8007 matches found
CVE-2023-24229
DrayTek Vigor2960 v1.5.1.4 allows an authenticated attacker with network access to the web management interface to inject operating system commands via the mainfunction.cgi 'parameter' parameter. NOTE: This vulnerability only affects products that are no longer supported by the maintainer...
CVE-2023-24229
Summary: CVE-2023-24229 affects DrayTek Vigor2960 (v1.5.1.4). An authenticated attacker with network access to the device’s web management interface can inject operating system commands through the mainfunction.cgi parameter, enabling arbitrary command execution. This vulnerability exists in a de...
CVE-2023-28343
OS command injection affects Altenergy Power Control Software C1.2.5 via shell metacharacters in the index.php/management/settimezone timezone parameter, because of settimezone in models/managementmodel.php...
GHSA-XXHH-59GH-6FFX SAP Cloud SDK for AI Python has OS Command Injection when Program Objects Execution is Enabled
SAP Business Object Adaptive Job Server - versions 420, 430, allows remote execution of arbitrary commands on Unix, when program objects execution is enabled, to authenticated users with scheduling rights, using the BI Launchpad, Central Management Console or a custom application based on the...
CVE-2023-28343
Altenergy Power Control Software C1.2.5 is affected by CVE-2023-28343: an OS command injection via shell metacharacters in the index.php/management/set_timezone parameter, caused by set_timezone in models/management_model.php. This allows remote command execution with the affected product version...
CVE-2023-24762
OS Command injection vulnerability in D-Link DIR-867 DIR867FW1.30B07 allows attackers to execute arbitrary commands via a crafted LocalIPAddress parameter for the SetVirtualServerSettings to HNAP1...
CVE-2023-24762
CVE-2023-24762 affects the D-Link DIR-867 router (firmware 1.30B07) with an OS command-injection vulnerability in SetVirtualServerSettings to HNAP1. An attacker can craft LocalIPAddress to execute arbitrary commands. CVSSv3.1 base score 9.8 (CRITICAL), vectors: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H...
CVE-2023-25279
The CVE-2023-25279 entry concerns an OS command injection in the D-Link DIR820LA1_FW105B03 firmware, enabling privilege escalation to root via a crafted payload. The affected product is a D-Link DIR820LA1 router; root cause is an OS command injection vulnerability, with impact described as high c...
CVE-2023-25279
OS Command injection vulnerability in D-Link DIR820LA1FW105B03 allows attackers to escalate privileges to root via a crafted payload...
CVE-2023-1350
A vulnerability was found in liferea. It has been rated as critical. Affected by this issue is the function updatejobrun of the file src/update.c of the component Feed Enrichment. The manipulation of the argument source with the input |date /tmp/bad-item-link.txt leads to os command injection. Th...
Command injection
A vulnerability was found in liferea. It has been rated as critical. Affected by this issue is the function updatejobrun of the file src/update.c of the component Feed Enrichment. The manipulation of the argument source with the input |date /tmp/bad-item-link.txt leads to os command injection. Th...
CVE-2023-1350
A vulnerability was found in liferea. It has been rated as critical. Affected by this issue is the function updatejobrun of the file src/update.c of the component Feed Enrichment. The manipulation of the argument source with the input |date /tmp/bad-item-link.txt leads to os command injection. Th...
CVE-2023-1350 liferea Feed Enrichment update.c update_job_run os command injection
A vulnerability was found in liferea. It has been rated as critical. Affected by this issue is the function updatejobrun of the file src/update.c of the component Feed Enrichment. The manipulation of the argument source with the input |date /tmp/bad-item-link.txt leads to os command injection. Th...
CVE-2023-1350
A vulnerability was found in liferea. It has been rated as critical. Affected by this issue is the function updatejobrun of the file src/update.c of the component Feed Enrichment. The manipulation of the argument source with the input |date /tmp/bad-item-link.txt leads to os command injection. Th...
CVE-2022-39951
A improper neutralization of special elements used in an os command 'os command injection' in Fortinet FortiWeb version 7.0.0 through 7.0.2, FortiWeb version 6.3.6 through 6.3.20, FortiWeb 6.4 all versions allows attacker to execute unauthorized code or commands via specifically crafted HTTP...
CVE-2022-39951
A improper neutralization of special elements used in an os command 'os command injection' in Fortinet FortiWeb version 7.0.0 through 7.0.2, FortiWeb version 6.3.6 through 6.3.20, FortiWeb 6.4 all versions allows attacker to execute unauthorized code or commands via specifically crafted HTTP...
CVE-2022-39951
FortiWeb is affected by an OS command injection vulnerability (CVE-2022-39951) in Fortinet FortiWeb versions 7.0.0–7.0.2, 6.3.6–6.3.20, and 6.4 all versions. The issue is described as improper neutralization of special elements used in an OS command, enabling an attacker to execute unauthorized c...
PT-2023-1682 · Fortinet · Fortiweb
Name of the Vulnerable Software and Affected Versions: FortiWeb versions 6.3.6 through 6.3.20 FortiWeb versions 7.0.0 through 7.0.2 FortiWeb 6.4 all versions Description: The issue is related to an improper neutralization of special elements used in an os command, also known as 'os command...
Barracuda CloudGen WAN OS Command Injection Vulnerability
Barracuda CloudGen WAN provides a private edge appliance for hybrid deployments. An authenticated user in the administration interface for the private edge virtual appliance can inject arbitrary OS commands via the /ajax/updatecertificate endpoint. Versions prior to v8. hotfix 1089 are affected...
