CVE-2022-38531: Improper Neutralization of Special Elements used in an OS Command

FPT G-97RG6M R4.2.98.035 and G-97RG3 R4.2.43.078 are vulnerable to Remote Command Execution in the ping function...

CVE-2022-37777: Undefined Security Weakness

Phicomm FIR151B A2, FIR302E A2, FIR300B A2, FIR303B A2 routers 3.0.1.17 and earlier were discovered to contain a remote command execution RCE vulnerability via the trHops parameter of the tracert function...

CVE-2022-37780: Undefined Security Weakness

Phicomm FIR151B A2, FIR302E A2, FIR300B A2, FIR303B A2 routers V3.0.1.17 were discovered to contain a remote command execution RCE vulnerability via the pingAddr parameter of the tracert function...

PT-2022-24066 · Phicomm · Phicomm Fir303B A2 +3

Name of the Vulnerable Software and Affected Versions: Phicomm FIR151B A2, FIR302E A2, FIR300B A2, FIR303B A2 routers versions 3.0.1.17 and earlier Description: A remote command execution issue was found, which can be exploited via the trHops parameter of the tracert function. Recommendations: Fo...

CVE-2022-37778: Undefined Security Weakness

Phicomm FIR151B A2, FIR302E A2, FIR300B A2, FIR303B A2 routers V3.0.1.17 were discovered to contain a remote command execution RCE vulnerability via the currenttime parameter of the time function...

Multiple Phicomm products have security vulnerabilities

The Phicomm FIR151B A2, among others, is a wireless router from the Chinese company Fusion Phicomm. A security vulnerability exists in Phicomm, which stems from the trHops parameter of its tracert function that allows an attacker to achieve remote command execution. The following versions are...

Hitachi RAID Manager SRA: Operating System Command Injection Vulnerability

Hitachi RAID Manager SRA is a storage replication adapter software from Hitachi, Japan. A security vulnerability exists in Hitachi RAID Manager Storage Replication Adapter that originates from it allowing remote authenticated users to execute arbitrary OS commands via OS command injection...

CVE-2022-31814

pfSense pfBlockerNG through 2.1.426 allows remote attackers to execute arbitrary OS commands as root via shell metacharacters in the HTTP Host header. NOTE: 3.x is unaffected...

Cisco Small Business RV110W Router Arbitrary Command Execution

The vulnerability in the web interface for managing microprogrammed software routers of Cisco Small Business RV110W, RV130, RV130W, and RV215W arises from the copying of buffers without checking the size of the input data during the processing of user fields in incoming HTTP packets. Exploiting...

PT-2022-20948 · Unknown · Pfsense Pfblockerng

Name of the Vulnerable Software and Affected Versions: pfSense pfBlockerNG versions 2.1.4 26 and earlier Description: The issue allows remote attackers to execute arbitrary OS commands as root via shell metacharacters in the HTTP Host header. It is estimated that over 388,000 devices may be...

Cisco Small Business RV110W Router Arbitrary Command Execution

The vulnerability in the web interface for managing microprogrammed software routers of Cisco Small Business RV110W, RV130, RV130W, and RV215W arises from the copying of buffers without checking the size of the input data during the processing of user fields in incoming HTTP packets. Exploiting...

CVE-2021-28398: Improper Neutralization of Special Elements used in an OS Command

A privileged attacker in GeoNetwork before 3.12.0 and 4.x before 4.0.4 can use the directory harvester before-script to execute arbitrary OS commands remotely on the hosting infrastructure. A User Administrator or Administrator account is required to perform this. This occurs in the runBeforeScri...

PT-2022-7694 · Drawio +1 · Drawio +1

Name of the Vulnerable Software and Affected Versions: drawio versions prior to 20.3.0 Description: The issue is related to the incorrect neutralization of special elements used in an OS command, which can allow a remote attacker to execute arbitrary commands. Recommendations: For versions prior ...

Exploit for Code Injection in Combodo Itop

iTop RCE via SSTI - CVE-2022-24780 exploit iTop --debu...

CVE-2022-36601: Undefined Security Weakness

The Eclipse TCF debug interface in JasMiner-X4-Server-20220621-090907 and below is open on port 1534. This issue allows unauthenticated attackers to gain root privileges on the affected device and access sensitive data or execute arbitrary commands...

Online Ordering System Code Vulnerabilities

Online Ordering System is a multi-store ordering system for janobe individual developers. It can be used for any small business. A security vulnerability exists in Online Ordering System version v2.3.2, which stems from its /admin/products/controller.php?action=add component that allows an attack...

Symmetricom SyncServer Unauthenticated Remote Command Execution

This module exploits an unauthenticated command injection vulnerability in /controller/ping.php. The S100 through S350 End of Life models should be vulnerable to unauthenticated exploitation due to a session handling vulnerability. Later models require authentication which is not provided in this...

ASUS RT-AC86U Command Injection

The vulnerability of the microprogrammed Wi-Fi router software from ASUS, the RT-AC86U, exists due to the lack of measures taken to neutralize special elements used in the operating system’s command set. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands or cause...

Gitlab -- multiple vulnerabilities

Gitlab reports: Remote Command Execution via GitHub import Stored XSS via labels color Content injection via Incidents Timeline description Lack of length validation in Snippets leads to Denial of Service Group IP allow-list not fully respected by the Package Registry Abusing Gitaly.GetTreeEntrie...

FreeBSD : Gitlab -- multiple vulnerabilities (e6b994e2-2891-11ed-9be7-454b1dd82c64)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the e6b994e2-2891-11ed-9be7-454b1dd82c64 advisory. - Gitlab reports: Remote Command Execution via GitHub import Stored XSS via labels color Conte...