CVE-2021-37925

CVE-2021-37925 affects Zoho ManageEngine ADManager Plus, versions 7110 and earlier. The issue is a Post-Auth OS command injection vulnerability, with Red Hat, NVD, PRION, CVE lists and CNNVD entries corroborating the description. The CVSS calculations indicate a high-impact, critical exposure: CV...

Adobe Digital Editions Multiple Vulnerabilities (APSB21-80) - Mac OS X

The host is missing an important security update according to Adobe September update. SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Siemens Desigo CC 操作系统命令注入漏洞

Siemens Desigo CC is an open building management platform from Siemens, Germany.GMA Manager allows the functional combination of different safety and security systems, such as fire detection systems and video surveillance, on a common platform.Operation Scheduler is a tool that enables security...

Schneider Electric Struxureware Data Center Expert

1. EXECUTIVE SUMMARY CVSS v3 9.1 ATTENTION: Exploitable remotely/low attack complexity Vendor: Schneider Electric Equipment: Struxureware Data Center Expert Vulnerabilities: OS Command Injection, Path Traversal 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow remote...

OS Command Injection in zacanger/is-program-installed

✍️ Description There is "OS Command Injection" vulnerability on "is-program-installed" npm package. This package tries to understand the given parameter name program or binary name is installed in the computer or not. However, since this package does not properly control the characters in the...

Mitsubishi Electric Europe B.V. smartRTU and INEA ME-RTU

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Mitsubishi Electric Europe B.V. Equipment: smartRTU and INEA ME-RTU Vulnerabilities: OS Command Injection, Improper Access Control, Cross-site Scripting, Use of Hard-coded Credentials, Unprotected...

A1:Injection — Top 10 OWASP 2017

A1:Injection — Top 10 OWASP 2017 💉 Introduction Injection is an issue that arises quite often and in several forms, things like SQL databases for example might contain issues such as SQL injection and the same might go for things like LDAP, XML, OS commands,… . In other words, there is a range of...

GHSA-2C83-WFV3-Q25F Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in ZMarkdown

Impact A Remote Command Execution vulnerability was found in the rebber module, which allowed execution of arbitrary commands. The reported problem came from CodeBlocks, which could be escaped to insert malicious LaTeX. Anyone using rebber without sanitation of code content or a custom macro is...

OS Command Injection

zeppelin-zengine is vulnerable to OS command injection. An attacker is able to inject bash commands into Spark interpreter settings...

OS Command Injection in bikeshed

This affects the package bikeshed before 3.0.0. This can occur when an untrusted source file containing Inline Tag Command metadata is processed. When an arbitrary OS command is executed, the command output would be included in the HTML output...

Exploit for OS Command Injection in Strapi

CVE-2019-19609 Strap...

BinderHub 操作系统命令注入漏洞

BinderHub is a kubernetes-based cloud service that allows users to share replicable interactive computing environments from a codebase. BinderHub suffers from an operating system command injection vulnerability. An attacker can exploit this vulnerability to execute code in the BinderHub context a...

Command injection

Network Attached Storage on LG N1T1 10124 devices allows an unauthenticated attacker to gain root access via OS command injection in the en/ajp/plugins/access.ssh/checkInstall.php destServer parameter...

CVE-2021-38306

Network Attached Storage on LG N1T1 10124 devices allows an unauthenticated attacker to gain root access via OS command injection in the en/ajp/plugins/access.ssh/checkInstall.php destServer parameter...

CVE-2021-38306

The CVE-2021-38306 entry concerns LG N1T1*** Network Attached Storage. Affected component: the en/ajp/plugins/access.ssh/checkInstall.php endpoint (destServer parameter). Root cause: OS command injection leading to unauthenticated remote code execution. Impact: attacker could gain root access on ...

API8: Injection☝️ — What you need to know

API8: Injection☝️ — What you need to know Introduction API8:2019 Injection What is Injection? API’s with the following properties are open to injection flaws: When we don’t sanitize the input from the front-end we are opening ourselves to a world of problems, this would allow the user to input...

Adobe Illustrator 2021 OS Command Injection Vulnerability

Adobe Illustrator 2021 is a vector graphics software. Adobe Illustrator 2021 version 25.2.3 and earlier is vulnerable to a security flaw. An attacker can exploit this vulnerability to achieve arbitrary code execution in the context of the current user...

Design/Logic Flaw

Acrobat Reader DC versions 2021.005.20054 and earlier, 2020.004.30005 and earlier and 2017.011.30197 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command. An authenticated attacker could leverage this vulnerability to achieve arbitrary code execution on...

CVE-2021-28634 Adobe Acrobat Reader AcrobatUtils.scpt Extension OS Command Injection Vulnerability

Acrobat Reader DC versions 2021.005.20054 and earlier, 2020.004.30005 and earlier and 2017.011.30197 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command. An authenticated attacker could leverage this vulnerability to achieve arbitrary code execution on...

CVE-2021-28634

CVE-2021-28634 affects Adobe Acrobat/Reader DC family. Specifically Acrobat Reader DC versions 2021.005.20054 and earlier, 2020.004.30005 and earlier, and 2017.011.30197 and earlier are vulnerable to Improper Neutralization of Special Elements used in an OS Command, enabling arbitrary code execut...