21 matches found
CVE-2019-16941
CVE-2019-16941 Proof-of-Concept: The vulnerability requires multiple and relatively improbable conditions in order to get triggered, fact that limits its exploitability. However, it takes little effort and understanding to prepare a payload given the fact that it can result into an arbitrary code...
CVE-2021-25646
Apache Druid RCE title="druid" && title=="Apache Druid" POST /druid/indexer/v1/sampler?for=filter HTTP/1.1 Host: x.x.x.x:8888 Content-Length: 612 Accept: application/json, text/plain, / Origin: http://x.x.x.x:8888 User-Agent: Mozilla/5.0 Windows NT 10.0; WOW64 AppleWebKit/537.36 KHTML, like Gecko...
EUVD-2026-51813
ArcadeDB before 26.7.2 arcadedb-engine allows trigger scripts to look up host classes in java.lang. via Java.type because ScriptTriggerExecutor adds java.lang. to the allowed packages. An authenticated user with UPDATESCHEMA permission can create a JavaScript trigger that invokes...
CVE-2026-67208
Juggle through 1.6.0 contains a remote code execution vulnerability that allows unauthenticated remote attackers to execute arbitrary OS commands by connecting to the exposed H2 database web console using default shipped credentials. Attackers can access the unprotected /h2-console endpoint,...
EUVD-2026-51278
Juggle through 1.6.0 contains a remote code execution vulnerability that allows unauthenticated remote attackers to execute arbitrary OS commands by connecting to the exposed H2 database web console using default shipped credentials. Attackers can access the unprotected /h2-console endpoint,...
PT-2026-66572
Juggle through 1.6.0 contains a remote code execution vulnerability that allows unauthenticated remote attackers to execute arbitrary OS commands by connecting to the exposed H2 database web console using default shipped credentials. Attackers can access the unprotected /h2-console endpoint,...
PT-2026-67320
Name of the Vulnerable Software and Affected Versions ArcadeDB versions prior to 26.7.2 Description An issue exists in the arcadedb-engine where trigger scripts can look up host classes in java.lang. via Java.type because the ScriptTriggerExecutor includes java.lang. in the allowed packages. An...
CVE-2026-49185 Instruction Injection via FieldX MDM
The FieldX MDM adb messaging topic passes unverified payloads directly into Runtime.exec, allowing command/instruction injection...
Acer M6E 安全漏洞
The Acer M6E is a portable 5G mobile hotspot device from Acer, a company based in Taiwan, China. The Acer M6E has a security vulnerability, which stems from the FieldX MDM adb messaging topic directly passing unvalidated payloads to Runtime.exec, potentially leading to command injection...
PT-2026-46140
Name of the Vulnerable Software and Affected Versions FieldX MDM affected versions not specified Description The adb messaging topic passes unverified payloads directly into the Runtime.exec function, which enables command or instruction injection. Recommendations At the moment, there is no...
CVE-2026-9437
A vulnerability has been found in DTStack Taier 1.4.0. This affects the function Runtime.exec of the component REST API. The manipulation of the argument sqlText leads to os command injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may ...
CVE-2026-9437
DTStack Taier 1.4.0 REST API Runtime.exec is affected. The vulnerability arises from manipulation of the sqlText argument, enabling OS command injection that could be exploited remotely. Exploit information is publicly disclosed; no remediation details are provided in the documents. The connected...
CVE-2026-9437
A vulnerability has been found in DTStack Taier 1.4.0. This affects the function Runtime.exec of the component REST API. The manipulation of the argument sqlText leads to os command injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may ...
Arbitrary Code Injection
Overview org.apache.activemq:activemq-all is a package that puts together an ActiveMQ jar bundle. Affected versions of this package are vulnerable to Arbitrary Code Injection over the /api/jolokia MBeans interface. A user can execute arbitrary code on the broker's JVM by invoking operations with ...
CVE-2026-34197
Improper Input Validation, Improper Control of Generation of Code 'Code Injection' vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ. Apache ActiveMQ Classic exposes the Jolokia JMX-HTTP bridge at /api/jolokia/ on the web console. The default Jolokia access policy permits exec operations o...
Komm.One CMS Security Vulnerability
Komm.One CMS is a customer service management software from the German company Komm.One. A security vulnerability exists in Komm.One CMS version 10.4.2.14 that originates from a vulnerability that could allow a remote attacker to execute arbitrary code by specifying a URL for java.lang.Runtime in...
DEBIAN-CVE-2023-36479
Eclipse Jetty Canonical Repository is the canonical repository for the Jetty project. Users of the CgiServlet with a very specific command structure may have the wrong command executed. If a user sends a request to a org.eclipse.jetty.servlets.CGI Servlet for a binary with a space in its name, th...
UBUNTU-CVE-2023-36479
Eclipse Jetty Canonical Repository is the canonical repository for the Jetty project. Users of the CgiServlet with a very specific command structure may have the wrong command executed. If a user sends a request to a org.eclipse.jetty.servlets.CGI Servlet for a binary with a space in its name, th...
VulnCheck KEV: CVE-2023-35042
GeoServer 2, in some configurations, allows remote attackers to execute arbitrary code via java.lang.Runtime.getRuntime.exec in wps:LiteralData within a wps:Execute request, as exploited in the wild in June 2023. NOTE: the vendor states that they are unable to reproduce this in any version...
CVE-2019-25022
An issue was discovered in Scytl sVote 2.1. An attacker can inject code that gets executed by creating an election-event and injecting a payload over an event alias, because the application calls Runtime.getRuntime.exec without validation...