412 matches found
snoyberg Keter 跨站脚本漏洞
snoyberg Keter is Michael Snoyman's personal developer's deployment system for web applications, originally used to host Yesod applications. A cross-site scripting vulnerability exists in snoyberg Keter version 1.8.1 and prior versions, which stems from cross-site scripting due to incorrect...
CVE-2022-3189
Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where a specially crafted PHP script could use parameters from a HTTP request to create a URL capable of changing the host parameter. The changed host parameter in the HTTP could point to another host that will send a...
Design/Logic Flaw
Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where a specially crafted PHP script could use parameters from a HTTP request to create a URL capable of changing the host parameter. The changed host parameter in the HTTP could point to another host that will send a...
CVE-2022-3189
Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where a specially crafted PHP script could use parameters from a HTTP request to create a URL capable of changing the host parameter. The changed host parameter in the HTTP could point to another host that will send a...
CVE-2022-3189: Server-Side Request Forgery (SSRF)
Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where a specially crafted PHP script could use parameters from a HTTP request to create a URL capable of changing the host parameter. The changed host parameter in the HTTP could point to another host that will send a...
Command Injection
github.com/sourcegraph/sourcegraph is vulnerable to Command Injection. The vulnerability exist in the listRepos function in listgitolite.go due to lack of input validation on the host parameter where the attacker uses a crafted request to execute commands inside the container...
Arbitrary Command Injection
Overview Affected versions of this package are vulnerable to Arbitrary Command Injection via the host parameter on the /list-gitolite endpoint. An attacker can inject commands by sending local requests to the vulnerable endpoint. Remediation Upgrade...
PT-2022-26172 · Sourcegraph · Sourcegraph
Name of the Vulnerable Software and Affected Versions: Sourcegraph versions prior to 4.1.0 Description: The issue is a command injection vulnerability in the gitserver service, present in all Sourcegraph deployments. This vulnerability was caused by a lack of input validation on the host paramete...
Sourcegraph 操作系统命令注入漏洞
Sourcegraph is an open source code search and navigation tool from US-based Sourcegraph. An operating system command injection vulnerability exists in Sourcegraph versions prior to 4.1.0, which stems from a command injection vulnerability due to a lack of input validation of the /list-gitolite...
CVE-2022-41942: Improper Input Validation
Sourcegraph is a code intelligence platform. In versions prior to 4.1.0 a command Injection vulnerability existed in the gitserver service, present in all Sourcegraph deployments. This vulnerability was caused by a lack of input validation on the host parameter of the /list-gitolite endpoint. It...
CVE-2022-41942
Sourcegraph is a code intelligence platform. In versions prior to 4.1.0 a command Injection vulnerability existed in the gitserver service, present in all Sourcegraph deployments. This vulnerability was caused by a lack of input validation on the host parameter of the "/list-gitolite" endpoint. I...
CVE-2022-41395
Tenda AC1200 Router Model W15Ev2 V15.11.0.101576 was discovered to contain a command injection vulnerability via the dmzHost parameter in the setDMZ function...
CVE-2022-44019
In Total.js 4 before 0e5ace7, /api/common/ping can achieve remote command execution via shell metacharacters in the host parameter...
Command injection
In Total.js 4 before 0e5ace7, /api/common/ping can achieve remote command execution via shell metacharacters in the host parameter...
total.js 操作系统命令注入漏洞
total.js is open source a framework developed using JavaScript for the Node.js platform. It can be used to develop web, desktop, service and IoT platforms. An operating system command injection vulnerability exists in versions of total.js prior to 0e5ace7, which stems from /api/common/ping can be...
CVE-2022-44019: Improper Neutralization of Special Elements used in an OS Command
In Total.js 4 before 0e5ace7, /api/common/ping can achieve remote command execution via shell metacharacters in the host parameter...
PT-2022-27081 · Total.Js · Total.Js
Name of the Vulnerable Software and Affected Versions: Total.js versions prior to 0e5ace7 Description: The issue allows remote command execution via shell metacharacters in the host parameter of the "/api/common/ping" API endpoint. Recommendations: For versions prior to 0e5ace7, update to a versi...
CVE-2022-44019
In Total.js 4 before 0e5ace7, /api/common/ping can achieve remote command execution via shell metacharacters in the host parameter...
