CVE-2023-37292

CVE-2023-37292 affects HGiga iSherlock software. The OS Command Injection vulnerability arises from improper neutralization of special elements in iSherlock-user modules. Affected versions are iSherlock 4.5 (before iSherlock-user-4.5-174) and iSherlock 5.5 (before iSherlock-user-5.5-174). Consequ...

PT-2023-25890 · Hgiga · Isherlock

Name of the Vulnerable Software and Affected Versions: HGiga iSherlock versions 4.5 before iSherlock-user-4.5-174 HGiga iSherlock versions 5.5 before iSherlock-user-5.5-174 Description: The issue is related to an Improper Neutralization of Special Elements used in an OS Command, also known as 'OS...

CVE-2023-3722

An OS command injection vulnerability was found in the Avaya Aura Device Services Web application which could allow remote code execution as the Web server user via a malicious uploaded file. This issue affects Avaya Aura Device Services version 8.1.4.0 and earlier...

Command injection

An OS command injection vulnerability was found in the Avaya Aura Device Services Web application which could allow remote code execution as the Web server user via a malicious uploaded file. This issue affects Avaya Aura Device Services version 8.1.4.0 and earlier...

CVE-2023-3722 Avaya Aura Device Services Remote Code Execution

An OS command injection vulnerability was found in the Avaya Aura Device Services Web application which could allow remote code execution as the Web server user via a malicious uploaded file. This issue affects Avaya Aura Device Services version 8.1.4.0 and earlier...

CVE-2023-3722 Avaya Aura Device Services Remote Code Execution

An OS command injection vulnerability was found in the Avaya Aura Device Services Web application which could allow remote code execution as the Web server user via a malicious uploaded file. This issue affects Avaya Aura Device Services version 8.1.4.0 and earlier...

CVE-2023-3722

Vulnerability summary (CVE-2023-3722) Avaya Aura Device Services Web, versions 8.1.4.0 and earlier, suffers an OS command injection via a malicious uploaded file, allowing remote code execution with the web server’s privileges. The issue affects the web interface and is documented as unauthentica...

CVE-2023-37477

1Panel exposes an OS command injection in its firewall IP endpoint (/hosts/firewall/ip). The vulnerability allows an authenticated attacker to craft input that leads to arbitrary command execution, potentially full system compromise. The issue stems from lack of input validation in the firewall f...

CVE-2023-37477 Command injection in firewall ip functionality in 1Panel

1Panel is an open source Linux server operation and maintenance management panel. An OS command injection vulnerability exists in 1Panel firewall functionality. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger...

CVE-2020-36762

A vulnerability was found in ONS Digital RAS Collection Instrument up to 2.0.27 and classified as critical. Affected by this issue is the function jobs of the file .github/workflows/comment.yml. The manipulation of the argument $COMMENTBODY leads to os command injection. Upgrading to version 2.0....

CVE-2020-36762 ONS Digital RAS Collection Instrument comment.yml jobs os command injection

A vulnerability was found in ONS Digital RAS Collection Instrument up to 2.0.27 and classified as critical. Affected by this issue is the function jobs of the file .github/workflows/comment.yml. The manipulation of the argument $COMMENTBODY leads to os command injection. Upgrading to version 2.0....

CVE-2020-36762

CVE-2020-36762 affects the ONS Digital RAS Collection Instrument up to version 2.0.27. The root cause is a command-injection vulnerability in the function jobs of the file .github/workflows/comment.yml , caused by manipulation of the argument $COMMENT_BODY . This leads to OS command execution. Th...

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

1Panel is an open source Linux server operation and maintenance management panel. An OS command injection vulnerability exists in 1Panel firewall functionality. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger...

CVE-2023-33011

A format string vulnerability in the Zyxel ATP series firmware versions 5.10 through 5.36 Patch 2, USG FLEX series firmware versions 5.00 through 5.36 Patch 2, USG FLEX 50W series firmware versions 5.10 through 5.36 Patch 2, USG20W-VPN series firmware versions 5.10 through 5.36 Patch 2, and VPN...

CVE-2023-33011

A format string vulnerability in the Zyxel ATP series firmware versions 5.10 through 5.36 Patch 2, USG FLEX series firmware versions 5.00 through 5.36 Patch 2, USG FLEX 50W series firmware versions 5.10 through 5.36 Patch 2, USG20W-VPN series firmware versions 5.10 through 5.36 Patch 2, and VPN...

CVE-2023-28767

The configuration parser fails to sanitize user-controlled input in the Zyxel ATP series firmware versions 5.10 through 5.36, USG FLEX series firmware versions 5.00 through 5.36, USG FLEX 50W series firmware versions 5.10 through 5.36, USG20W-VPN series firmware versions 5.10 through 5.36, and VP...

CVE-2023-28767

Concrete details exist: CVE-2023-28767 affects Zyxel devices (ATP series 5.10–5.36; USG FLEX 5.00–5.36 and 50(W) 5.10–5.36; USG20(W)-VPN 5.10–5.36; VPN series 5.00–5.36). The issue is in the configuration parser’s failure to sanitize user-supplied input, enabling an unauthenticated LAN attacker t...

U.S. Dept Of Defense: Blind Sql Injection in https://████████/

A blind SQL injection vulnerability was discovered in the █████████ website. This vulnerability allowed an attacker to bypass authentication and retrieve sensitive information from the database. The vulnerability was successfully exploited using SQLmap, a popular SQL injection tool...

CVE-2023-37564

OS command injection vulnerability in ELECOM wireless LAN routers allows a network-adjacent authenticated attacker to execute an arbitrary OS command with a root privilege by sending a specially crafted request. Affected products and versions are as follows: WRC-1167GHBK-S v1.03 and earlier,...

CVE-2023-37564

OS command injection vulnerability in ELECOM wireless LAN routers allows a network-adjacent authenticated attacker to execute an arbitrary OS command with a root privilege by sending a specially crafted request. Affected products and versions are as follows: WRC-1167GHBK-S v1.03 and earlier,...