CVE-2022-34374

CVE-2022-34374 affects Dell Container Storage Modules (version 1.2). The vulnerability is an OS command injection in the goiscsi and gobrick libraries, caused by improper handling/validation of constructed commands. A remote authenticated attacker with low privileges could exploit this to execute...

PT-2022-22151 · Dell · Dell Container Storage Modules

Name of the Vulnerable Software and Affected Versions: Dell Container Storage Modules version 1.2 Description: The issue is related to an OS command injection in the goiscsi and gobrick libraries. A remote authenticated malicious user with low privileges could exploit this, leading to the executi...

Mitsubishi Electric Multiple Factory Automation Products (Update B)

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Mitsubishi Electric Equipment: GOT2000 compatible HMI software, CC-Link IE TSN Industrial Managed Switch, MELSEC iQ-R Series OPC UA Server Module Vulnerabilities: Infinite Loop, OS Command Injection 2...

Exploit for OS Command Injection in Hikvision Ds-2Cd2026G2-Iu\/Sl_Firmware

CVE-2021-36260 Check whether the Sleep command is e...

JVN#45473612: Multiple vulnerabilities in CentreCOM AR260S V2

CentreCOM AR260S V2 provided by Allied Telesis K.K. contains multiple vulnerabilities listed below. OS command injection vulnerability in GUI setting page CWE-78 - CVE-2022-35273 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H| Base Score: 8.8 CVSS v2|...

PT-2022-4625 · Centrecom · Centrecom Ar260S V2

Name of the Vulnerable Software and Affected Versions: CentreCOM AR260S V2 firmware versions prior to Ver.3.3.7 Description: The issue is related to an OS command injection vulnerability in the GUI setting page, allowing a remote authenticated attacker to execute an arbitrary OS command. This...

CVE-2022-31499

Nortek Linear eMerge E3-Series devices before 0.32-08f allow an unauthenticated attacker to inject OS commands via ReaderNo. NOTE: this issue exists because of an incomplete fix for CVE-2019-7256...

CVE-2022-31499

Nortek Linear eMerge E3-Series devices before 0.32-08f allow an unauthenticated attacker to inject OS commands via ReaderNo. NOTE: this issue exists because of an incomplete fix for CVE-2019-7256...

Design/Logic Flaw

Nortek Linear eMerge E3-Series devices before 0.32-08f allow an unauthenticated attacker to inject OS commands via ReaderNo. NOTE: this issue exists because of an incomplete fix for CVE-2019-7256...

CVE-2022-31499

CVE-2022-31499 affects Nortek Linear eMerge E3-Series devices prior to version 0.32-08f, where an unauthenticated attacker can inject OS commands via ReaderNo. This extends an earlier issue from CVE-2019-7256 (incomplete fix leading to OS command injection). Public materials from Exploit-DB and C...

CVE-2022-31499

Nortek Linear eMerge E3-Series devices before 0.32-08f allow an unauthenticated attacker to inject OS commands via ReaderNo. NOTE: this issue exists because of an incomplete fix for CVE-2019-7256...

CVE-2022-2234

CVE-2022-2234 affects mySCADA myPRO HMI/SCADA (versions prior to 8.26.0; 8.26.0 and earlier). It stems from improper neutralization of special elements in commands, enabling an authenticated user to modify parameters to execute OS commands (command injection). Impact described as high across conf...

CVE-2022-34383

Dell Edge Gateway 5200 EGW versions before 1.03.10 contain an operating system command injection vulnerability. A local malicious user may potentially exploit this vulnerability by using an SMI to bypass PMC mitigation and gain arbitrary code execution during SMM...

TP-LINK Archer A7 操作系统命令注入漏洞

TP-LINK Archer A7 is a wireless router from China P&L TP-LINK. A security vulnerability exists in the TP-LINK Archer A7USV5210519 version, which originates when the program uses a portion of a received packet as part of a command, and can be exploited by an attacker to execute arbitrary commands ...

CVE-2022-32572

CVE-2022-32572 affects WWBN AVideo 11.6 and dev master commit 3f7c0364, with an OS command injection in aVideoEncoder wget functionality. The root cause is unsanitized user-controlled downloadURL passed to wget, enabling arbitrary command execution when the URL is processed by the wget helper. TA...

CVE-2022-32572

An os command injection vulnerability exists in the aVideoEncoder wget functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can send an HTTP request to trigger this vulnerability...

CVE-2022-30534

An OS command injection vulnerability exists in the aVideoEncoder chunkfile functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can send an HTTP request to trigger this vulnerability...

CVE-2022-30534

CVE-2022-30534 affects WWBN AVideo 11.6 and dev master commit 3f7c0364. The OS command injection occurs in the aVideoEncoder chunkfile handling, where a specially crafted HTTP request leads to arbitrary command execution. Talos details show the vulnerability path via the aVideoEncoder.json.php fl...

PT-2022-20163 · Wwbn · Avideo

Name of the Vulnerable Software and Affected Versions: WWBN AVideo versions 11.6 Description: An OS command injection issue exists in the aVideoEncoder chunkfile functionality. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can send an HTTP request to trigge...

SUSE SLES15 / openSUSE 15 Security Update : nodejs10 (SUSE-SU-2022:2855-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2855-1 advisory. - CVE-2021-22930, CVE-2021-22940: Fixed two memory corruption issues during HTTP/2 stream cancellation bsc1188917,...