Command injection

Authenticated Semi-Blind Command Injection via Parameter Injection exists on Altus Nexto, Nexto Xpress, and Hadron Xtorm devices via the getlogs.cgi tcpdump feature. This affects Nexto NX3003 1.8.11.0, Nexto NX3004 1.8.11.0, Nexto NX3005 1.8.11.0, Nexto NX3010 1.8.3.0, Nexto NX3020 1.8.3.0, Nexto...

CVE-2021-39244

CVE-2021-39244 is a documented authenticated semi-blind command injection vulnerability affecting Altus Nexto and Hadron Xtorm devices, exposed via the getlogs.cgi tcpdump feature. Affected products/versions (per sources) include Nexto NX3003/ NX3004/ NX3005/ NX3010/ NX3020/ NX3030 (1.8.11.0 or 1...

CVE-2021-39244: Improper Neutralization of Special Elements used in an OS Command

Authenticated Semi-Blind Command Injection via Parameter Injection exists on Altus Nexto, Nexto Xpress, and Hadron Xtorm devices via the getlogs.cgi tcpdump feature. This affects Nexto NX3003 1.8.11.0, Nexto NX3004 1.8.11.0, Nexto NX3005 1.8.11.0, Nexto NX3010 1.8.3.0, Nexto NX3020 1.8.3.0, Nexto...

AT&T Labs Xmill 参数注入漏洞

AT&T Labs Xmill is a new tool for efficient compression of XML data from AT&T Labs, USA. AT&T Labs Xmill suffers from a parameter injection vulnerability that exists due to a boundary error in the command line parsing HandleFileArg function in strlen. A local user can use a specially crafted...

Palo Alto Networks PAN-OS 参数注入漏洞

PAN-OS is an operating system designed specifically for the security and control of Palo Alto Networks firewalls, with a rich set of firewall, management and network features. An OS command parameter injection vulnerability exists in the web interface of PAN-OS. An attacker could exploit this...

Mobileiron MobileIron Core参数注入漏洞

Mobileiron MobileIron Core is a management console component of the MobileIron platform from Mobileiron, Inc. The product supports the definition of security and management policies for devices, applications and content. A parameter injection vulnerability exists in Ivanti MobileIron Core version...

Etherpad 参数注入漏洞

Etherpad is open source a Web-based online document collaboration tool . Multiple users can simultaneously write a text document through Etherpad , and see all the participants of real-time editing . Etherpad version 1.8.13 there is a security vulnerability , the vulnerability stems from a...

CVE-2021-32534

QSAN SANOS factory reset function does not filter special parameters. Remote attackers can use this vulnerability to inject and execute arbitrary commands without permissions. The referred vulnerability has been solved with the updated version of QSAN SANOS v2.1.0...

CVE-2020-22208

SQL Injection in 74cms 3.2.0 via the x parameter to plus/ajaxstreet.php...

CVE-2021-27479

ZOLL Defibrillator Dashboard, v prior to 2.2,The affected product’s web application could allow a low privilege user to inject parameters to contain malicious scripts to be executed by higher privilege users...

Code injection

ZOLL Defibrillator Dashboard, v prior to 2.2,The affected product’s web application could allow a low privilege user to inject parameters to contain malicious scripts to be executed by higher privilege users...

Ruby Parameter Injection Vulnerability

Ruby is a cross-platform, object-oriented, dynamically-typed programming language from the individual developer, Yukihiro Matsumoto. A parameter injection vulnerability exists in Ruby versions prior to 1.4.0, which can be exploited by an attacker to read and write arbitrary files via a crafted UR...

Ruby 参数注入漏洞

Ruby is a cross-platform, object-oriented, dynamically-typed programming language from the individual developer, Yukihiro Matsumoto. A parameter injection vulnerability exists in Ruby versions prior to 1.4.0, which can be exploited by an attacker to read and write arbitrary files via a crafted UR...

CVE-2020-18230

Cross Site Scripting XSS in PHPMyWind v5.5 allows remote attackers to execute arbitrary code by injecting scripts into the parameter "$cfgswitchshow" of component " /admin/webconfig.php"...

CVE-2020-18229

Cross Site Scripting XSS in PHPMyWind v5.5 allows remote attackers to execute arbitrary code by injecting scripts into the parameter "$cfgcopyright" of component " /admin/webconfig.php"...

PT-2021-18403

Name of the Vulnerable Software and Affected Versions IBM InfoSphere Information Server version 11.7 Description The issue allows an attacker to obtain sensitive information by injecting parameters into an HTML query, which could be used in further attacks against the system. Recommendations For...

Cisco Modeling Labs Parameter Injection Vulnerability

Cisco Modeling Labs is a software application from the American company Cisco Cisco. A local network simulation tool that runs on workstations and servers. Cisco Modeling Labs suffers from a parameter injection vulnerability that stems from insufficient validation of user-supplied web UI input,...

IBM InfoSphere Information Server 信息泄露漏洞

IBM InfoSphere Information Server is a data integration platform that includes a range of products that enable you to understand, cleanse, monitor, transform, and transfer data, as well as collaborate to bridge the gap between business and IT. An information disclosure vulnerability exists in IBM...

Cisco Modeling Labs 参数注入漏洞

Cisco Modeling Labs is a software application from the American company Cisco Cisco. A local network simulation tool that runs on workstations and servers. Cisco Modeling Labs suffers from a parameter injection vulnerability that stems from insufficient validation of user-supplied web UI input,...

Aiven Ltd: Grafana RCE via SMTP server parameter injection

Summary: This report is similar to 1180653, except with different parameter injection entrypoint. SMTP server password configuration setting accepts new line characters. This can be used to set non-exported configuration variables. Using this CRLF-injection, the renderingargs of grafana image...