Design/Logic Flaw

components/Modals/HelpTexts/GenericAll/GenericAll.jsx in Bloodhound = 4.0.1 allows remote attackers to execute arbitrary system commands when the victim imports a malicious data file containing JavaScript in the objectId parameter...

CVE-2021-3210

components/Modals/HelpTexts/GenericAll/GenericAll.jsx in Bloodhound = 4.0.1 allows remote attackers to execute arbitrary system commands when the victim imports a malicious data file containing JavaScript in the objectId parameter...

Alfresco Software Alfresco Enterprise and Alfresco Injection Vulnerabilities

Alfresco Software Alfresco Enterprise is the enterprise version of an enterprise content management system from Alfresco Software. The system includes document management, office collaboration, etc. Alfresco is an open source enterprise content management system. The platform page using Freemarke...

PT-2021-9474 · Alfresco · Alfresco Enterprise Content Management

Name of the Vulnerable Software and Affected Versions: Alfresco Enterprise Content Management ECM versions prior to 6.2.1 Description: An issue was discovered that allows a user with privileges to edit a FreeMarker template to execute arbitrary Java code or run arbitrary system commands with the...

Systeminformation Operating System Command Injection Vulnerability

An operating system command injection vulnerability exists in Systeminformation, which arises when a network system or product fails to properly filter special characters, commands, etc., during the construction of executable operating system commands from externally input data. An attacker could...

MGASA-2021-0074 Updated phppgadmin package fixes a security vulnerability

phppgadmin through 7.12.1 allows sensitive actions to be performed without validating that the request originated from the application. One such area, database.php does not verify the source of an HTTP request. This can be leveraged by a remote attacker to trick a logged-in administrator to visit...

Updated phppgadmin package fixes a security vulnerability

phppgadmin through 7.12.1 allows sensitive actions to be performed without validating that the request originated from the application. One such area, database.php does not verify the source of an HTTP request. This can be leveraged by a remote attacker to trick a logged-in administrator to visit...

Command Execution Vulnerability in SEACMS (CNVD-2021-15534)

SEACMS is a video-on-demand system designed for webmasters with different needs. SEACMS suffers from a command execution vulnerability, which can be exploited by attackers to inject malicious code, execute system commands, and gain system privileges...

DEBIAN-CVE-2021-21289

Mechanize is an open-source ruby library that makes automated web interaction easy. In Mechanize from version 2.0.0 and before version 2.7.7 there is a command injection vulnerability. Affected versions of mechanize allow for OS commands to be injected using several classes' methods which...

CVE-2021-25310

CVE-2021-25310 affects Belkin Linksys WRT160NL devices (firmware 1.0.04.002_US_20130619). The issue is a command-injection vulnerability in the admin web interface: remote authenticated attackers can inject shell commands via shell metacharacters in the ui_language POST parameter sent to apply.cg...

LOGITEC CORPORATION LAN-W300N/PGRB Buffer Overflow Vulnerability

LOGITEC CORPORATION LAN-W300N/PGRB is a wireless router device. LOGITEC CORPORATION LAN-W300N/PGRB is vulnerable to a buffer overflow vulnerability, which can be exploited by attackers to execute arbitrary operating system commands via unspecified vectors...

CentOS 8 : spamassassin (CESA-2020:4625)

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2020:4625 advisory. - spamassassin: crafted configuration files can run system commands without any output or errors CVE-2018-11805 - spamassassin: crafted email message c...

IBM QRadar Code Execution Vulnerability

IBM QRadar is an enterprise security information and event management SIEM product that detects anomalies, finds advanced threats, and eliminates false positives. A code execution vulnerability exists in IBM QRadar 7.4.0 - 7.4.2 Patch 1, 7.3.0 - 7.3.3 Patch 7. The vulnerability stems from unsafe...

LOGITEC CORPORATION LAN-W300N/PGRB 操作系统命令注入漏洞

LOGITEC CORPORATION LAN-W300N/PGRB is a wireless router device. LOGITEC CORPORATION LAN-W300N/PGRB is vulnerable to OS command injection, which can be exploited by attackers to execute arbitrary OS commands via unspecified vectors...

LOGITEC CORPORATION LAN-W300N/PGRB 缓冲区错误漏洞

LOGITEC CORPORATION LAN-W300N/PGRB is a wireless router device. LOGITEC CORPORATION LAN-W300N/PGRB is vulnerable to a buffer overflow vulnerability, which can be exploited by attackers to execute arbitrary operating system commands via unspecified vectors...

Zen Cart 操作系统命令注入漏洞

Zen Cart is an open source, free shopping mall system , used to build a professional online store . A remote code execution vulnerability exists in Zen Cart 1.5.7b. The vulnerability can be exploited by an administrator to execute arbitrary OS commands by inspecting HTML radio input elements and...

DELL EMC Avamar Server Path Traversal Vulnerability (CNVD-2021-05125)

DELL Dell EMC Avamar Server is a suite of fully virtualized backup and recovery software for servers from Dell USA. A path traversal vulnerability exists in DELL EMC Avamar Server versions 19.1, 19.2, and 19.3, which originates from an unauthenticated, remote attacker executing arbitrary operatin...

Cisco Smart Software Manager 操作系统命令注入漏洞

Cisco Smart Software Manager Satellite is software designed to provide intelligent management of licenses. A command injection vulnerability exists in the WEB UI of Cisco Smart Software Manager Satellite 5.1.0 and prior versions. The vulnerability stems from the program not properly validating...

The vulnerability of NETGEAR’s embedded software exists due to the lack of measures taken to neutralize special elements used in the operating system commands. This allows a hacker to execute arbitrary commands.

The vulnerability in NETGEAR’s embedded software exists because measures are not taken to neutralize the special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

Mubu Authorization Issues Vulnerability

Mubu is a platform for online writing from Mubu, a company based in Beijing, China. An authorization issue vulnerability exists in Mubu version 2.2.1, which stems from its failure to strictly limit user privileges and can be exploited by a local attacker to execute system commands...