CVE-2024-7203

CVE-2024-7203 describes a post-authentication command-injection in Zyxel USG FLEX and ATP firmware (versions V4.60–V5.38). An authenticated administrator could execute OS commands on affected devices by sending crafted CLI input. Reported impact in sources includes potential for arbitrary OS comm...

Cambium EPMP 1000 Ping Command Injection

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "Cambium ePMP 1000 'ping' Command Injection up to v2.5", 'Description' = % This module exploits an OS Command Injection vulnerability in Cambium...

CVE-2024-8330

6SHR system from Gether Technology does not properly validate uploaded file types, allowing remote attackers with regular privileges to upload web shell scripts and use them to execute arbitrary system commands on the server...

CVE-2024-8330 Gether Technology 6SHR System - Unrestricted File Upload

6SHR system from Gether Technology does not properly validate uploaded file types, allowing remote attackers with regular privileges to upload web shell scripts and use them to execute arbitrary system commands on the server...

Linksys E1500 Command Injection Vulnerability

The Linksys E1500 is a wireless router from Linksys USA. A command injection vulnerability exists in Linksys E1500 v1.0.06.001, which originates from an application that fails to properly filter construct command special characters, commands, etc. An authenticated attacker can use this...

TOTOLINK X5000r Command Injection Vulnerability

The TOTOLINK X5000r is a wireless router manufactured by TOTOLINK. TOTOLINK X5000r has a command injection vulnerability in version 9.1.0cu.2350b20230313. The vulnerability arises because the setAccessDeviceCfg function within the /cgi-bin/cstecgi.cgi file fails to properly validate or clean up...

Siemens SINEC NMS Elevation of Privilege Vulnerability (CNVD-2024-35426)

SINEC NMS is a new generation network management system for digital enterprises. An elevation of privilege vulnerability exists in Siemens SINEC NMS, which can be exploited by an attacker to execute operating system commands with elevated privileges...

PT-2024-19112 · Envoy · Envoy

Name of the Vulnerable Software and Affected Versions: Envoy versions 4.x through 5.x Description: The issue is related to inadequate encryption strength, allowing an authenticated attacker to execute arbitrary OS commands via encrypted package upload. Recommendations: For Envoy versions 4.x...

The vulnerability of SysAid’s software for supporting and controlling hardware and software systems lies in the lack of measures taken to neutralize special elements used in the operating system commands. This allows attackers to execute arbitrary commands.

The vulnerability of the software used for supporting and controlling hardware and software systems of SysAid is related to the failure to take measures to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrar...

The vulnerability of the lib-src/etags.c file of the EMACS text editor’s etags component allows a hacker to execute arbitrary code.

The vulnerability of the lib-src/etags.c file of the EMACS text editor’s etags component is related to the improper elimination of special elements used in the OS command. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2024-6117

A Unrestricted upload of file with dangerous type vulnerability in meeting management function in Hamastar MeetingHub Paperless Meetings 2021 allows remote authenticated users to perform arbitrary system commands via a crafted ASP file...

CVE-2024-6117

CVE-2024-6117 affects Hamastar MeetingHub Paperless Meetings (version 2021). Multiple connected sources describe an unrestricted upload of files with dangerous types in the meeting management function, enabling remote authenticated users to execute arbitrary system commands via a crafted ASP file...

CVE-2024-6117 Hamastar MeetingHub Paperless Meetings - Unrestricted Upload of File with Dangerous Type

A Unrestricted upload of file with dangerous type vulnerability in meeting management function in Hamastar MeetingHub Paperless Meetings 2021 allows remote authenticated users to perform arbitrary system commands via a crafted ASP file...

The vulnerability of the command-line interface (CLI) of the Junos OS Evolved routers from the PTX Series, ACX Series, and QFX Series allows a attacker to elevate their privileges to the root level.

The vulnerability of the command-line interface CLI of Junos OS Evolved routers from the PTX Series, ACX Series, and QFX Series exists due to the lack of measures taken to neutralize special elements used in operating system commands. Exploiting this vulnerability can allow attackers to elevate...

PT-2024-25648 · Elecom · Elecom Wireless Lan Routers

Name of the Vulnerable Software and Affected Versions: ELECOM wireless LAN routers affected versions not specified Description: The issue allows for the unrestricted upload of files with dangerous types in ELECOM wireless LAN routers. A specially crafted file can be uploaded by a logged-in user...

CVE-2022-4002

A command injection vulnerability could allow an authenticated user to execute operating system commands as root via a specially crafted API request...

CVE-2022-4002

Motorola Q14 Mesh Router firmware vulnerability: a command-injection flaw exists prior to version 1.5.0.16 that could let an authenticated user execute OS commands as root via a crafted API request. The issue affects the Q14 firmware family before the stated fix; exploitation context and in-the-w...

CVE-2022-4002

A command injection vulnerability could allow an authenticated user to execute operating system commands as root via a specially crafted API request...

The vulnerability of the software for processing, transforming, and generating documents using Ghostscript arises from the improper neutralization of special elements used in operating system commands. This allows an attacker to execute arbitrary code.

The vulnerability of the software for processing, transforming, and generating Ghostscript documents is related to the introduction of a specially created pipe command. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary code...

ELECOM WRC-X6000XS-G、WRC-X1500GS-B和WRC-X1500GSA-B 安全漏洞

ELECOM WRC-X6000XS-G and others are a wireless router from ELECOM Japan. A security vulnerability exists in the ELECOM WRC-X6000XS-G, WRC-X1500GS-B, and WRC-X1500GSA-B v1.11 and earlier versions, which stems from the possibility that a logged in user with administrative privileges could send a...