18753 matches found
ImageProcessing Command Injection
The vulnerability of the ImageProcessing software exists due to the lack of measures taken to neutralize special elements used in the operating system’s commands. Exploiting this vulnerability allows a remote attacker to execute shell commands...
CVE-2022-29516: Improper Neutralization of Special Elements used in an OS Command
The web console of FUJITSU Network IPCOM series IPCOM EX2 IN3200, 3500, IPCOM EX2 LB1100, 3200, 3500, IPCOM EX2 SC1100, 3200, 3500, IPCOM EX2 NW1100, 3200, 3500, IPCOM EX2 DC, IPCOM EX2 DC, IPCOM EX IN2300, 2500, 2700, IPCOM EX LB1100, 1300, 2300, 2500, 2700, IPCOM EX SC1100, 1300, 2300, 2500,...
EGroupware Code Injection vulnerability
phpgwapi/js/fckeditor/editor/dialog/fckspellerpages/spellerpages/serverscripts/spellchecker.php in EGroupware 1.4.001+.002; 1.6.001+.002 and possibly other versions before 1.6.003; and EPL 9.1 before 9.1.20100309 and 9.2 before 9.2.20100309; allows remote attackers to execute arbitrary commands v...
GHSA-5GX6-F2QQ-475F EGroupware Code Injection vulnerability
phpgwapi/js/fckeditor/editor/dialog/fckspellerpages/spellerpages/serverscripts/spellchecker.php in EGroupware 1.4.001+.002; 1.6.001+.002 and possibly other versions before 1.6.003; and EPL 9.1 before 9.1.20100309 and 9.2 before 9.2.20100309; allows remote attackers to execute arbitrary commands v...
GHSA-7FV9-M79R-J9X8 Electron vulnerable to remote command execution
Electron before 1.6.8 allows remote command execution because of a nodeIntegration bypass vulnerability. This also affects all applications that bundle Electron code equivalent to 1.6.8 or earlier. Bypassing the Same Origin Policy SOP is a precondition; however, recent Electron versions do not ha...
Electron vulnerable to remote command execution
Electron before 1.6.8 allows remote command execution because of a nodeIntegration bypass vulnerability. This also affects all applications that bundle Electron code equivalent to 1.6.8 or earlier. Bypassing the Same Origin Policy SOP is a precondition; however, recent Electron versions do not ha...
GHSA-XQ29-JCJ7-XG86 Webkit PDFs for TYPO3 allows remote attackers to execute arbitrary commands
Unspecified vulnerability in the Webkit PDFs webkitpdf extension before 1.1.4 for TYPO3 allows remote attackers to execute arbitrary commands via unknown vectors...
Webkit PDFs for TYPO3 allows remote attackers to execute arbitrary commands
Unspecified vulnerability in the Webkit PDFs webkitpdf extension before 1.1.4 for TYPO3 allows remote attackers to execute arbitrary commands via unknown vectors...
GHSA-RG6G-V4XM-G49Q News system (news) extension for TYPO3 vulnerable to SQL Injection
SQL injection vulnerability in the News system news extension before 1.3.3 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...
CoolURI extension for TYPO3 vulnerable to SQL Injection
SQL injection vulnerability in the CoolURI extension before 1.0.30 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...
TeamPass arbitrary file upload vulnerability
An arbitrary file upload vulnerability, present in TeamPass before 2.1.27.9, allows remote authenticated users to upload arbitrary files leading to Remote Command Execution. To exploit this vulnerability, an authenticated attacker has to tamper with parameters of a request to upload.files.php, in...
GHSA-RM3Q-QFRM-FRRV TeamPass arbitrary file upload vulnerability
An arbitrary file upload vulnerability, present in TeamPass before 2.1.27.9, allows remote authenticated users to upload arbitrary files leading to Remote Command Execution. To exploit this vulnerability, an authenticated attacker has to tamper with parameters of a request to upload.files.php, in...
CVE-2022-1362: Improper Neutralization of Special Elements used in an OS Command
The affected On-Premise cnMaestro is vulnerable inside a specific route where a user can upload a crafted package to the system. An attacker could abuse this user-controlled data to execute arbitrary commands on the server...
D-Link DIR-823-Pro Arbitrary Command Execution
The vulnerability of the SetNTPserverSeting function in D-Link DIR-823-Pro wireless routers’ software lies in the lack of measures taken to clean data at the management level. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands using the systemtimetimezone paramet...
TELNET Arbitrary Command Execution
The vulnerability of the TELNET network protocol implementation in D-Link DIR-882A1 wireless routers’ microsoftware lies in the lack of measures taken to clean data at the operating level when processing symbolic links like /usr/bin/cli. Exploiting this vulnerability allows an attacker to execute...
Fidelis Network Deception: Command Injection Vulnerability
Fidelis Network Deception is a security product from Fidelis USA, Inc. A command injection vulnerability exists in versions prior to Fidelis Network Deception 9.4.5, which stems from the filename parameter of CommandPost when using the updatecheckfile value. Command injection exists, and an...
Zyxell HTTP Interface Command Execution
The vulnerability of the HTTP interface implementation for Zyxell network interfaces relates to errors in processing input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely by introducing a specially crafted file...
SMA100 post-authentication Remote Command Execution vulnerability
Improper neutralization of special elements in the SonicWall SSL-VPN SMA100 series management interface allows a remote authenticated attacker to inject OS Command as a 'root' user which potentially leads to remote command execution vulnerability or denial of service DoS attack.IMPORTANT: SMA 100...
CVE-2021-42897
A remote command execution RCE vulnerability was found in FeMiner wms V1.0 in /wms/src/system/datarec.php. The $POSTrname is directly passed into the $mysqlstr and is executed by exec...