Command injection

An improper neutralization of special elements used in an OS command vulnerability CWE-78 in the management interface of FortiADC 7.1.0 through 7.1.1, 7.0.0 through 7.0.3, 6.2.0 through 6.2.5 and 6.1.0 all versions may allow an authenticated attacker to execute unauthorized commands via...

CVE-2023-36642

An improper neutralization of special elements used in an OS command vulnerability CWE-78 in the management interface of FortiTester 3.0.0 through 7.2.3 may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments to existing commands...

PT-2023-13449

Name of the Vulnerable Software and Affected Versions FortiADC versions 6.1.0 through 7.1.1 Description An improper neutralization of special elements used in an OS command vulnerability in the management interface of FortiADC may allow an authenticated attacker to execute unauthorized commands v...

Fortinet FortiADC Operating System Command Injection Vulnerability

Fortinet FortiADC is an application delivery controller from Fortinet. A security vulnerability exists in Fortinet FortiADC that originates from an operating system command injection vulnerability in the management interface. Affected products and versions: FortiADC versions 7.1.0 through 7.1.1,...

FortiTester Operating System Command Injection Vulnerability

FortiTester is a Fortinet Professional-based network traffic testing tool from FortiTester, Inc. A security vulnerability exists in FortiTester versions 3.0.0 through 7.2.3 that stems from an operating system command injection vulnerability in the management interface. An attacker could use this...

PT-2023-25648 · Fortinet · Fortitester

Name of the Vulnerable Software and Affected Versions: FortiTester versions 3.0.0 through 7.2.3 Description: An improper neutralization of special elements used in an OS command vulnerability in the management interface may allow an authenticated attacker to execute unauthorized commands via...

CVE-2023-38829

An issue in NETIS SYSTEMS WF2409E v.3.6.42541 allows a remote attacker to execute arbitrary code via the ping and traceroute functions of the diagnostic tools component in the admin management interface...

Design/Logic Flaw

An issue in NETIS SYSTEMS WF2409E v.3.6.42541 allows a remote attacker to execute arbitrary code via the ping and traceroute functions of the diagnostic tools component in the admin management interface...

NETIS SYSTEMS WF2409E Command Injection Vulnerability

NETIS SYSTEMS WF2409E is a wireless router from NETIS SYSTEMS. A security vulnerability exists in the NETIS SYSTEMS WF2409E version v.3.6.42541 that originates from a vulnerability that allows an attacker to execute arbitrary code via the ping and traceroute functions in the management interface...

CVE-2023-38829

An issue in NETIS SYSTEMS WF2409E v.3.6.42541 allows a remote attacker to execute arbitrary code via the ping and traceroute functions of the diagnostic tools component in the admin management interface...

CVE-2023-4528

Unsafe deserialization in JSCAPE MFT Server versions prior to 2023.1.9 Windows, Linux, and MacOS permits an attacker to run arbitrary Java code including OS commands via its management interface...

Deserialization of untrusted data

Unsafe deserialization in JSCAPE MFT Server versions prior to 2023.1.9 Windows, Linux, and MacOS permits an attacker to run arbitrary Java code including OS commands via its management interface...

CVE-2023-4528 JSCAPE MFT Server Unsafe Deserialization on Management Port

Unsafe deserialization in JSCAPE MFT Server versions prior to 2023.1.9 Windows, Linux, and MacOS permits an attacker to run arbitrary Java code including OS commands via its management interface...

JSCAPE MFT Server Code Issue Vulnerability

JSCAPE MFT Server is a flexible and scalable hosted file transfer solution from JSCAPE USA. A security vulnerability exists in JSCAPE MFT Server versions prior to 2023.1.9 that stems from the presence of insecure deserialization, which allows an attacker to run arbitrary Java code through its...

PT-2023-4877 · Jscape · Jscape Mft Server

Name of the Vulnerable Software and Affected Versions: JSCAPE MFT Server versions prior to 2023.1.9 Description: The issue is related to unsafe deserialization in the JSCAPE MFT Server, which allows an attacker to execute arbitrary Java code, including OS commands, via its management interface...

CVE-2023-20263

CVE-2023-20263 affects Cisco HyperFlex HX Data Platform, specifically the web-based management interface. The issue arises from improper input validation of HTTP request parameters, enabling an unauthenticated, remote attacker to persuade a user to click a crafted link and potentially redirect th...

Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers Stack Overflow Vulnerability

A vulnerability in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to improper validation of requests that are sent to the...

PT-2023-21822 · Qualcomm · Qualcomm Snapdragon

Name of the Vulnerable Software and Affected Versions: Qualcomm Snapdragon chipsets affected versions not specified Description: The issue is related to memory corruption in the WLAN HAL while parsing WMI command parameters. This can potentially lead to security risks, but specific details about...

Vulnerabilities fixed in VMware Aria Operations Networks

VMWare has fixed vulnerabilities in Aria Operations Networks, formerly known as vRealize Network Insight. A malicious party could exploit the vulnerabilities to bypass authentication, or to execute arbitrary code on the underlying system. The most serious vulnerability has been given attribute...

CVE-2023-39266

A vulnerability in the ArubaOS-Switch web management interface could allow an unauthenticated remote attacker to conduct a stored cross-site scripting XSS attack against a user of the interface provided certain configuration options are present. A successful exploit could allow an attacker to...