Spryker Commerce OS Remote Command Execution

Title ===== SCHUTZWERK-SA-2022-003: Remote Command Execution in Spryker Commerce OS Status ====== PUBLISHED Version ======= 1.0 CVE reference ============= CVE-2022-28888 Link ==== https://www.schutzwerk.com/en/43/advisories/schutzwerk-sa-2022-003/ Text-only version:...

PT-2022-18401 · Shanghai Feixun Data Communication Technology Co. · Fir302B

Name of the Vulnerable Software and Affected Versions: Shanghai Feixun Data Communication Technology Co., Ltd router fir302b version A2 Description: The issue is related to a remote command execution vulnerability via the Ping function. This allows for potential unauthorized access and control...

CVE-2022-31208

An issue was discovered in Infiray IRAY-A8Z3 1.0.957. The webserver contains an endpoint that can execute arbitrary commands by manipulating the cmdstring URL parameter...

Design/Logic Flaw

Roxy-WI is a Web interface for managing HAProxy, Nginx and Keepalived servers. Prior to version 6.1.1.0, the system command can be run remotely via the subprocessexecute function without processing the inputs received from the user in the /app/options.py file. Version 6.1.1.0 contains a patch for...

CVE-2022-31161

Roxy-WI is a Web interface for managing HAProxy, Nginx and Keepalived servers. Prior to version 6.1.1.0, the system command can be run remotely via the subprocessexecute function without processing the inputs received from the user in the /app/options.py file. Version 6.1.1.0 contains a patch for...

PT-2022-20576 · Haproxy +3 · Haproxy +3

Name of the Vulnerable Software and Affected Versions: Roxy-WI versions prior to 6.1.1.0 Description: Roxy-WI is a Web interface for managing HAProxy, Nginx, and Keepalived servers. The system command can be run remotely via the subprocess execute function without processing the inputs received...

CVE-2022-28888

Spryker Commerce OS 1.4.2 allows Remote Command Execution...

CVE-2022-28888

Spryker Commerce OS 1.4.2 allows Remote Command Execution...

CVE-2022-28888: Improper Neutralization of Special Elements used in an OS Command

Spryker Commerce OS 1.4.2 allows Remote Command Execution...

Sourcegraph gitserver sshCommand Remote Command Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Sourcegraph gitserver sshCommand RCE', 'Description' = %q A vulnerability exists within Sourcegraph's gitserver component that allows a remote...

PT-2022-19293 · Spryker · Spryker Commerce Os

Name of the Vulnerable Software and Affected Versions: Spryker Commerce OS version 1.4.2 Description: The issue allows for Remote Command Execution. Recommendations: For Spryker Commerce OS version 1.4.2, at the moment, there is no information about a newer version that contains a fix for this...

CVE-2022-28888

Spryker Commerce OS 1.4.2 allows Remote Command Execution...

Node.js outputFunctionName Command Execution

The vulnerability of the outputFunctionName function in the Node.js web application framework is related to incorrect elimination of special elements in the output data used by the incoming component. Exploiting this vulnerability allows an attacker to execute arbitrary commands remotely...

NPM npm-dependency-versions Command Execution

The vulnerability of the NPM dependency-versions versioning tool is related to insufficient checking of arguments passed to the command. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

CVE-2022-28888

CVE-2022-28888 affects Spryker Commerce OS 1.4.2 and specifically the spryker/http module versions below 1.7.0. The root cause is described as a predictable value used to sign/verify special _fragment URLs, enabling an attacker to cause remote command execution in many setups. Advisories state th...

Spryker Commerce OS operating system command injection vulnerability

Spryker Commerce OS is a B2B, B2C and Marketplace solution from Spryker Germany. A security vulnerability exists in Spryker Commerce OS version 1.4.2 that originates from allowing an attacker to perform remote command execution...

Exploit for Expression Language Injection in Apache Struts

CVE-2021-31805 1. Introduction Struts2 Remote Command Exec...

Rack Modular Interface Command Injection

The vulnerability of the modular interface between web servers and Rack web applications is related to improper input validation during data processing, as transmitted through the intermediate software Rack Lint and CommonLogger. Exploiting this vulnerability allows a remote attacker to send...

XStream: remote command execution attack by manipulating the processed input stream

A flaw was found in XStream. By manipulating the processed input stream, a remote attacker may be able to obtain sufficient rights to execute commands. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...

Gitlab -- multiple vulnerabilities

Gitlab reports: Remote Command Execution via Project Imports XSS in ZenTao integration affecting self hosted instances without strict CSP XSS in project settings page Unallowed users can read unprotected CI variables IP allow-list bypass to access Container Registries 2FA status is disclosed to...