CVE-2024-27521: Improper Neutralization of Special Elements used in an OS Command

TOTOLINK A3300R V17.0.0cu.557B20221024 was discovered to contain an unauthenticated remote command execution RCE vulnerability via multiple parameters in the "setOpModeCfg" function. This security issue allows an attacker to take complete control of the device. In detail, exploitation allows...

TOTOLINK A3300R security vulnerabilities

The TOTOLINK A3300R is a dual-band wireless router. A command execution vulnerability exists in the TOTOLINK A3300R, which stems from a Remote Command Execution RCE vulnerability in multiple parameters of the setOpModeCfg function, which can be exploited by an attacker to execute arbitrary system...

Tenda AC10U formWriteFacMac Arbitrary Command Execution

The vulnerability of the formWriteFacMac function /goform/WriteFacMac in the Tenda AC10U router software relates to the failure to neutralize special elements used in operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

CVE-2024-24897 Remote command execution in A-Tune-Collector

Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability in openEuler A-Tune-Collector on Linux allows Command Injection. This vulnerability is associated with program files...

CVE-2024-24897 Remote command execution in A-Tune-Collector

Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability in openEuler A-Tune-Collector on Linux allows Command Injection. This vulnerability is associated with program files...

LunarNight Laboratory WebProxy Security Vulnerability

Lunarnight Laboratory LunarNight Laboratory WebProxy is a perl script for web proxies from Lunarnight Laboratory Vietnam. A security vulnerability exists in LunarNight Laboratory WebProxy versions 1.7.8 through 1.7.9 that originates from a vulnerability that could allow an unauthenticated, remote...

CVE-2024-27438

Apache Doris versions 1.2.0 through 2.0.4 are vulnerable to a Download of Code Without Integrity Check (CWE-494) vulnerability. The root cause is that JDBC driver files used for the JDBC catalog are not checked for integrity. An attacker authorized to create a JDBC catalog can provide an arbitrar...

CVE-2024-27438 Apache Doris: Downloading arbitrary remote jar files resulting in remote command execution

Download of Code Without Integrity Check vulnerability in Apache Doris. The jdbc driver files used for JDBC catalog is not checked and may resulting in remote command execution. Once the attacker is authorized to create a JDBC catalog, he/she can use arbitrary driver jar file with unchecked code...

CVE-2024-27438 Apache Doris: Downloading arbitrary remote jar files resulting in remote command execution

Download of Code Without Integrity Check vulnerability in Apache Doris. The jdbc driver files used for JDBC catalog is not checked and may resulting in remote command execution. Once the attacker is authorized to create a JDBC catalog, he/she can use arbitrary driver jar file with unchecked code...

CVE-2024-27438

Download of Code Without Integrity Check vulnerability in Apache Doris. The jdbc driver files used for JDBC catalog is not checked and may resulting in remote command execution. Once the attacker is authorized to create a JDBC catalog, he/she can use arbitrary driver jar file with unchecked code...

CVE-2023-35899

IBM Cloud Pak for Automation 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, 22.0.1, and 22.0.2 is potentially vulnerable to CSV Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file...

OpenNMS Horizon 31.0.7 Remote Command Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'OpenNMS Horizon Authenticated RCE', 'Description' = %q This module exploits built-in functionality in OpenNMS Horizon in order to execute arbitra...

CVE-2024-27438: Download of Code Without Integrity Check

Download of Code Without Integrity Check vulnerability in Apache Doris. The jdbc driver files used for JDBC catalog is not checked and may resulting in remote command execution. Once the attacker is authorized to create a JDBC catalog, he/she can use arbitrary driver jar file with unchecked code...

ArubaOS CLI Command Execution

The vulnerability of the CLI interface of ArubaOS operating systems is related to the lack of measures taken to neutralize special elements used in operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

PT-2024-22277

Name of the Vulnerable Software and Affected Versions FitNesse all releases Description The issue allows a remote authenticated attacker to execute arbitrary OS commands. Note that this behavior is claimed by a contributor to be a product specification rather than a vulnerability, and this is und...

PT-2024-2930 · Ivanti · Ivanti Avalanche

Name of the Vulnerable Software and Affected Versions: Ivanti Avalanche versions prior to 6.4.3 Description: The issue is related to a heap overflow vulnerability in the WLAvalancheService component. This vulnerability can be exploited by a remote unauthenticated attacker to execute arbitrary...

PT-2024-2913 · Ivanti · Ivanti Avalanche

Name of the Vulnerable Software and Affected Versions: Ivanti Avalanche versions prior to 6.4.3 Description: The issue is related to a Path Traversal vulnerability in the web component of Ivanti Avalanche. This vulnerability is caused by incorrect restriction of the directory path name with limit...

PT-2024-2386 · Tenda · Tenda Ac15

Name of the Vulnerable Software and Affected Versions: Tenda AC15 versions 15.03.05.18 through 15.03.20 multi Description: The issue is related to the function formSetSambaConf at the /goform/setsambacfg endpoint, where the usbName parameter is not properly sanitized, leading to OS command...

OESA-2024-1291 aops-zeus security update

A host and user manager service which is the foundation of aops. Security Fixes: In aops-zeus software versions 1.2.01.4.1, there is a vulnerability in the plugin management command of the zeus/conf/constant file. Through this vulnerability, an attacker can implant arbitrary commands to be execut...

OESA-2024-1292 aops-zeus security update

A host and user manager service which is the foundation of aops. Security Fixes: In aops-zeus software versions 1.2.01.4.1, there is a vulnerability in the plugin management command of the zeus/conf/constant file. Through this vulnerability, an attacker can implant arbitrary commands to be execut...