14217 matches found
CVE-2025-65363
Authenticated append-style command-injection Ruijie APs APRGOS 11.1.x allows an authenticated web user to execute appended shell expressions as root, enabling file disclosure, device disruption, and potential network pivoting via the command parameter to the webaction.do endpoint...
PT-2025-49831
Name of the Vulnerable Software and Affected Versions RUGGEDCOM ROX II versions prior to 2.17.0 Description The RUGGEDCOM ROX II family is affected by an issue where, under certain conditions, IPsec may allow code injection. This could allow an attacker to execute arbitrary code as a root user...
PT-2025-49816
An attacker can use an undocumented UART port on the PCB as a side-channel to get root access e.g. with the credentials obtained from CVE-2025-41692...
PT-2025-49828
Name of the Vulnerable Software and Affected Versions RUGGEDCOM ROX II versions prior to 2.17.0 Description A flaw exists in the RUGGEDCOM ROX II family that could allow an attacker to gain root access on the affected system. This is due to inadequate validation when installing and loading certai...
PT-2025-49826
Name of the Vulnerable Software and Affected Versions RUGGEDCOM ROX II versions prior to 2.17.0 Description A code injection issue exists in the DHCP Server configuration file of RUGGEDCOM ROX II devices. Successful exploitation could allow an attacker to execute arbitrary code, potentially gaini...
PT-2025-49830
Name of the Vulnerable Software and Affected Versions RUGGEDCOM ROX II versions prior to 2.17.0 Description A code injection issue exists in RUGGEDCOM ROX II devices. This occurs when the device is utilizing VRF Virtual Routing and Forwarding. Successful exploitation allows an attacker to execute...
Siemens RUGGEDCOM ROX II 命令注入漏洞
Siemens RUGGEDCOM ROX II is an operating system for industrial applications from Siemens, Germany. Siemens RUGGEDCOM ROX II suffers from a command injection vulnerability that is caused by a flaw in the dynamic DNS configuration process. An attacker can exploit the vulnerability to execute...
PT-2025-49827
Name of the Vulnerable Software and Affected Versions RUGGEDCOM ROX II versions prior to 2.17.0 Description A flaw exists in the RUGGEDCOM ROX II family that allows for the injection of additional configuration parameters during Dynamic DNS configuration. An attacker could potentially exploit thi...
Phoenix Contact FL SWITCH 安全漏洞
The PHOENIX CONTACT FL SWITCH is an industrial grade Ethernet switch from PHOENIX CONTACT, Germany. A security vulnerability exists in Phoenix Contact FL SWITCH versions prior to 3.50, which originates from an undocumented UART port and could result in gaining root access...
CVE-2025-65363
Authenticated append-style command-injection Ruijie APs APRGOS 11.1.x allows an authenticated web user to execute appended shell expressions as root, enabling file disclosure, device disruption, and potential network pivoting via the command parameter to the webaction.do endpoint...
PT-2025-49570
Name of the Vulnerable Software and Affected Versions Ruijie APs versions 11.1.x Description An authenticated user with web access can inject shell commands on Ruijie APs. This allows execution of appended shell expressions as root through the command parameter in the ''web action.do'' endpoint...
CVE-2025-65363
Authenticated append-style command-injection Ruijie APs APRGOS 11.1.x allows an authenticated web user to execute appended shell expressions as root, enabling file disclosure, device disruption, and potential network pivoting via the command parameter to the webaction.do endpoint...
SUSE CVE-2025-12744
A flaw was found in the ABRT daemon's handling of user-supplied mount information.ABRT copies up to 12 characters from an untrusted input and places them directly into a shell command docker inspect %s without proper validation. An unprivileged local user can craft a payload that injects shell...
CVE-2025-45311
Insecure permissions in fail2ban-client v0.11.2 allows attackers with limited sudo privileges to perform arbitrary operations as root. NOTE: this is disputed by multiple parties because the action for a triggered rule can legitimately be an arbitrary operation as root. Thus, the software is...
CVE-2025-66431
WebPros Plesk before 18.0.73.5 and 18.0.74 before 18.0.74.2 on Linux allows remote authenticated users to execute arbitrary code as root via domain creation. The attacker needs "Create and manage sites" with "Domains management" and "Subdomains management."...
CVE-2025-54304
An issue was discovered on Thermo Fisher Ion Torrent OneTouch 2 INS1005527 devices. When they are powered on, an X11 display server is started. The display server listens on all network interfaces and is accessible over port 6000. The X11 access control list, by default, allows connections from...
Dell PowerScale OneFS 8.2.2 <= 9.4.0.17 / 9.5.0 <= 9.5.0.8 / 9.6.0.0 <= 9.7.0.3 / 9.8.0.0 < 9.8.0.1 Privilege Management (DSA-2024-255)
The Dell PowerScale OneFS on the remote device is missing a security patch and is, therefore, affected by privilege management vulnerability: - Dell PowerScale OneFS versions 8.2.2.x through 9.8.0.0 contain an improper privilege management vulnerability. A local high privileged attacker could...
Dell PowerScale OneFS 8.2.2 <= 9.5.0.8 / 9.6.0 <= 9.7.0.3 / 9.8.0.0 < 9.8.0.1 Multiple Vulnerabilities (DSA-2024-255)
The Dell PowerScale OneFS on the remote device is missing a security patch and is, therefore, affected by Multiple Vulnerabilies as follows: - Dell PowerScale OneFS versions 8.2.2.x through 9.8.0.0 contain an improper privilege management vulnerability. A local high privileged attacker could...
Dell PowerScale OneFS 8.2.2 <= 9.7.0.3 / 9.8.0.0 < 9.8.0.1 Improper Privilege Management (DSA-2024-255)
The Dell PowerScale OneFS on the remote device is missing a security patch and is, therefore, affected by improper privilege management vulnerability. - Dell PowerScale OneFS versions 8.2.2.x through 9.8.0.0 contain an improper privilege management vulnerability. A local high privileged attacker...
