1891 matches found
How to track and stop CVE-2024-3400: Palo Alto Networks API Exploit Causing Critical Infrastructure and Enterprise Epidemics
On Friday April 12, Palo Alto disclosed that some versions of PAN-OS are not only vulnerable to remote code execution, but that the vulnerability has been actively exploited to install backdoors on Palo Alto firewalls. A patch is expected to be available on April 14th. The advisory from Palo Alto...
PT-2024-27378
Name of the Vulnerable Software and Affected Versions TBK DVR-4104 versions prior to 20240412 TBK DVR-4216 versions prior to 20240412 Description An OS command injection issue exists in TBK DVR devices due to insufficient validation of user-supplied input. Remote, unauthenticated attackers can...
Exploit for CVE-2024-24576
Exploring Command Injection Vulnerabilities in Windows with Ni...
CVE-2024-2029
CVE-2024-2029 affects mudler/localai's TranscriptEndpoint.audioToWav. Root cause: unsanitized user filenames passed to ffmpeg via a shell command, enabling arbitrary command execution on the host. Impacts include unauthorized access and data breaches, contingent on process privileges. Connected d...
NETGEAR R6850 c4-IPAddr Parameter Command Injection Vulnerability
The NETGEAR R6850 is a wireless router from NETGEAR. The NETGEAR R6850 suffers from a command injection vulnerability that stems from the c4-IPAddr parameter failing to properly filter constructed command special characters, commands, and so on. An attacker can exploit this vulnerability to cause...
CVE-2024-30713
CVE-2024-30713 entry is rejected/not used and does not represent an active vulnerability.
System Management Module (SMM v1 and v2) and Fan Power Controller (FPC) Vulnerabilities - Lenovo Support US
No description provided...
CVE-2023-6318
A command injection vulnerability exists in the processAnalyticsReport method from the com.webos.service.cloudupload service on webOS version 5 through 7. A series of specially crafted requests can lead to command execution as the root user. An attacker can make authenticated requests to trigger...
CVE-2024-25568
OS command injection vulnerability in ELECOM wireless LAN routers allows a network-adjacent unauthenticated attacker to execute arbitrary OS commands by sending a specially crafted request to the product. Affected products and versions are as follows: WRC-X3200GST3-B v1.25 and earlier, WRC-G01-W...
CVE-2024-25946
Dell vApp Manager, versions prior to 9.2.4.9 contain a Command Injection Vulnerability. An authorized attacker could potentially exploit this vulnerability leading to an execution of an inserted command. Dell recommends customers to upgrade at the earliest opportunity...
Ruijie Networks RG-EG350 操作系统命令注入漏洞
Ruijie Networks RG-EG350 is a multi-service integrated gateway product from China's Ruijie Networks that solves the current egress challenges of small and medium-sized networks. An OS command injection vulnerability exists in Ruijie Networks RG-EG350 20240318 and earlier versions, which originate...
[R1] Stand-alone Security Patch Available for Tenable Security Center versions 5.23.1, 6.1.1, 6.2.0 and 6.2.1: SC-202403.1
R1 Stand-alone Security Patch Available for Tenable Security Center versions 5.23.1, 6.1.1, 6.2.0 and 6.2.1: SC-202403.1 Arnie Cabral Mon, 03/25/2024 - 11:58 Security Center leverages third-party software to help provide underlying functionality. One of the third-party components sqlite was found...
SUSE-SU-2024:0863-1 Security update for fontforge
This update for fontforge fixes the following issues: - CVE-2024-25081: Fixed command injection via crafted filenames bsc1220404. - CVE-2024-25082: Fixed command injection via crafted archives or compressed files bsc1220405...
CVE-2024-2352 1Panel swap baseApi.UpdateDeviceSwap command injection
A vulnerability, which was classified as critical, has been found in 1Panel up to 1.10.1-lts. Affected by this issue is the function baseApi.UpdateDeviceSwap of the file /api/v1/toolbox/device/update/swap. The manipulation of the argument Path with the input 123123123\nopen -a Calculator leads to...
CVE-2024-0815
Command injection in paddle.utils.download.wgetdownload bypass filter in paddlepaddle/paddle 2.6.0...
PT-2024-13448
Name of the Vulnerable Software and Affected Versions Cypress Solutions CTM-200 versions 2.7.1.5600 and below Description The issue is related to an OS command injection vulnerability. This vulnerability can be exploited via the cli text parameter. Recommendations For versions 2.7.1.5600 and belo...
CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2023-21237 Android Pixel Information Disclosure Vulnerability CVE-2021-36380 Sunhillo SureLine OS Command Injection Vulnerablity These types of vulnerabilities are...
TP-LINK ER7206 wireguard VPN Command Injection Vulnerability
The TP-LINK ER7206 is a multi-function Gigabit router from China P&L TP-LINK. The TP-LINK ER7206 wireguard VPN configuration suffers from an input validation vulnerability that can be exploited by a remote attacker to submit a special request that can be used in an application context to execute...
Metasploit Weekly Wrap-Up 02/23/2024
LDAP Capture module Metasploit now has an LDAP capture module thanks to the work of JustAnda7. This work was completed as part of the Google Summer of Code program. When the module runs it will by default require privileges to listen on port 389. The module implements a default implementation for...