94875 matches found
EUVD-2020-31281
office-converter through 1.0.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying a crafted fileName to generatePdf or generateHtml. Attackers can embed $..., backticks, or a closing quote with shell metacharacters in the file name, which is...
CVE-2020-37282 office-converter through 1.0.2 OS Command Injection via fileName in generatePdf
office-converter through 1.0.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying a crafted fileName to generatePdf or generateHtml. Attackers can embed $..., backticks, or a closing quote with shell metacharacters in the file name, which is...
CVE-2020-37282
The office-converter package (versions through 1.0.2 ) is vulnerable to an OS command injection flaw. The root cause is the improper handling of the fileName parameter within the generatePdf() and generateHtml() functions. Attackers can supply a crafted filename containing shell metacharacters, s...
EUVD-2026-101029
Dell Unisphere for PowerMax vApp, versions 9.2.4.x, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote execution...
CVE-2026-101215
Dell Unisphere for PowerMax vApp versions 9.2.4.x are affected by an OS Command Injection vulnerability (CWE-78). This flaw stems from the Improper Neutralization of Special Elements used in an OS Command. A high privileged attacker with remote access could potentially exploit this vulnerability ...
CVE-2026-101215
Dell Unisphere for PowerMax vApp, versions 9.2.4.x, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote execution...
CVE-2026-101216
The Dell Unisphere for PowerMax vApp versions 9.2.4.x are susceptible to a Command Injection vulnerability (CWE-77) caused by the improper neutralization of special elements in a command. A high-privileged attacker with remote access could exploit this flaw to achieve remote execution . Remediati...
EUVD-2026-101026
Dell Unisphere for PowerMax vApp, versions 9.2.4.x, contains an Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote execution...
CVE-2026-101216
Dell Unisphere for PowerMax vApp, versions 9.2.4.x, contains an Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote execution...
Vulnerabilities hidden in Ahsay AhsayCBS
Ahsay has fixed vulnerabilities in AhsayCBS up to version 10.3.2. The vulnerability with identifier CVE-2026-105133 has a CVSS score of 7.3 and involves insufficient authentication in the checkSysPwd function of the AhsayCBS API. An unauthorized malicious actor could exploit this vulnerability to...
CVE-2026-16741
Improper neutralization of special elements used in an OS command 'OS command injection' vulnerability in TR7 Cyber Defense Inc. TR7 ASP on virtual appliance and TR7 Cyber Defense Inc. TR7 ASP on physical appliance allows OS Command Injection. This issue affects TR7 ASP: from 1.0.40.236 befor...
CVE-2026-16740
Missing authentication for critical function vulnerability in TR7 Cyber Defense Inc. TR7 ASP on virtual appliance and TR7 Cyber Defense Inc. TR7 ASP on physical appliance allows OS Command Injection. This issue affects TR7 ASP: from 1.0.40.236 before 1.0.1554.2331; TR7 ASP: from 1.6.42.239...
CVE-2026-16740
TR7 Cyber Defense Inc. TR7 ASP is vulnerable to OS Command Injection due to a Missing Authentication for Critical Function vulnerability (CWE-306). This issue affects TR7 ASP on both virtual and physical appliances. Specifically, it impacts versions 1.0.40.236 before 1.0.1554.2331 and versions 1....
CVE-2026-16740 Missing Authentication for Critical Function in TR7 Cyber Defense's TR7 ASP
Missing authentication for critical function vulnerability in TR7 Cyber Defense Inc. TR7 ASP on virtual appliance and TR7 Cyber Defense Inc. TR7 ASP on physical appliance allows OS Command Injection. This issue affects TR7 ASP: from 1.0.40.236 before 1.0.1554.2331; TR7 ASP: from 1.6.42.239...
EUVD-2026-101020
Missing authentication for critical function vulnerability in TR7 Cyber Defense Inc. TR7 ASP on virtual appliance and TR7 Cyber Defense Inc. TR7 ASP on physical appliance allows OS Command Injection. This issue affects TR7 ASP: from 1.0.40.236 before 1.0.1554.2331; TR7 ASP: from 1.6.42.239...
EUVD-2026-101019
Improper neutralization of special elements used in an OS command 'OS command injection' vulnerability in TR7 Cyber Defense Inc. TR7 ASP on virtual appliance and TR7 Cyber Defense Inc. TR7 ASP on physical appliance allows OS Command Injection. This issue affects TR7 ASP: from 1.0.40.236 befor...
CVE-2026-16741
The TR7 ASP software by TR7 Cyber Defense Inc. is vulnerable to an OS Command Injection flaw due to the improper neutralization of special elements used in an OS command. This vulnerability affects the virtual appliance and physical appliance versions. Specifically, the affected versions include ...
CVE-2026-16741 OS Command in TR7 Cyber Defense's TR7 ASP
Improper neutralization of special elements used in an OS command 'OS command injection' vulnerability in TR7 Cyber Defense Inc. TR7 ASP on virtual appliance and TR7 Cyber Defense Inc. TR7 ASP on physical appliance allows OS Command Injection. This issue affects TR7 ASP: from 1.0.40.236 befor...
curl: IMAP APPEND plus CRLF conversion command injection
A flaw was found in curl. When curl is configured to perform carriage return and line feed CRLF conversion during an Internet Message Access Protocol IMAP append operation, it incorrectly reports the raw input size rather than the expanded byte count. Because the receiving server only reads the...