openNDS Security Vulnerabilities

openNDS is openNDS open source a high-performance, small footprint portal system. A security vulnerability exists in openNDS prior to version 10.1.3 that stems from an inability to clean up a network interface name entry in a configuration file, allowing an attacker with direct or indirect access...

PT-2024-12709 · Opennds +1 · Opennds +1

Name of the Vulnerable Software and Affected Versions: OpenNDS versions prior to 10.1.3 Description: An issue was discovered in OpenNDS where it fails to sanitize the gateway FQDN entry in the configuration file. This allows attackers with direct or indirect access to the configuration file to...

The vulnerability of the Atril document viewing program relates to the possibility of inserting commands that allow a hacker to execute arbitrary code.

The vulnerability of the Atril application for viewing multi-page documents is related to improper elimination of special elements used in the OS command. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the Network Diagnostic Commands function in the microprogramming software of the SmartNode SN200 adapter allows a perpetrator to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the Network Diagnostic Commands function in the microprogramming software of the SmartNode SN200 adapter lies in the lack of measures taken to neutralize the special elements used in the operating system commands. Exploiting this vulnerability can allow a remote attacker to...

CVE-2023-5080

A privilege escalation vulnerability was reported in some Lenovo tablet products that could allow local applications access to device identifiers and system commands...

Privilege escalation

A privilege escalation vulnerability was reported in some Lenovo tablet products that could allow local applications access to device identifiers and system commands...

CVE-2023-5080

A privilege escalation vulnerability was reported in some Lenovo tablet products that could allow local applications access to device identifiers and system commands...

Lenovo Tablet Security Breach

Lenovo Tablet is a series of tablet computers from the Chinese company Lenovo. A security vulnerability exists in Lenovo Tablet, which stems from a privilege escalation vulnerability. The vulnerability could allow a local application to access device identifiers and system commands...

CVE-2023-42136

PAX Android based POS devices with PayDroid8.1.0SagittariusV11.1.5020230614 or earlier can allow the execution of arbitrary commands with system account privilege by shell injection starting with a specific word. The attacker must have shell access to the device in order to exploit this...

PT-2024-19047 · Tp Link · Tp-Link

Name of the Vulnerable Software and Affected Versions: TP-LINK products affected versions not specified Description: The issue allows a network-adjacent unauthenticated attacker with access to the product from the LAN port or Wi-Fi to execute arbitrary OS commands on the product that has...

PT-2024-1069 · Tp Link · Tp-Link Archer Ax5400 +2

Name of the Vulnerable Software and Affected Versions: TP-Link Archer AX3000 versions TP-Link Archer AX5400 versions TP-Link Archer AXE75 versions Description: The issue exists due to the lack of measures to neutralize special elements used in the operating system command. This allows a...

PT-2024-1559 · Lenovo · Lenovo Tablet

Name of the Vulnerable Software and Affected Versions: Lenovo tablet products affected versions not specified Description: A privilege escalation issue is present in some Lenovo tablet products, related to insecure privilege management. This could allow a local application to access device...

SAP Application Interface Framework Code Injection Vulnerability

SAP Application Interface Framework SAP AIF is an application interface framework from SAP. A code injection vulnerability exists in the SAP Application Interface Framework File Adapter, which can be exploited to allow an elevated privilege user to traverse layers and directly execute operating...

CVE-2023-29048

A component for parsing OXMF templates could be abused to execute arbitrary system commands that would be executed as the non-privileged runtime user. Users and attackers could run system commands with limited privilege to gain unauthorized access to confidential information and potentially viola...

Design/Logic Flaw

A component for parsing OXMF templates could be abused to execute arbitrary system commands that would be executed as the non-privileged runtime user. Users and attackers could run system commands with limited privilege to gain unauthorized access to confidential information and potentially viola...

CVE-2023-29048

A component for parsing OXMF templates could be abused to execute arbitrary system commands that would be executed as the non-privileged runtime user. Users and attackers could run system commands with limited privilege to gain unauthorized access to confidential information and potentially viola...

CVE-2023-29048

Open-Xchange App Suite (backend) is affected by CVE-2023-29048, impacting the Open-Xchange App Suite v7.10.x line (example reference cites 7.10.6-rev50). The root cause is a flaw in the OXMF template parser that could be abused to execute arbitrary system commands as the non-privileged runtime us...

CVE-2023-29048

A component for parsing OXMF templates could be abused to execute arbitrary system commands that would be executed as the non-privileged runtime user. Users and attackers could run system commands with limited privilege to gain unauthorized access to confidential information and potentially viola...

CVE-2023-29048

A component for parsing OXMF templates could be abused to execute arbitrary system commands that would be executed as the non-privileged runtime user. Users and attackers could run system commands with limited privilege to gain unauthorized access to confidential information and potentially viola...

FESTO Hardware Controller, Hardware Servo Press Kit Improper Neutralization of Special Elements Used in an OS Command (CVE-2022-30311)

In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint cecc-x-refresh-request POST request doesn't check for port syntax. This can result in unauthorized execution of system commands with root privileges due to improper access control command injection. This plugin...