CVE-2025-9997

CWE-78: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability exists that could cause command injection in BLMon that is executed in the operating system console when in a SSH session...

CVE-2025-9997

CVE-2025-9997 relates to an OS command injection in BLMon Console (Schneider Electric) triggered during SSH sessions when running netstat. The root cause is improper neutralization of special elements in OS commands (CWE-78), potentially allowing execution of arbitrary shell commands on the affec...

CVE-2025-53796

Buffer over-read in Windows Routing and Remote Access Service RRAS allows an unauthorized attacker to disclose information over a network...

CVE-2025-42944

Due to a deserialization vulnerability in SAP NetWeaver, an unauthenticated attacker could exploit the system through the RMI-P4 module by submitting malicious payload to an open port. The deserialization of such untrusted Java objects could lead to arbitrary OS command execution, posing a high...

CVE-2025-42911

SAP NetWeaver Service Data Download allows an authenticated user to call a remote-enabled function module, which could grant access to information about the SAP system and operating system. This leads to a low impact on confidentiality, with no effect on the integrity and availability of the...

CVE-2025-42911

SAP NetWeaver Service Data Download allows an authenticated user to call a remote-enabled function module, which could grant access to information about the SAP system and operating system. This leads to a low impact on confidentiality, with no effect on the integrity and availability of the...

CVE-2025-42911 Missing Authorization check in SAP NetWeaver (Service Data Download)

SAP NetWeaver Service Data Download allows an authenticated user to call a remote-enabled function module, which could grant access to information about the SAP system and operating system. This leads to a low impact on confidentiality, with no effect on the integrity and availability of the...

CVE-2025-42911 Missing Authorization check in SAP NetWeaver (Service Data Download)

SAP NetWeaver Service Data Download allows an authenticated user to call a remote-enabled function module, which could grant access to information about the SAP system and operating system. This leads to a low impact on confidentiality, with no effect on the integrity and availability of the...

CVE-2025-42911

CVE-2025-42911 affects SAP NetWeaver (Service Data Download). An authenticated user can call a remote-enabled function module, potentially exposing information about the SAP system and operating system. The impact is described as low confidentiality impact, with no stated effects on integrity or ...

Schneider Electric Saitel DR RTU 操作系统命令注入漏洞

The Schneider Electric Saitel DR RTU is a remote terminal device from Schneider Electric France. The Schneider Electric Saitel DR RTU suffers from an operating system command injection vulnerability that stems from improper neutralization of operating system commands, which could lead to command...

Tautulli 操作系统命令注入漏洞

Tautulli is a Tautulli open source application for monitoring Plex Media Server Media Server. An operating system command injection vulnerability exists in Tautulli 2.15.3 and earlier versions, which stems from a command injection vulnerability that could lead to remote code execution...

PT-2025-36544

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver affected versions not specified Description: SAP NetWeaver Service Data Download allows an authenticated user to call a remote-enabled function module, potentially granting access to information about the SAP system and operatin...

NVIDIA NVDebug 操作系统命令注入漏洞

NVIDIA NVDebug is a debugging and diagnostic tool from NVIDIA. NVIDIA NVDebug suffers from an operating system command injection vulnerability that originates from the ability to potentially cause code to be run on the platform host as an unprivileged user, which could lead to code execution,...

Adobe Premiere Pro < 24.6.8 / 25.0 < 25.4 Arbitrary code execution (APSB25-87) (macOS)

The version of Adobe Premiere Pro installed on the remote macOS host is prior to 24.6.8, 25.4. It is, therefore, affected by a vulnerability as referenced in the APSB25-87 advisory. - Use After Free CWE-416 potentially leading to Arbitrary code execution CVE-2025-54242 Note that Nessus has not...

PT-2025-36979

Name of the Vulnerable Software and Affected Versions: BLMon affected versions not specified Description: An OS Command Injection issue exists in BLMon that could allow command injection when executed in the operating system console during an SSH session. The issue is related to the improper...

Microsoft Windows Local Security Authority Subsystem Service 安全漏洞

Microsoft Windows Local Security Authority Subsystem Service is an internal program of Microsoft Corporation USA that runs Windows system security policies. It verifies user identity, manages user password changes, and generates access characters when a user logs on to a computer standalone or...

CVE-2025-9997: Improper Neutralization of Special Elements used in an OS Command

CWE-78: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability exists that could cause command injection in BLMon that is executed in the operating system console when in a SSH session...

SAP NetWeaver 代码问题漏洞

SAP NetWeaver is the German SAP SAP company's set of service-oriented integrated application platform. The platform mainly for SAP applications to provide development and runtime environment. A deserialization vulnerability exists in SAP NetWeaver, which arises from unsafe deserialization of...

Rockwell Automation Stratix IOS 安全漏洞

Rockwell Automation Stratix IOS is an industrial operating system from Rockwell Automation USA. A security vulnerability exists in Rockwell Automation Stratix IOS that originates from an unverified upload of a malicious configuration that could lead to remote code execution...

Schneider Electric Saitel DR RTU 操作系统命令注入漏洞

The Schneider Electric Saitel DR RTU is a remote terminal device from Schneider Electric France. The Schneider Electric Saitel DR RTU suffers from an operating system command injection vulnerability that stems from improper neutralization of special elements, which could lead to the execution of...