CVE-2022-1703: Improper Neutralization of Special Elements used in an OS Command

Improper neutralization of special elements in the SonicWall SSL-VPN SMA100 series management interface allows a remote authenticated attacker to inject OS Commands which potentially leads to remote command execution vulnerability or denial of service DoS attack...

PT-2022-14057

Name of the Vulnerable Software and Affected Versions SonicWall SSL-VPN SMA100 series affected versions not specified Description The issue is related to the improper neutralization of special elements in the management interface, allowing a remote authenticated attacker to inject OS commands. Th...

CVE-2021-32546

Missing input validation in internal/db/repoeditor.go in Gogs before 0.12.8 allows an attacker to execute code remotely. An unprivileged attacker registered user can overwrite the Git configuration in his repository. This leads to Remote Command Execution, because that configuration can contain a...

PT-2022-14171 · Gogs · Gogs

Name of the Vulnerable Software and Affected Versions: gogs/gogs versions =0.12.7 Description: A remote command execution issue exists due to improper validation of the tree path parameter during file uploads. An attacker can upload a file into the .git directory by setting tree path=.git.,...

CVE-2021-32546: Undefined Security Weakness

Missing input validation in internal/db/repoeditor.go in Gogs before 0.12.8 allows an attacker to execute code remotely. An unprivileged attacker registered user can overwrite the Git configuration in his repository. This leads to Remote Command Execution, because that configuration can contain a...

FactoryTalk AssetCentre SaveConfigFile Arbitrary Command Execution

The vulnerability of the SaveConfigFile function in the RACompare service of the FactoryTalk AssetCentre software exists because measures to neutralize the special elements used in the operating system commands are not taken. Exploiting this vulnerability allows a malicious actor to execute...

Zyxel NWA-1100-NH Web Interface Command Execution

The vulnerability of the web interface of Zyxel NWA-1100-NH wireless access point exists due to the lack of measures taken to neutralize the special elements used in the operating system’s command set. Exploiting this vulnerability allows a malicious actor to execute arbitrary operating system...

OpenSSL c_rehash Command Execution

The vulnerability of the crehash implementation in the OpenSSL library is related to the failure to take measures to neutralize metasymbols during certificate processing in /etc/ssl/certs/. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

Exploit for OS Command Injection in Zyxel Usg_Flex_100W_Firmware

CVE-2022-30525 Zyxel Firewall Command Injection Vulnerability...

CVE-2022-20797

A vulnerability in the web-based management interface of Cisco Secure Network Analytics, formerly Cisco Stealthwatch Enterprise, could allow an authenticated, remote attacker to execute arbitrary commands as an administrator on the underlying operating system. This vulnerability is due to...

CVE-2022-20797: Improper Input Validation

A vulnerability in the web-based management interface of Cisco Secure Network Analytics, formerly Cisco Stealthwatch Enterprise, could allow an authenticated, remote attacker to execute arbitrary commands as an administrator on the underlying operating system. This vulnerability is due to...

PT-2022-3423

Name of the Vulnerable Software and Affected Versions Rack versions prior to 2.0.9.1 Rack versions prior to 2.1.4.1 Rack versions prior to 2.2.3.1 Description A sequence injection vulnerability exists in Rack, which could allow a possible shell escape in the Lint and CommonLogger components. This...

MinDoc code issues and vulnerabilities

MinDoc is a Go-based online document management system based on the beego framework developed by Iminho Personal Developer. A security vulnerability exists in MinDoc v2.1-beta.5, which stems from an arbitrary file upload issue. The vulnerability can be exploited to execute arbitrary commands via ...

CVE-2022-29637: Unrestricted Upload of File with Dangerous Type

An arbitrary file upload vulnerability in Mindoc v2.1-beta.5 allows attackers to execute arbitrary commands via a crafted Zip file...

Schneider Electric PLC Buffer Overflow

The vulnerability of microprogrammed software in Schneider Electric’s programmable logic controllers such as Modicon M340, Modicon Quantum, and Modicon Premium arises due to buffer overflow in the stack. Exploiting this vulnerability allows an attacker to execute arbitrary commands remotely by...

ShopXO RCE Vulnerability

A remote command execution vulnerability in shopxo 1.9.3 allows an attacker to upload malicious code generated by phar where the suffix is JPG, which is uploaded after modifying the phar suffix...

GHSA-XX77-W6P5-XVMJ ShopXO RCE Vulnerability

A remote command execution vulnerability in shopxo 1.9.3 allows an attacker to upload malicious code generated by phar where the suffix is JPG, which is uploaded after modifying the phar suffix...

GHSA-372H-P48H-XW8Q Liferay Portal Allows RCE via Deserialization of a JSON Payload

Liferay Portal CE 7.1.0 and earlier allows remote command execution because of deserialization of a JSON payload...

Liferay Portal Allows RCE via Deserialization of a JSON Payload

Liferay Portal CE 7.1.0 and earlier allows remote command execution because of deserialization of a JSON payload...

Total.js CMS RCE Vulnerability

An issue was discovered in Total.js CMS 12.0.0. An authenticated user with the widgets privilege can gain achieve Remote Command Execution RCE on the remote server by creating a malicious widget with a special tag containing JavaScript code that will be evaluated server side. In the process of...