10137 matches found
CVE-2022-20617
CVE-2022-20617 affects the Jenkins Docker Commons Plugin (1.17 and earlier); OS command execution arises from unsanitized image/tag names. Exploitation requires Item/Configure permission or control over a job’s SCM content. The provided documents indicate this vulnerability is addressed in relate...
CVE-2021-42561
CVE-2021-42561 affects CALDERA 2.8.1 where the Human plugin passes an unsanitized name parameter to Python os.system, enabling shell metacharacters to escape commands and execute arbitrary code. Multiple vendors and advisories (Red Hat, CNVD, OSV, CVE lists) corroborate a command-injection vulner...
CVE-2021-20038..42: SonicWall SMA 100 Multiple Vulnerabilities (FIXED)
Over the course of routine security research, Rapid7 researcher Jake Baines discovered and reported five vulnerabilities involving the SonicWall Secure Mobile Access SMA 100 series of devices, which includes SMA 200, 210, 400, 410, and 500v. The most serious of these issues can lead to...
GHSA-W2PM-R78H-4M7V OS Command Injection in Laravel Framework
OS Command injection vulnerability in function link in Filesystem.php in Laravel Framework before 5.8.17...
CVE-2021-45912
An unauthenticated Named Pipe channel in Controlup Real-Time Agent cuAgent.exe before 8.5 potentially allows an attacker to run OS commands via the ProcessActionRequest WCF method...
Command injection
An unauthenticated Named Pipe channel in Controlup Real-Time Agent cuAgent.exe before 8.5 potentially allows an attacker to run OS commands via the ProcessActionRequest WCF method...
CVE-2021-45913
A hardcoded key in ControlUp Real-Time Agent cuAgent.exe before 8.2.5 may allow a potential attacker to run OS commands via a WCF channel...
CVE-2021-45913
A hardcoded key in ControlUp Real-Time Agent cuAgent.exe before 8.2.5 may allow a potential attacker to run OS commands via a WCF channel...
Hardcoded credentials
A hardcoded key in ControlUp Real-Time Agent cuAgent.exe before 8.2.5 may allow a potential attacker to run OS commands via a WCF channel...
CVE-2021-45912
Controlup Real-Time Agent (cuAgent.exe) exposes an unauthenticated Named Pipe channel that, before version 8.5, allows an attacker to execute OS commands via the ProcessActionRequest WCF method. Impact is local and could enable command execution with the attacker’s privileges. Remediation per sou...
The software of SIEM EventLog Analyzer is vulnerable because measures are not taken to neutralize special elements used in the operating system command. This vulnerability allows a perpetrator to execute arbitrary commands on the target system.
The vulnerability of the SIEM EventLog Analyzer software exists due to the lack of measures taken to neutralize special elements used in the operating system command. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands on the target system remotely...
CVE-2021-35032
The CVE-2021-35032 issue affects Zyxel GS1900 series switches running firmware 2.60, due to a flaw in the libsal.so component that allows an authenticated local user to execute arbitrary OS commands via a crafted function call. Affected product: Zyxel GS1900 switches; vulnerable surface: libsal.s...
Lantronix PremierWave 2050 OS Command Injection Vulnerability (CNVD-2022-04974)
The Lantronix PremierWave 2050 is an embedded Wi-Fi module manufactured by Lantronix.The Web Manager FsTFtp feature of the Lantronix PremierWave 2050 8.9.0.0R4 is vulnerable to an operating system command injection vulnerability that could be exploited by an attacker with a specially crafted HTTP...
Lantronix PremierWave 2050 OS Command Injection Vulnerability (CNVD-2022-04973)
The PremierWave 2050 is an embedded Wi-Fi module manufactured by Lantronix.The Web Manager SslGenerateCSR feature of the Lantronix PremierWave 2050 8.9.0.0R4 is vulnerable to OS command injection, which can be exploited by attackers to cause arbitrary command execution with the help of specially...
Acronis: SQL injection in https://demor.adr.acronis.com/ via the username parameter
Vulnerability description not provided...
CVE-2021-43981
The CVE-2021-43981 entry concerns mySCADA myPRO, affected up to version 8.20.0. The vulnerability is an OS command injection flaw introduced by a feature that sends emails, where a specific parameter can be exploited to inject arbitrary OS commands. Multiple connected sources (NVD entry, ICS advi...
CVE-2021-44453 mySCADA myPRO
mySCADA myPRO: Versions 8.20.0 and prior has a vulnerable debug interface which includes a ping utility, which may allow an attacker to inject arbitrary operating system commands...
CVE-2021-23198 mySCADA myPRO
mySCADA myPRO: Versions 8.20.0 and prior has a feature where the password can be specified, which may allow an attacker to inject arbitrary operating system commands through a specific parameter...
CVE-2021-23198
CVE-2021-23198 affects mySCADA myPRO before version 8.22.0. The vulnerability is an OS command injection stemming from a feature where a password/parameter can be specified, enabling an attacker to inject arbitrary operating system commands. Various connected sources (NVD/NVD-derived CVSS metrics...
