CVE-2023-46321

iTermSessionLauncher.m in iTerm2 before 3.5.0beta12 does not sanitize paths in x-man-page URLs. They may have shell metacharacters for a /usr/bin/man command line...

CVE-2023-46321

iTermSessionLauncher.m in iTerm2 before 3.5.0beta12 does not sanitize paths in x-man-page URLs. They may have shell metacharacters for a /usr/bin/man command line...

CVE-2023-45852

In Vitogate 300 2.1.3.0, /cgi-bin/vitogate.cgi allows an unauthenticated attacker to bypass authentication and execute arbitrary commands via shell metacharacters in the ipaddr params JSON data for the put method...

Authentication flaw

In Vitogate 300 2.1.3.0, /cgi-bin/vitogate.cgi allows an unauthenticated attacker to bypass authentication and execute arbitrary commands via shell metacharacters in the ipaddr params JSON data for the put method...

CVE-2023-45852

In Vitogate 300 2.1.3.0, /cgi-bin/vitogate.cgi allows an unauthenticated attacker to bypass authentication and execute arbitrary commands via shell metacharacters in the ipaddr params JSON data for the put method...

VulnCheck KEV: CVE-2021-36380

Sunhillo SureLine contains an OS command injection vulnerability that allows an attacker to cause a denial-of-service or utilize the device for persistence on the network via shell metacharacters in ipAddr or dnsAddr in /cgi/networkDiag.cgi...

CVE-2023-28614

Freewill iFIS aka SMART Trade 20.01.01.04 allows OS Command Injection via shell metacharacters to a report page...

PT-2023-21848 · Unknown · Freewill Ifis

Name of the Vulnerable Software and Affected Versions: Freewill iFIS aka SMART Trade version 20.01.01.04 Description: The issue allows OS Command Injection via shell metacharacters to a report page. Recommendations: For Freewill iFIS aka SMART Trade version 20.01.01.04, consider restricting acces...

CVE-2023-28614

Freewill iFIS aka SMART Trade 20.01.01.04 allows OS Command Injection via shell metacharacters to a report page...

CVE-2023-28614

Freewill iFIS aka SMART Trade 20.01.01.04 allows OS Command Injection via shell metacharacters to a report page...

Oracle Linux 5 : lftp (ELSA-2009-1278)

The remote Oracle Linux 5 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2009-1278 advisory. - Resolves: 239334 solves CVE-2007-2348 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus...

CVE-2022-24989

TerraMaster NAS through 4.2.30 allows remote WAN attackers to execute arbitrary code as root via the raidtype and diskstring parameters for PHP Object Instantiation to the api.php?mobile/createRaid URI. Shell metacharacters can be placed in raidtype because popen is used without any sanitization...

OS Command Injection

emacs is vulnerable to OS Command Injection. The vulnerability allows a malicious attacker to execute arbitrary commands through a file or directory name which contains shell metacharacters...

Moxa AWK-3121 Improper Neutralization of Special Elements Used in a Command (CVE-2018-10702)

An issue was discovered on Moxa AWK-3121 1.14 devices. It provides functionality so that an administrator can run scripts on the device to troubleshoot any issues. However, the same functionality allows an attacker to execute commands on the device. The POST parameter iwfilename is susceptible to...

Moxa AWK-3121 Improper Neutralization of Special Elements Used in a Command (CVE-2018-10699)

An issue was discovered on Moxa AWK-3121 1.14 devices. The Moxa AWK 3121 provides certfile upload functionality so that an administrator can upload a certificate file used for connecting to the wireless network. However, the same functionality allows an attacker to execute commands on the device...

Moxa AWK-3121 Improper Neutralization of Special Elements Used in a Command (CVE-2018-10697)

An issue was discovered on Moxa AWK-3121 1.14 devices. The Moxa AWK 3121 provides ping functionality so that an administrator can execute ICMP calls to check if the network is working correctly. However, the same functionality allows an attacker to execute commands on the device. The POST paramet...

EulerOS Virtualization 2.10.1 : emacs (EulerOS-SA-2023-2461)

According to the versions of the emacs package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because...

CVE-2023-38378

The web interface on the RIGOL MSO5000 digital oscilloscope with firmware 00.01.03.00.03 allows remote attackers to execute arbitrary code via shell metacharacters in pass1 to the webcontrol changepwd.cgi application...

CVE-2023-38378

The web interface on the RIGOL MSO5000 digital oscilloscope with firmware 00.01.03.00.03 allows remote attackers to execute arbitrary code via shell metacharacters in pass1 to the webcontrol changepwd.cgi application...

PT-2023-26389 · Rigol · Rigol Mso5000

Name of the Vulnerable Software and Affected Versions: RIGOL MSO5000 digital oscilloscope version 00.01.03.00.03 Description: The issue allows remote attackers to execute arbitrary code via shell metacharacters in pass1 to the "webcontrol changepwd.cgi" application. This is a problem with the web...