93299 matches found
CVE-2026-106056
Rundeck versions before 6.2.0 are vulnerable to an OS command injection vulnerability. The flaw exists because the CLIUtils.quoteWindowsCMDArg method wraps free-text options in ineffective single quotes, allowing authenticated users with job run permissions to inject cmd.exe metacharacters like &...
CVE-2026-106056 Rundeck before 6.2.0 OS Command Injection via Windows Job Option Quoting
Rundeck before 6.2.0 contains an OS command injection vulnerability that allows authenticated users with job run permission to execute commands on Windows nodes by supplying crafted option values. Attackers can inject cmd.exe metacharacters such as && or | into free-text options, which...
CVE-2026-106056 Rundeck before 6.2.0 OS Command Injection via Windows Job Option Quoting
Rundeck before 6.2.0 contains an OS command injection vulnerability that allows authenticated users with job run permission to execute commands on Windows nodes by supplying crafted option values. Attackers can inject cmd.exe metacharacters such as && or | into free-text options, which...
CVE-2024-31317-Deployer
CVE-2024-31317 Deployer 🔒 보안 연구 고지 이 프로젝트는 보안 연구 및 교육 목적으로만 사용됩니다. 이 도구를 사용하여 승인되지 않은 테스트를 수행하는 것은 불법입니다. 저자는 어떠한 오용이나 손해에 대해서도 책임을 지지 않습니다. 📋 개요 CVE-2024-31317은 Android 9부터 Android 13까지의 기기에 영향을 미치는 심각한 보안 취약점으로, WRITESECURESETTINGS 권한을 가진 애플리케이션이 명령어 주입을 통해 시스템 수준 권한 실행을 얻을 수 있습니다. 이 프로젝트는 해당...
CVE-2026-92531
Operating system command injection vulnerability in the SVN integration component of BugTracker.NET. The application incorporates the value of the field corresponding to the repository into an svn.exe command without properly validating it. An authenticated user with administrator privileges coul...
CVE-2023-22496-PoC
CVE-2023-22496 — Внедрение команд ОС в Netdata Agent PoC Критичность : Критический CVSS 9.8 Затронуто : Netdata Agent Исправлено в : v1.37.0 Тип : Внедрение команд ОС CWE-78 Обзор CVE-2023-22496 — это уязвимость внедрения команд ОС в системе уведомлений о предупреждениях Netdata. registryhostname...
CVE-2026-92531 Improper Neutralization of Special Elements used in an OS Command in BugTracker.NET
Operating system command injection vulnerability in the SVN integration component of BugTracker.NET. The application incorporates the value of the field corresponding to the repository into an svn.exe command without properly validating it. An authenticated user with administrator privileges coul...
EUVD-2026-94283
Operating system command injection vulnerability in the SVN integration component of BugTracker.NET. The application incorporates the value of the field corresponding to the repository into an svn.exe command without properly validating it. An authenticated user with administrator privileges coul...
CVE-2026-92531
BugTracker.NET contains an operating system command injection vulnerability in its SVN integration component . The application fails to properly validate the repository field value before incorporating it into an svn.exe command. An authenticated user with administrator privileges can store manip...
CVE-2026-92531 Improper Neutralization of Special Elements used in an OS Command in BugTracker.NET
Operating system command injection vulnerability in the SVN integration component of BugTracker.NET. The application incorporates the value of the field corresponding to the repository into an svn.exe command without properly validating it. An authenticated user with administrator privileges coul...
CVE-2026-54161
CVE-2026-54161 PoC Краткое описание upsmon интерполирует передаваемое сервером и контролируемое злоумышленником значениеups.alarm без очистки в команду оболочки, которая выполняется через system. Когда отслеживаемое устройство сообщает о состоянии ALARM и оператор настроил NOTIFYCMD с EXEC на...
CVE-2026-34038
CVE-2026-34038: Coolify에서의 인증된 원격 명령어 삽입 이 저장소는 CVE-2026-34038 에 대한 문서와 분석을 포함합니다. 이는 Coolify의 심각한 명령어 삽입 취약점입니다. 요약 Coolify에서 인증된 원격 명령어 삽입 취약점CWE-78으로 인해 애플리케이션 "쓰기" 권한을 가진 사용자가 원격 코드 실행RCE을 달성하고, 배포 로그를 통해 민감한 환경 변수예: 데이터베이스 자격 증명, API 키를 탈취 할 수 있습니다. 빌드 환경이 Docker 소켓을 격리하더라도 가능합니다. 취약점 유형:...
CVE-2021-46422
CVE-2021-46422 SDT-CW3B1 1.1.0 - Внедрение команд ОС Exploit Title: SDT-CW3B1 1.1.0 - OS Command Injection Vendor Homepage: http://telesquare.co.kr/ CVE : CVE-2021-46422 CVE Description: Telesquare SDT-CW3B1 1.1.0 is affected by an OS command injection vulnerability that allows a remote attacker ...
CVE-2012-2982
CVE-2012-2982 Этот скрипт на Python написан для уязвимости в Webmin 1.580, CVE-2012-2982. Уязвимость существует в компоненте /file/show.cgi и позволяет аутентифицированному пользователю, имеющему доступ к модулю File Manager, выполнять произвольные команды с привилегиями root. Установка...
GPON
RCE на домашних роутерах GPON CVE-2018-10561 Уязвимость Многие роутеры сегодня используют GPON-интернет, и способ обойти всю аутентификацию на устройствах CVE-2018-10561 был найден VPNMentor. С помощью этого обхода аутентификации также можно выявить другую уязвимость внедрения команд CVE-2018-105...
-CVE-2014-6271-Shellshock-Remote-Command-Injection-
CVE-2014-6271 Shellshock-Remote-Command-Injection CVE-2014-6271 Инструмент Apache Shellshock Remote Command Injection для быстрого получения обратной оболочки и просмотра файлов Shellshock Apache remote exploit Usage: ./Shellshock.py payload=reverse rhost=1.2.3.4 page=3 lhost=5.6.7.8 lport=1234...
CVE-2024-55187
요약 민감한 관리 매개변수가 충분히 정화되지 않아, 공격자가 시스템 바이너리 경로를 오염시킬 수 있습니다. 그러면 공격자는 위험한 CSV 파일을 업로드할 수 있으며, 이 파일은 PHP의 exec 호출에 의해 평가될 셸 메타문자를 포함한 PHAR 아카이브로 취급되어 원격 코드 실행RCE을 초래할 수 있습니다. 영향 서버 장악 서비스 거부 데이터 손실 CVSS 점수 심각 - 9.1 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H 세부 사항 파일...
CVE-2025-60787
CVE-2025-60787 - MotionEye RCE MotionEye v0.43.1b4 Внедрение команд ОС Эксплойт для Proof-of-Concept, демонстрирующий внедрение команд ОС в уязвимости motionEye, веб-интерфейса для демона motion. Уязвимость использует параметр конфигурации imagefilename, который передаётся напрямую в оболочку без...
vulnerabilities found in the SonicWall SMA1000 appliance
SonicWall has identified several vulnerabilities in the SonicWall SMA1000 appliance. These vulnerabilities include a pre-authentication Server-Side Request Forgery SSRF vulnerability, which allows unauthorized attackers to execute unauthorized internal requests. Additionally, there is a...
