759 matches found
CVE-2024-43386 Phoenix Contact: OS command execution through EMAIL_NOTIFICATION.TO in mGuard devices.
A low privileged remote attacker can trigger the execution of arbitrary OS commands as root due to improper neutralization of special elements in the variable EMAILNOTIFICATION.TO in mGuard devices...
CVE-2024-43386 Phoenix Contact: OS command execution through EMAIL_NOTIFICATION.TO in mGuard devices.
A low privileged remote attacker can trigger the execution of arbitrary OS commands as root due to improper neutralization of special elements in the variable EMAILNOTIFICATION.TO in mGuard devices...
CVE-2024-43386
CVE-2024-43386 affects Phoenix Contact mGuard devices (including FL/TC MGUARD) where a low-privileged remote attacker can trigger OS command execution as root via improper neutralization of elements in the EMAIL_NOTIFICATION.TO variable. The issue is rooted in input handling of that field, enabli...
CVE-2024-43385
CVE-2024-43385 affects PHOENIX CONTACT mGuard devices. The vulnerability stems from improper neutralization of a special element in the PROXY_HTTP_PORT variable, enabling a low-privileged remote attacker to trigger arbitrary OS command execution as root. Documents identify the affected component ...
CVE-2024-35783: Execution with Unnecessary Privileges
A vulnerability has been identified in SIMATIC BATCH V9.1 All versions, SIMATIC Information Server 2020 All versions V2020 SP2 Update 5, SIMATIC Information Server 2022 All versions V2022 SP1 Update 2, SIMATIC PCS 7 V9.1 All versions V9.1 SP2 UC06, SIMATIC Process Historian 2020 All versions V202...
CVE-2024-21881: Inadequate Encryption Strength
Inadequate Encryption Strength vulnerability allow an authenticated attacker to execute arbitrary OS Commands via encrypted package upload.This issue affects Envoy: 4.x and 5.x...
CVE-2024-40895
FFRI AMC versions 3.4.0 to 3.5.3 and some OEM products that implement/bundle FFRI AMC versions 3.4.0 to 3.5.3 allow a remote unauthenticated attacker to execute arbitrary OS commands when certain conditions are met in an environment where the notification program setting is enabled and the...
CVE-2024-40895
FFRI AMC versions 3.4.0 to 3.5.3 and some OEM products that implement/bundle FFRI AMC versions 3.4.0 to 3.5.3 allow a remote unauthenticated attacker to execute arbitrary OS commands when certain conditions are met in an environment where the notification program setting is enabled and the...
CVE-2024-40895
The management console FFRI AMC (versions 3.4.0 to 3.5.3), along with certain OEM products by NEC Corporation and Sky Co., Ltd. , is vulnerable to an OS command injection (CWE-78). The flaw is triggered when the notification program setting is enabled and the executable file path is configured to...
CVE-2024-5670
The web services of Softnext's products, Mail SQR Expert and Mail Archiving Expert do not properly validate user input, allowing unauthenticated remote attackers to inject arbitrary OS commands and execute them on the remote server...
CVE-2024-38471
Multiple TP-LINK products allow a network-adjacent attacker with an administrative privilege to execute arbitrary OS commands by restoring a crafted backup file. The affected device, with the initial configuration, allows login only from the LAN port or Wi-Fi...
CVE-2024-38471
Multiple TP-LINK products, including the Archer AX3000, Archer AXE75, Archer AX5400, Archer Air R5, and Archer AXE5400 , are vulnerable to an OS command injection (CWE-78) flaw. The root cause is the failure to neutralize special elements used in operating system commands during the backup/restor...
CVE-2024-38471
Multiple TP-LINK products allow a network-adjacent attacker with an administrative privilege to execute arbitrary OS commands by restoring a crafted backup file. The affected device, with the initial configuration, allows login only from the LAN port or Wi-Fi...
CVE-2024-6071 PTC Creo Elements/Direct License Server Missing Authorization
PTC Creo Elements/Direct License Server exposes a web interface which can be used by unauthenticated remote attackers to execute arbitrary OS commands on the server...
CVE-2024-36103
OS command injection vulnerability in WRC-X5400GS-B v1.0.10 and earlier, and WRC-X5400GSA-B v1.0.10 and earlier allows a network-adjacent attacker with an administrative privilege to execute arbitrary OS commands by sending a specially crafted request to the product...
CVE-2024-33793: Improper Neutralization of Special Elements used in an OS Command
netis-systems MEX605 v2.00.06 allows attackers to execute arbitrary OS commands via a crafted payload to the ping test page...
Meinberg LANTIME Remote Code Execution (CVE-2020-7240)
Meinberg Lantime devices allow attackers with privileges to configure a device to execute arbitrary OS commands by editing the /config/netconf.cmd script aka Extended Network Configuration. Note: According to the description, the vulnerability requires a fully authenticated super-user account usi...
Fedora 38 : php (2024-39d50cc975)
The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-39d50cc975 advisory. PHP version 8.2.18 11 Apr 2024 Core: Fixed bug GH-13612 Corrupted memory in destructor with weak references. nielsdos Fixed bug GH-13784...
Command Injection
llamaindex is vulnerable to Command Injection. The vulnerability is due to insufficient input validation in the safeeval function, allowing attackers to craft inputs that execute arbitrary OS commands without containing underscores, thus bypassing security checks...