Command injection

PopojiCMS version 2.0.1 is vulnerable to remote command execution in the Meta Social field...

The vulnerability of the sub_4119A0 function in the microprogramming software of the TOTOLINK X6000R router allows a hacker to execute arbitrary code.

The vulnerability of the sub4119A0 function shttpd in the TOTOLINK X6000R router microprogramming system exists due to the lack of measures to neutralize special elements used in the operating system command. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Windows Media Remote Code Execution Vulnerability

...

PT-2023-8276 · Ivanti · Ivanti Avalanche

Name of the Vulnerable Software and Affected Versions: Ivanti Avalanche versions affected versions not specified Description: The issue is related to a stack-based buffer overflow in the WLAvalancheService of the Ivanti Avalanche system. An attacker can send specially crafted data packets to the...

PT-2023-8043 · Adobe · Experience Manager

Name of the Vulnerable Software and Affected Versions: Adobe Experience Manager versions 6.5.18 and earlier Description: The issue is related to a lack of protection for the web page structure in Adobe Experience Manager AEM, which can be exploited by a remote attacker to execute arbitrary code...

PT-2023-7781 · Siemens · Scalance M826-2 Shdsl-Router +11

Name of the Vulnerable Software and Affected Versions: RUGGEDCOM RM1224 LTE4G EU versions prior to V8.0 RUGGEDCOM RM1224 LTE4G NAM versions prior to V8.0 SCALANCE M804PB versions prior to V8.0 SCALANCE M812-1 ADSL-Router versions prior to V8.0 SCALANCE M816-1 ADSL-Router versions prior to V8.0...

The software for Zoho ManageEngine RecoveryManager Plus is vulnerable because measures taken to eliminate special elements used in the operating system commands have not been implemented. This vulnerability allows attackers to execute arbitrary commands.

The software for Zoho ManageEngine RecoveryManager Plus has vulnerabilities because measures to neutralize specific elements have not been taken. Exploiting these vulnerabilities allows a malicious actor to execute arbitrary commands remotely...

The vulnerability in the web interface of Cisco Firepower Management Center’s software management interface allows a perpetrator to execute arbitrary code.

The vulnerability of the web-based software interface of the Cisco Firepower Management Center exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using specially crafted commands from a remote location...

webkitgtk: Arbitrary Remote Code Execution

A flaw was found in WebKitGTK. Processing malicious web content may lead to remote code execution. This vulnerability is known to be actively exploited in the wild and was included in the CISA's KEV catalog...

Ubuntu 23.04 / 23.10 : LibreOffice vulnerabilities (USN-6546-1)

The remote Ubuntu 23.04 / 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6546-1 advisory. Reginaldo Silva discovered that LibreOffice incorrectly handled filenames when passing embedded videos to GStreamer. If a user were tricked into...

The vulnerability of the command-line interface (CLI) of the Ericsson Evolved Packet Gateway (EPG) allows a attacker to execute arbitrary commands.

The vulnerability of the command-line interface CLI of the Ericsson Evolved Packet Gateway EPG is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to execute arbitrary commands remotely...

GL.iNet Unauthenticated Remote Command Execution via the logread module.

A command injection vulnerability exists in multiple GL.iNet network products, allowing an attacker to inject and execute arbitrary shell commands via JSON parameters at the glsystemlog and glcrashlog interface in the logread module. This exploit requires post-authentication using the Admin-Token...

CVE-2023-47254

An OS Command Injection in the CLI interface on DrayTek Vigor167 version 5.2.2, allows remote attackers to execute arbitrary system commands and escalate privileges via any account created within the web interface...

CVE-2023-48410

In cdParseMsg of cdcodec.c, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2023-48397

CVE-2023-48397: Out-of-bounds read in Init of protocolcalladapter.cpp allows information disclosure with potential for System-level impact. The issue requires no user interaction. Documented in multiple sources (NVD entry and Android Pixel bulletin) with Pixel subcomponent exynos-ril and a CVSS v...

QNAP Systems QVR Operating System Command Injection Vulnerability

The QNAP Systems QVR is a QNAP monitoring system control center from China Weilian Technology QNAP Systems. An operating system command injection vulnerability exists in the QNAP Systems QVR version 4.x. An attacker could exploit this vulnerability to execute commands over the network...

The vulnerability of the Apache Airflow Hive Provider, a network software tool, arises from improper code generation management. This allows an attacker to execute arbitrary code.

The vulnerability of the Apache Airflow Hive Provider network software is related to incorrect code generation management. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Design/Logic Flaw

The configuration functionality in the Intelligent Platform Management Interface IPMI baseboard management controller BMC implementation on Supermicro X11 and M11 based devices, with firmware versions through 3.17.02, allows remote authenticated users to execute arbitrary commands...

Design/Logic Flaw

The web interface in the Intelligent Platform Management Interface IPMI baseboard management controller BMC implementation on Supermicro X11 and M11 based devices, with firmware versions before 3.17.02, allows remote authenticated users to execute arbitrary commands via a crafted request targetin...

USN-6522-2: FreeRDP vulnerabilities

USN-6522-1 fixed several vulnerabilities in FreeRDP. This update provides the corresponding update for Ubuntu 18.04 LTS. Original advisory details: It was discovered that FreeRDP incorrectly handled drive redirection. If a user were tricked into connection to a malicious server, a remote attacker...