CVE-2022-30603

Vulnerability summary (CVE-2022-30603) : Abode Systems iota All-In-One Security Kit (versions 6.9X/6.9Z) exposes an OS command-injection in the web interface endpoint /action/iperf. The POST handler collects a user-supplied server_ip and unsafely interpolates it into a shell command, then execute...

CVE-2022-30603

An OS command injection vulnerability exists in the web interface /action/iperf functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger...

CVE-2022-30541

The CVE-2022-30541 issue affects Abode Systems iota All-In-One Security Kit 6.9X and 6.9Z. Talos confirms an OS command injection in the XCMD setUPnP handler, where an XMPP XML payload contains a webextport value that, if crafted, can bypass normal checks and lead to OS command execution. The pay...

CVE-2022-29520

CVE-2022-29520 affects Abode Systems iota All-In-One Security Kit (firmware 6.9Z). A crafted XCMD via setUPnP webextport can feed data into /var/in, which console_main_loop then parses as commands and executes through popen, enabling arbitrary command execution as root. TALOS details describe 6.9...

CVE-2022-29472

Summary (CVE-2022-29472): Abode Systems iota All-In-One Security Kit (versions 6.9X/6.9Z) suffers an OS command injection in the web interface’s util_set_serial_mac. A specially crafted HTTP POST to /action/factorySerialMacPost can cause arbitrary commands to run as root by manipulating the U-Boo...

CVE-2022-29472

An OS command injection vulnerability exists in the web interface utilsetserialmac functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can send an HTTP request to trigger this...

CVE-2022-29472

An OS command injection vulnerability exists in the web interface utilsetserialmac functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can send an HTTP request to trigger this...

CVE-2022-27804

An os command injection vulnerability exists in the web interface utilsetabodecode functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can send an HTTP request to trigger this...

CVE-2022-27804

An os command injection vulnerability exists in the web interface utilsetabodecode functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can send an HTTP request to trigger this...

PT-2022-20198 · Abode Systems · Iota All-In-One Security Kit

Name of the Vulnerable Software and Affected Versions: Abode Systems, Inc. iota All-In-One Security Kit versions 6.9X and 6.9Z Description: An OS command injection issue exists in the web interface /action/iperf functionality. A specially-crafted HTTP request can lead to arbitrary command...

PT-2022-21735 · Abode Systems · Iota All-In-One Security Kit

Name of the Vulnerable Software and Affected Versions: Abode Systems, Inc. iota All-In-One Security Kit versions 6.9X and 6.9Z Description: The issue is related to OS command injection vulnerabilities in the XCMD testWifiAP functionality. This can lead to arbitrary command execution, allowing an...

CVE-2022-35132

The CVE-2022-35132 vulnerability affects Webmin/Usermin (up to version 1.850). It allows a remote authenticated user to execute OS commands via command injection in a filename used by the GPG module. Root cause: improper handling of the GPG module filename enables command execution. Impact is hig...

PT-2022-19676 · Abode Systems · Iota All-In-One Security Kit

Name of the Vulnerable Software and Affected Versions: Abode Systems, Inc. iota All-In-One Security Kit version 6.9Z Description: An OS command injection issue exists in the console main loop :sys functionality. A specially-crafted XCMD can lead to arbitrary command execution. An attacker can sen...

Dell PowerScale OneFS OS Command Injection Vulnerability

Dell PowerScale OneFS is an operating system from Dell, Inc. Dell PowerScale OneFS is vulnerable to an operating system command injection vulnerability that could be exploited by a privileged local attacker to compromise the entire system...

PT-2022-21741 · Abode Systems · Iota All-In-One Security Kit

Name of the Vulnerable Software and Affected Versions: Abode Systems, Inc. iota All-In-One Security Kit versions 6.9X and 6.9Z Description: The issue is related to OS command injection vulnerabilities in the web interface /action/wirelessConnect functionality. A specially-crafted HTTP request can...

CVE-2022-29851

documentconverter in OX App Suite through 7.10.6, in a non-default configuration with ghostscript, allows OS Command Injection because file conversion may occur for an EPS document that is disguised as a PDF document...

CVE-2022-29851

documentconverter in OX App Suite through 7.10.6, in a non-default configuration with ghostscript, allows OS Command Injection because file conversion may occur for an EPS document that is disguised as a PDF document...

CVE-2022-29851

CVE-2022-29851 affects Open-Xchange OX App Suite up to v7.10.6. In a non-default configuration using ghostscript, documentconverter can perform OS command injection when converting an EPS file masquerading as a PDF. The vulnerability is tied to the EPS→PDF conversion path and non-default ghostscr...

CVE-2022-29851

documentconverter in OX App Suite through 7.10.6, in a non-default configuration with ghostscript, allows OS Command Injection because file conversion may occur for an EPS document that is disguised as a PDF document...

PT-2022-19878 · Open Xchange · Ox App Suite

Name of the Vulnerable Software and Affected Versions: OX App Suite versions through 7.10.6 Description: The issue allows OS Command Injection in a non-default configuration where ghostscript is used, because file conversion may occur for an EPS document disguised as a PDF document...