CVE-2024-56497

An improper neutralization of special elements used in an os command 'os command injection' in Fortinet FortiMail versions 7.2.0 through 7.2.4 and 7.0.0 through 7.0.6 and 6.4.0 through 6.4.7, FortiRecorder versions 7.0.0 and 6.4.0 through 6.4.4 allows attacker to execute unauthorized code or...

CVE-2024-50566

A improper neutralization of special elements used in an os command 'os command injection' vulnerability in Fortinet FortiManager Cloud 7.6.0 through 7.6.1, FortiManager Cloud 7.4.0 through 7.4.4, FortiManager Cloud 7.2.2 through 7.2.7, FortiManager 7.6.0 through 7.6.1, FortiManager 7.4.0 through...

CVE-2024-50566

A improper neutralization of special elements used in an os command 'os command injection' vulnerability in Fortinet FortiManager Cloud 7.6.0 through 7.6.1, FortiManager Cloud 7.4.0 through 7.4.4, FortiManager Cloud 7.2.2 through 7.2.7, FortiManager 7.6.0 through 7.6.1, FortiManager 7.4.0 through...

CVE-2024-50566

CVE-2024-50566 affects Fortinet FortiManager and FortiManager Cloud: FortiManager Cloud 7.6.0–7.6.1, 7.4.0–7.4.4, 7.2.2–7.2.7; FortiManager 7.6.0–7.6.1, 7.4.0–7.4.5, 7.2.1–7.2.8 (and corresponding Cloud variants). Root cause: improper neutralization of special elements used in OS commands (OS com...

CVE-2025-20055

OS command injection vulnerability exists in network storage servers STEALTHONE D220/D340 provided by Y'S corporation. An attacker who can access the affected product may execute an arbitrary OS command...

CVE-2025-20016

OS command injection vulnerability exists in network storage servers STEALTHONE D220/D340/D440 provided by Y'S corporation. A user with an administrative privilege who logged in to the web management page of the affected product may execute an arbitrary OS command...

CVE-2025-20055

OS command injection vulnerability exists in network storage servers STEALTHONE D220/D340 provided by Y'S corporation. An attacker who can access the affected product may execute an arbitrary OS command...

CVE-2025-20055

OS command injection vulnerability exists in network storage servers STEALTHONE D220/D340 provided by Y'S corporation. An attacker who can access the affected product may execute an arbitrary OS command...

CVE-2025-20055

CVE-2025-20055 affects STEALTHONE D220/D340 network storage servers from Y'S corporation. A network-accessible OS command injection vulnerability could allow an attacker who can access the product to execute arbitrary OS commands (CVSS v3.1: 9.8 CRITICAL; no user interaction). Affected versions i...

CVE-2025-20016

OS command injection vulnerability exists in network storage servers STEALTHONE D220/D340/D440 provided by Y'S corporation. A user with an administrative privilege who logged in to the web management page of the affected product may execute an arbitrary OS command...

CVE-2025-20016

STEALTHONE D220/D340/D440 network storage servers from Y'S corporation are affected by CVE-2025-20016, an OS command injection (CWE-78) in the web management page. A user with administrative privileges can log in and execute arbitrary OS commands. Public write-ups confirm impact to the web UI as ...

CVE-2025-20016

OS command injection vulnerability exists in network storage servers STEALTHONE D220/D340/D440 provided by Y'S corporation. A user with an administrative privilege who logged in to the web management page of the affected product may execute an arbitrary OS command...

Wavlink AC3000 adm.cgi set_ledonoff() OS command injection vulnerability

Talos Vulnerability Report TALOS-2024-2032 Wavlink AC3000 adm.cgi setledonoff OS command injection vulnerability January 14, 2025 CVE Number CVE-2024-37186 SUMMARY An os command injection vulnerability exists in the adm.cgi setledonoff functionality of Wavlink AC3000 M33A8.V5030.210505. A special...

PT-2025-2818 · Fortinet · Fortisoar Imap Connector

Name of the Vulnerable Software and Affected Versions: FortiSOAR IMAP connector versions 3.5.7 and below Description: The issue is related to an improper neutralization of special elements used in an OS command, which may allow an authenticated attacker to execute unauthorized code or commands vi...

Wavlink AC3000 adm.cgi sch_reboot() OS command injection vulnerabilities

Talos Vulnerability Report TALOS-2024-2033 Wavlink AC3000 adm.cgi schreboot OS command injection vulnerabilities January 14, 2025 CVE Number CVE-2024-39781,CVE-2024-39783,CVE-2024-39782 SUMMARY Multiple OS command injection vulnerabilities exist in the adm.cgi schreboot functionality of Wavlink...

PT-2025-2585 · Fortinet · Fortivoice

Name of the Vulnerable Software and Affected Versions: Fortinet FortiVoice versions 7.0.0 through 7.0.4 Fortinet FortiVoice versions prior to 6.4.9 Description: The issue is related to an improper neutralization of special elements used in an OS command, allowing an authenticated privileged...

BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) OS Command Injection Vulnerability

BeyondTrust Privileged Remote Access PRA and Remote Support RS contain an OS command injection vulnerability that can be exploited by an attacker with existing administrative privileges to upload a malicious file. Successful exploitation of this vulnerability can allow a remote attacker to execut...

CVE-2025-0107

An OS command injection vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to run arbitrary OS commands as the www-data user in Expedition, which results in the disclosure of usernames, cleartext passwords, device configurations, and device API keys for firewalls...

CVE-2025-0107

An OS command injection vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to run arbitrary OS commands as the www-data user in Expedition, which results in the disclosure of usernames, cleartext passwords, device configurations, and device API keys for firewalls...

CVE-2025-0107 Expedition: OS Command Injection Vulnerability

An OS command injection vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to run arbitrary OS commands as the www-data user in Expedition, which results in the disclosure of usernames, cleartext passwords, device configurations, and device API keys for firewalls...