The software platform for container deployment in the SUSE Rancher production environment is vulnerable. This vulnerability stems from the failure to address the need to neutralize certain special elements used in the operating system command set. This allows attackers to execute arbitrary commands.

The vulnerability of the software platform for container deployment in the SUSE Rancher wrangler production environment exists due to the lack of measures taken to neutralize special elements used in the operating system command set. Exploiting this vulnerability allows a remote attacker to execu...

pdf_info 安全漏洞

pdfinfo is a package pdfinfo command line tool by tomtaylor personal developer. A security vulnerability exists in pdfinfo version 0.5.3, which can be exploited by an attacker to execute operating system commands using a command chain...

Cisco Email Security Appliance Arbitrary Code Execution (cisco-sa-esa-sma-privesc-9DVkFpJ8)

According to its self-reported version, Cisco Email Security Appliance is affected by vulnerability in the CLI of Cisco ESA could allow an authenticated, local attacker to execute arbitrary commands on an affected device. This vulnerability is due to improper input validation in the CLI. An...

K05403841: BIG-IP and BIG-IQ improvements disclosed by Rapid7

Security Advisory Description BIG-IP and BIG-IQ improvements disclosed by Rapid7 Important : F5 recognizes these issues are security related. However, there is no known way to exploit these issues without first bypassing existing security controls using an unknown or undiscovered mechanism,...

K06024431: BIG-IQ vulnerability CVE-2021-23024

Security Advisory Description The BIG-IQ Configuration utility has an authenticated remote command execution vulnerability in undisclosed pages. CVE-2021-23024 Impact This vulnerability allows an authenticated admin user or a user account assigned with an administrator role and no shell access to...

K61002104: BIG-IP AFM and PEM TMUI XSS vulnerability CVE-2019-6639

Security Advisory Description Undisclosed TMUI pages for AFM and PEM Subscriber management are vulnerable to a stored cross-site scripting XSS issue. This is a control plane issue only and is not accessible from the data plane. The attack requires a malicious resource administrator to store the...

K55580033: iControl REST vulnerability CVE-2022-35728

Security Advisory Description An authenticated user's iControl REST token may remain valid for a limited time after logging out from the Configuration utility. CVE-2022-35728 Impact A remote unauthenticated attacker may be able to reuse, for a limited time, an authenticated user's iControl REST...

K03009991: iControl REST unauthenticated remote command execution vulnerability CVE-2021-22986

Security Advisory Description The iControl REST interface has an unauthenticated remote command execution vulnerability. CVE-2021-22986 Impact This vulnerability allows for unauthenticated attackers with network access to the iControl REST interface, through the BIG-IP management interface and se...

K15399: Usermin remote vulnerability CVE-2014-3883

Security Advisory Description Description Usermin before 1.600 allows remote attackers to execute arbitrary operating-system commands via unspecified vectors related to a user action. CVE-2014-3883 Impact None. No F5 products are vulnerable to this vulnerability. Status F5 Product Development has...

K21540525: F5 TMUI XSS vulnerability CVE-2020-5945

Security Advisory Description Undisclosed TMUI page contains a stored cross site scripting vulnerability XSS. The issue allows a minor privilege escalation for resource admin to escalate to full admin. CVE-2020-5945 Impact A malicious, authenticated user with Resource Administrator privileges may...

K57555833: BIG-IP APM vulnerability CVE-2022-27634

Security Advisory Description BIG-IP APM does not properly validate configurations, allowing an authenticated attacker with high privileges to manipulate the APM policy leading to privilege escalation/remote code execution. CVE-2022-27634 Impact This vulnerability may allow an authenticated...

The vulnerability of the Nagios XI monitoring tool’s script /usr/local/nagiosxi/html/includes/configwizards/windowswmi/windowswmi.inc.php allows a attacker to execute arbitrary commands.

The vulnerability of the Nagios XI monitoring tool’s script located at /usr/local/nagiosxi/html/includes/configwizards/windowswmi/windowswmi.inc.php is related to the failure to take measures to neutralize special elements used in operating system commands. Exploiting this vulnerability allows a...

The vulnerability of the command-line interface (CLI) implementation of Zyxel networking devices allows a perpetrator to execute arbitrary commands.

The vulnerability of CLI implementations for Zyxel network devices involves a lack of measures to neutralize special elements used in OS commands. Exploiting this vulnerability allows an attacker to execute arbitrary commands remotely...

CVE-2023-20075

Vulnerability in the CLI of Cisco Secure Email Gateway could allow an authenticated, remote attacker to execute arbitrary commands. These vulnerability is due to improper input validation in the CLI. An attacker could exploit this vulnerability by injecting operating system commands into a...

SUSE CVE-2020-1946

In Apache SpamAssassin before 3.4.5, malicious rule configuration .cf files can be configured to run system commands without any output or errors. With this, exploits can be injected in a number of scenarios. In addition to upgrading to SA version 3.4.5, users should only use update channels or 3...

PT-2023-2971 · Cisco · Cisco Secure Email Gateway

Name of the Vulnerable Software and Affected Versions: Cisco Secure Email Gateway affected versions not specified Description: The issue is due to improper input validation in the CLI, allowing an authenticated, remote attacker to execute arbitrary commands by injecting operating system commands...

The vulnerability of the lib/ajaxHandlers/ajaxAddTemplate.php component, a utility for managing network device configurations using the rConfig protocol, allows a attacker to execute arbitrary operating system commands.

The vulnerability of the lib/ajaxHandlers/ajaxAddTemplate.php utility, which is used to manage network device configurations in the rConfig framework, exists because special elements used in the operating system command are not properly eliminated. Exploiting this vulnerability allows a malicious...

Wago PFC200 Cloud Connectivity Multiple Command Injection (CVE-2019-5155)

An exploitable command injection vulnerability exists in the cloud connectivity feature of WAGO PFC200. An attacker can inject operating system commands into any of the parameter values contained in the firmware update command. This affects WAGO PFC200 Firmware version 03.02.0214, version...

Exploit for Server-Side Request Forgery in F5 Big-Ip_Access_Policy_Manager

CVE-2021-22986 This vulnerability allows for unauthenticated...

The vulnerability of InHand Networks InRouter302’s microprogramming software arises from the failure to take measures to neutralize the special elements used in the operating system command set. This vulnerability allows a perpetrator to execute arbitrary commands.

The vulnerability of InHand Networks InRouter302 microprogramming software exists due to the lack of measures taken to neutralize the special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...