Command injection

A CWE-78: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability exists that allows a local privilege escalation on the appliance when a maliciously crafted Operating System command is entered on the device. Affected products: StruxureWare Data Cent...

CVE-2023-25555

A CWE-78: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability exists that could allow a user that knows the credentials to execute unprivileged shell commands on the appliance over SSH. Affected products: StruxureWare Data Center Expert V7.9.2 an...

CVE-2023-25554

A CWE-78: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability exists that allows a local privilege escalation on the appliance when a maliciously crafted Operating System command is entered on the device. Affected products: StruxureWare Data Cent...

The vulnerability of the closed software environment of the Cisco Identity Services Engine allows a perpetrator to increase their privileges.

The vulnerability of the closed software environment of the Cisco Identity Services Engine exists due to the lack of measures taken to neutralize special elements used in the operating system command set. Exploiting this vulnerability can allow attackers to enhance their privileges...

Python 输入验证错误漏洞

Python is an open source, object-oriented programming language from the Python Foundation. The language is extensible, supports modules and packages, and supports multiple platforms. An input validation error vulnerability exists in Python versions prior to 2.7.18, and versions 3.x through 3.11,...

CVE-2023-27043

The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is...

CVE-2023-27043

The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is...

CVE-2023-1873

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Faturamatik Bircard allows SQL Injection. This issue affects Bircard: before 23.04.05...

The vulnerability of the curl command-line utility relates to its inability to clean up special elements in another plane, allowing a malicious actor to execute arbitrary code within the system.

The vulnerability of the curl command-line utility is related to data exchange using the TELNET protocol. This allows a malicious individual to send a specially created username and “telnet parameters” during server authentication. Exploiting this vulnerability enables a remote attacker to send...

CVE-2023-29132

Irssi 1.3.x and 1.4.x before 1.4.4 has a use-after-free because of use of a stale special collector reference. This occurs when printing of a non-formatted line is concurrent with printing of a formatted line...

FortiWeb & FortiADC - OS command injection in CLI

An improper neutralization of special elements used in an OS command vulnerability CWE-78 in the command line interpreter of FortiWeb & FortiADC may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments to existing commands...

Siemens SICAM A8000 命令注入漏洞

The Siemens SICAM A8000 is a protection and interval control unit device for relay protection and substation environments from Siemens, Germany. A command injection vulnerability exists in the Siemens SICAM A8000. The vulnerability stems from the device's failure to properly filter constructed...

Ubuntu 22.10 : Irssi vulnerability (USN-6002-1)

The remote Ubuntu 22.10 host has packages installed that are affected by a vulnerability as referenced in the USN-6002-1 advisory. It was discovered that Irssi incorrectly handled certain internal routines. An attacker could possibly use this issue to cause a crash. Tenable has extracted the...

The vulnerability of TOTOLINK A7100RU router’s microprogramming software, related to the lack of measures to neutralize special elements, allows a intruder to execute arbitrary commands.

The vulnerability of TOTOLINK A7100RU router microprogramming software is related to the lack of measures taken to neutralize special elements used in the OS’s commands when processing parameters in the /setting/setWanIeCfg directory. Exploiting this vulnerability allows a remote attacker to...

CVE-2023-1758

Failure to Sanitize Special Elements into a Different Plane Special Element Injection in GitHub repository thorsten/phpmyfaq prior to 3.1.12...

Design/Logic Flaw

Failure to Sanitize Special Elements into a Different Plane Special Element Injection in GitHub repository thorsten/phpmyfaq prior to 3.1.12...

CVE-2023-1758 Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in thorsten/phpmyfaq

Failure to Sanitize Special Elements into a Different Plane Special Element Injection in GitHub repository thorsten/phpmyfaq prior to 3.1.12...

CVE-2023-1758 Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in thorsten/phpmyfaq

Failure to Sanitize Special Elements into a Different Plane Special Element Injection in GitHub repository thorsten/phpmyfaq prior to 3.1.12...

CVE-2023-1758

CVE-2023-1758 affects thorsten/phpmyfaq (phpMyFAQ) prior to version 3.1.12. The issue is a failure to sanitize special elements into a different plane, which enables stored cross-site scripting (XSS) via the FAQ comment username parameter. The vulnerability is documented by multiple sources (GitH...

CVE-2022-43769 Hitachi Vantara Pentaho Business Analytics Server - Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)

Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x allow certain web services to set property values which contain Spring templates that are interpreted downstream...