15575 matches found
PT-2022-19293 · Spryker · Spryker Commerce Os
Name of the Vulnerable Software and Affected Versions: Spryker Commerce OS version 1.4.2 Description: The issue allows for Remote Command Execution. Recommendations: For Spryker Commerce OS version 1.4.2, at the moment, there is no information about a newer version that contains a fix for this...
Sourcegraph gitserver sshCommand Remote Command Execution
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Sourcegraph gitserver sshCommand RCE', 'Description' = %q A vulnerability exists within Sourcegraph's gitserver component that allows a remote...
The vulnerability of the outputFunctionName function in the Node.js web application framework allows a attacker to execute arbitrary commands.
The vulnerability of the outputFunctionName function in the Node.js web application framework is related to incorrect elimination of special elements in the output data used by the incoming component. Exploiting this vulnerability allows an attacker to execute arbitrary commands remotely...
The vulnerability of the NPM’s npm-dependency-versions versioning tool allows a attacker to execute any command they desire.
The vulnerability of the NPM dependency-versions versioning tool is related to insufficient checking of arguments passed to the command. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...
Spryker Commerce OS 操作系统命令注入漏洞
Spryker Commerce OS is a B2B, B2C and Marketplace solution from Spryker Germany. A security vulnerability exists in Spryker Commerce OS version 1.4.2 that originates from allowing an attacker to perform remote command execution...
CVE-2022-28888
CVE-2022-28888 affects Spryker Commerce OS 1.4.2 and specifically the spryker/http module versions below 1.7.0. The root cause is described as a predictable value used to sign/verify special _fragment URLs, enabling an attacker to cause remote command execution in many setups. Advisories state th...
Exploit for Expression Language Injection in Apache Struts
CVE-2021-31805 1. Introduction Struts2 Remote Command Exec...
The vulnerability of the modular interface between web servers and web applications in Rack, related to improper neutralization of special elements used in operating system commands, allows attackers to execute arbitrary shell commands on the target system.
The vulnerability of the modular interface between web servers and Rack web applications is related to improper input validation during data processing, as transmitted through the intermediate software Rack Lint and CommonLogger. Exploiting this vulnerability allows a remote attacker to send...
XStream: remote command execution attack by manipulating the processed input stream
A flaw was found in XStream. By manipulating the processed input stream, a remote attacker may be able to obtain sufficient rights to execute commands. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...
Gitlab -- multiple vulnerabilities
Gitlab reports: Remote Command Execution via Project Imports XSS in ZenTao integration affecting self hosted instances without strict CSP XSS in project settings page Unallowed users can read unprotected CI variables IP allow-list bypass to access Container Registries 2FA status is disclosed to...
The vulnerability of Huawei CV81-WDM FW printer’s microprogramming software arises from the lack of measures taken to neutralize special elements used in the operating system command set. This vulnerability allows attackers to execute arbitrary operating system commands.
The vulnerability of Huawei CV81-WDM FW printer’s microprogramming software exists due to the lack of measures taken to neutralize the special elements used in the operating system command set. Exploiting this vulnerability allows a remote attacker to execute arbitrary operating system commands...
The vulnerability of the saprouttab file affects SAP NetWeaver and SAP ABAP software integration platforms, allowing attackers to execute arbitrary commands.
The vulnerability of the saprouttab file in SAP NetWeaver and SAP ABAP software integration platforms is related to authentication errors. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...
The vulnerability of the mailcap module in the Python programming language allows a hacker to execute any command they desire.
The vulnerability of the mailcap module in the Python programming language lies in insufficient checking of arguments passed in commands. Exploiting this vulnerability allows an attacker to execute any command remotely...
VulnCheck KEV: CVE-2020-26878
Ruckus through 1.5.1.0.21 is affected by remote command injection. An authenticated user can submit a query to the API /service/v1/createUser endpoint, injecting arbitrary commands that will be executed as root user via web.py...
The vulnerability of Bently Nevada 3701 monitoring and protection systems, related to the use of pre-installed credentials, allows a intruder to execute arbitrary commands.
The vulnerability of Bently Nevada 3701 monitoring and protection systems lies in the use of pre-installed credentials. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...
Multiple TP-Link Wireless Extender Remote Command Execution Vulnerabilities
TP-Link WA850RE and others are all TP-Link's wireless extenders. A number of wireless extenders have remote command execution vulnerabilities, which can be exploited by attackers to execute unauthorized remote commands...
CVE-2019-25071 Apple iOS Siri Self privileges management
A vulnerability was found in Apple iPhone up to 12.4.1. It has been declared as critical. Affected by this vulnerability is Siri. Playing an audio or video file might be able to initiate Siri on the same device which makes it possible to execute commands remotely. Exploit details have been...
CVE-2019-25071
CVE-2019-25071 affects Apple iPhone on iOS up to 12.4.1, where playing an audio/video file can initiate Siri on the same device, enabling commands to be executed remotely. Public demonstrations exist; Apple disputes security implications. Remediation noted as upgrading to iOS 13.0 or later.
Apple iPhone 安全漏洞
The Apple iPhone is a smartphone from Apple, an American Apple Apple company. A security vulnerability exists in Apple iPhone versions prior to 12.4.1, which stems from the ability to play an audio or video file to launch Siri on the same device, allowing commands to be executed remotely...
