerability allows attackers to execute arbitrary commands and gain unauthorized access to...

Iteris Vantage Velocity Command Injection (CVE-2020-9020)

A command injection vulnerability exists in Iteris Vantage Velocity. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

Gnu Mailman Command Injection (CVE-2020-12108)

A command injection vulnerability exists in Gnu Mailman. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

CVE-2020-27600

HNAP1/control/SetMasterWLanSettings.php in D-Link D-Link Router DIR-846 DIR-846 A1100.26 allows remote attackers to execute arbitrary commands via shell metacharacters in the ssid0 or ssid1 parameter...

CVE-2020-27600

HNAP1/control/SetMasterWLanSettings.php in D-Link D-Link Router DIR-846 DIR-846 A1100.26 allows remote attackers to execute arbitrary commands via shell metacharacters in the ssid0 or ssid1 parameter...

Rockwell Automation FactoryTalk AssetCentre OS Command Injection Vulnerability

Rockwell Automation FactoryTalk AssetCentre is an asset management software tool from Rockwell Automation that allows manufacturers and industrial companies to centrally manage controllers and other automation-related assets. An OS command injection vulnerability exists in Rockwell Automation...

CVE-2021-23348

This affects the package portprocesses before 1.0.5. If attacker-controlled user input is given to the killProcess function, it is possible for an attacker to execute arbitrary commands. This is due to use of the childprocess exec function without input sanitization...

Input validation

This affects the package portprocesses before 1.0.5. If attacker-controlled user input is given to the killProcess function, it is possible for an attacker to execute arbitrary commands. This is due to use of the childprocess exec function without input sanitization...

CVE-2021-23348 Arbitrary Command Injection

This affects the package portprocesses before 1.0.5. If attacker-controlled user input is given to the killProcess function, it is possible for an attacker to execute arbitrary commands. This is due to use of the childprocess exec function without input sanitization...

CVE-2021-23348

CVE-2021-23348 affects the portprocesses package (pre-1.0.5). The killProcess function accepts attacker-controlled input and uses child_process.exec without input sanitization, enabling arbitrary command execution. Exploitation details are supported by multiple sources (GHSA, OSV, NVD, Snyk) and ...

CVE-2021-23348

This affects the package portprocesses before 1.0.5. If attacker-controlled user input is given to the killProcess function, it is possible for an attacker to execute arbitrary commands. This is due to use of the childprocess exec function without input sanitization...

Code Injection in trentm/json

✍️ Description json is a 'json' command tool for massaging and processing JSON on the command line. Affected versions of this package are vulnerable to Arbitrary Code Injection via the -d argument. 🕵️‍♂️ Proof of Concept curl -sL 'https://api.github.com/repos/joyent/node/issues?state=open' |...

OS Command Injection

kill-by-port is vulnerable to OS command injection. An attacker is able to inject and execute arbitrary OS commands due to the passing of untrusted user input to the childprocess.exec function...