elecom lan 操作系统命令注入漏洞

elecom lan is a router from Elecom Japan. Elecom lan suffers from an OS command injection vulnerability that stems from improper input validation. An attacker can exploit the vulnerability to pass carefully constructed data to an application and execute arbitrary OS commands on the target system...

Docker code injection vulnerability

Docker is an open source application container engine from the U.S. company Docker. The product supports creating a container lightweight virtual machine and deploying and running applications on Linux systems, as well as automating the installation, deployment, and upgrade of applications throug...

Command injection

A command injection vulnerability was reported in the Integrated Management Module IMM of legacy IBM System x 3550 M3 and IBM System x 3650 M3 servers that could allow the execution of operating system commands over an authenticated SSH or Telnet session...

CVE-2021-3934

ohmyzsh is vulnerable to Improper Neutralization of Special Elements used in an OS Command...

The vulnerability of the SCADA system “KRUG-2000” software lies in its failure to take measures to neutralize special elements used in the operating system’s commands. This allows a intruder to trigger a service failure or execute arbitrary code.

The vulnerability of the SCADA system “KRUG-2000” lies in the lack of measures taken to neutralize special elements used in the operating system commands. Exploiting this vulnerability can allow an intruder to cause a service failure or execute arbitrary code by introducing arbitrary code into th...

Six Apart Movable Type Command Injection Vulnerability

Six Apart Movable Type is an application from Six Apart, Inc. A command injection vulnerability exists in Six Apart Movable Type due to incorrect input validation in the Movable Type XMLRPC API, which can be exploited by an unauthenticated remote attacker to execute arbitrary operating system...

The vulnerability of the POST request processing mechanism of the enhanced qualified electronic signature service for operating systems “EMIAS” allows a perpetrator to execute arbitrary code.

The vulnerability of the POST request processing mechanism of the enhanced qualified electronic signature service for operating systems “EMIAS” exists due to the failure to take measures to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a...

The vulnerability of the microprogrammed software in Emerson WirelessHART Gateways of the 1420, 1410D, and 1410 series wireless hardware routers lies in the lack of measures to neutralize special elements used in the operating system’s command set. This allows a hacker to execute arbitrary commands.

The vulnerability of the microprogrammed software in Emerson WirelessHART Gateways of the 1420, 1410D, and 1410 series wireless hardware routers stems from the lack of measures taken to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a remot...

Mail.ru: OS command injection on seedr.ru

site: https://seedr.ru The seedid parameter be vulnerable to OS command injection attacks. It is possible to use various shell metacharacters to inject arbitrary OS commands. The command output does not appear to be returned in the application's responses, however it is possible to inject time...

CVE-2021-33693

SAP Cloud Connector, version - 2.0, allows an authenticated administrator to modify a configuration file to inject malicious codes that could potentially lead to OS command execution...

CVE-2021-33693

SAP Cloud Connector, version - 2.0, allows an authenticated administrator to modify a configuration file to inject malicious codes that could potentially lead to OS command execution...

CVE-2021-38648

Open Management Infrastructure Elevation of Privilege Vulnerability Recent assessments: zeroSteiner at October 27, 2021 5:59pm UTC reported: A locally exploitable vulnerability exists within Microsoft’s OMI management server in versions prior to 1.6.8-1 that can allow a local attacker to execute...

The vulnerability of the CLI command-line interface of the Fortinet FortiManager device management software and the Fortinet FortiAnalyzer security event monitoring and analysis tool allows a malicious actor to execute arbitrary commands.

The vulnerability of the CLI command-line interface of the Fortinet FortiManager device management system and the Fortinet FortiAnalyzer security event monitoring and analysis tool is related to the lack of measures taken to neutralize special elements used in the operating system commands...

The vulnerabilities of PDF viewing and editing programs such as Adobe Acrobat Document Cloud, Adobe Acrobat Reader Document Cloud, Adobe Acrobat 2017, Adobe Acrobat Reader 2017, and Adobe Acrobat 2020 are due to the lack of measures taken to neutralize special elements used in the operating system’s command structure. This vulnerability allows attackers to increase their privileges.

The vulnerability of PDF viewing and editing programs such as Adobe Acrobat Document Cloud, Adobe Acrobat Reader Document Cloud, Adobe Acrobat 2017, Adobe Acrobat Reader 2017, and Adobe Acrobat 2020 exists due to the failure to take measures to neutralize special elements used in the operating...

CVE-2021-38163

SAP NetWeaver Visual Composer 7.0 RT versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticated as a non-administrative user can upload a malicious file over a network and trigger its processing, which is capable of running operating system commands with the privilege of th...

CVE-2021-38163

SAP NetWeaver Visual Composer 7.0 RT versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticated as a non-administrative user can upload a malicious file over a network and trigger its processing, which is capable of running operating system commands with the privilege of th...

CVE-2021-33673

Under certain conditions, SAP Contact Center - version 700,does not sufficiently encode user-controlled inputs and persists in them. This allows an attacker to exploit a Stored Cross-Site Scripting XSS vulnerability when a user browses through the employee directory and to execute arbitrary code ...

CVE-2021-33672

Due to missing encoding in SAP Contact Center's Communication Desktop component- version 700, an attacker could send malicious script in chat message. When the message is accepted by the chat recipient, the script gets executed in their scope. Due to the usage of ActiveX in the application, the...

Design/Logic Flaw

SAP NetWeaver Visual Composer 7.0 RT versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticated as a non-administrative user can upload a malicious file over a network and trigger its processing, which is capable of running operating system commands with the privilege of th...

CVE-2021-38163

SAP NetWeaver Visual Composer 7.0 RT versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticated as a non-administrative user can upload a malicious file over a network and trigger its processing, which is capable of running operating system commands with the privilege of th...