Command injection

The jokob-sk/Pi.Alert fork before 22.12.20 of Pi.Alert allows Remote Code Execution via nmapscan.php scan parameter OS Command Injection...

PT-2023-15649 · Jokob Sk · Pi.Alert

Name of the Vulnerable Software and Affected Versions: jokob-sk/Pi.Alert versions prior to 22.12.20 Description: The issue allows Remote Code Execution via nmap scan.php scan parameter OS Command Injection. Recommendations: For versions prior to 22.12.20, consider disabling access to the nmap...

CVE-2022-48252

The jokob-sk/Pi.Alert fork before 22.12.20 of Pi.Alert allows Remote Code Execution via nmapscan.php scan parameter OS Command Injection...

JVN#99957889: Multiple vulnerabilities in MAHO-PBX NetDevancer series

There are multiple vulnerabilities in the Management screen of MAHO-PBX NetDevancer series provided by Mahoroba Kobo, Inc. OS Command Injection CWE-78 - CVE-2023-22279 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H| Base Score: 9.8 CVSS v2|...

CVE-2022-48252

CVE-2022-48252 affects jokob-sk/Pi.Alert fork prior to 22.12.20. The vulnerability enables Remote Code Execution through nmap_scan.php (scan parameter), an OS command injection issue with network access (attack vector: NETWORK, no privileges required). Base CVSS 3.1: Critical (3.1/AV:N/AC:L/PR:N/...

AlmaLinux 8 : nodejs:14 (ALSA-2023:0050)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:0050 advisory. minimist: prototype pollution CVE-2021-44906 node-fetch: exposure of sensitive information to an unauthorized actor CVE-2022-0235 nodejs-minimatch: ReDoS...

Siemens SINEC INS

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories CERT Services | Services |...

Oracle Linux 8 : nodejs:14 (ELSA-2023-0050)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-0050 advisory. - Apply upstream fix for CVE-2022-24999 Resolves: CVE-2022-24999 - Record CVEs fixed by current or previous upstream releases Resolves: CVE-2021-44906...

RHEL 8 : nodejs:14 (RHSA-2023:0050)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:0050 advisory. Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. The...

CWP login.php Unauthenticated RCE

Control Web Panel versions use exploit/linux/http/control/webpanellogincmdexec msf undefinedwebpanellogincmdexec show actions ...actions... msf undefinedwebpanellogincmdexec set ACTION msf undefinedwebpanellogincmdexec show options ...show and set options... msf undefinedwebpanellogincmdexec run...

PT-2023-1560 · Suse · Libzypp-Plugin-Appdata +1

Name of the Vulnerable Software and Affected Versions: SUSE Linux Enterprise Server for SAP 15-SP3 libzypp-plugin-appdata versions prior to 1.0.1+git.20180426 openSUSE Leap 15.4 libzypp-plugin-appdata versions prior to 1.0.1+git.20180426 Description: The issue is related to an Improper...

CVE-2022-35845

Multiple improper neutralization of special elements used in an OS Command 'OS Command Injection' vulnerabilities CWE-78 in FortiTester 7.1.0, 7.0 all versions, 4.0.0 through 4.2.0, 2.3.0 through 3.9.1 may allow an authenticated attacker to execute arbitrary commands in the underlying shell...

CVE-2022-39947

A improper neutralization of special elements used in an os command 'os command injection' in Fortinet FortiADC version 7.0.0 through 7.0.2, FortiADC version 6.2.0 through 6.2.3, FortiADC version version 6.1.0 through 6.1.6, FortiADC version 6.0.0 through 6.0.4, FortiADC version 5.4.0 through 5.4...

Command injection

Multiple improper neutralization of special elements used in an OS Command 'OS Command Injection' vulnerabilities CWE-78 in FortiTester 7.1.0, 7.0 all versions, 4.0.0 through 4.2.0, 2.3.0 through 3.9.1 may allow an authenticated attacker to execute arbitrary commands in the underlying shell...

CVE-2022-35845

Multiple improper neutralization of special elements used in an OS Command 'OS Command Injection' vulnerabilities CWE-78 in FortiTester 7.1.0, 7.0 all versions, 4.0.0 through 4.2.0, 2.3.0 through 3.9.1 may allow an authenticated attacker to execute arbitrary commands in the underlying shell...

CVE-2022-35845

FortiTester is affected by CVE-2022-35845, an OS Command Injection vulnerability due to improper neutralization of special elements in use. The issue allows an authenticated attacker to execute arbitrary commands in the underlying shell. Affected FortiTester versions include 2.3.0–3.9.1, 4.0.0–4....

PT-2023-2122 · Fortinet · Fortitester

Name of the Vulnerable Software and Affected Versions: FortiTester versions 2.3.0 through 3.9.1 FortiTester versions 4.0.0 through 4.2.0 FortiTester versions 7.0.0 through 7.1.0 Description: The issue exists due to the failure to neutralize special elements used in an OS command, allowing an...

GO-2022-1184 OS command injection vulnerability in code.sajari.com/docconv

The manipulation of the argument path to docconv.ConvertPDF,PDFHasImage leads to os command injection...

CVE-2021-4281

A vulnerability was found in Brave UX for-the-badge and classified as critical. Affected by this issue is some unknown functionality of the file .github/workflows/combine-prs.yml. The manipulation leads to os command injection. The name of the patch is 55b5a234c0fab935df5fb08365bc8fe9c37cf46b. It...

CVE-2021-4281

A vulnerability was found in Brave UX for-the-badge and classified as critical. Affected by this issue is some unknown functionality of the file .github/workflows/combine-prs.yml. The manipulation leads to os command injection. The name of the patch is 55b5a234c0fab935df5fb08365bc8fe9c37cf46b. It...