2643 matches found
CVE-2024-31161 ASUS Download Master - Arbitrary File Upload
The upload functionality of ASUS Download Master does not properly filter user input. Remote attackers with administrative privilege can exploit this vulnerability to upload any file to any location. They may even upload malicious web page files to the website directory, allowing arbitrary system...
CVE-2024-31161 ASUS Download Master - Arbitrary File Upload
The upload functionality of ASUS Download Master does not properly filter user input. Remote attackers with administrative privilege can exploit this vulnerability to upload any file to any location. They may even upload malicious web page files to the website directory, allowing arbitrary system...
The vulnerability of the microprogrammed software for Zyxel NAS326 and Zyxel NAS542 lies in the lack of measures taken to neutralize special elements used in the operating system’s command set. This allows attackers to execute arbitrary commands.
The vulnerability of the microprogrammed software for Zyxel NAS326 and Zyxel NAS542 lies in the lack of measures taken to neutralize the special elements used in the operating system commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands by sending a...
CVE-2024-4696
A privilege escalation vulnerability was reported in Lenovo Service Bridge prior to version 5.0.2.17 that could allow operating system commands to be executed if a specially crafted link is visited...
CVE-2024-4696
A privilege escalation vulnerability was reported in Lenovo Service Bridge prior to version 5.0.2.17 that could allow operating system commands to be executed if a specially crafted link is visited...
CVE-2024-4696
A privilege escalation vulnerability was reported in Lenovo Service Bridge prior to version 5.0.2.17 that could allow operating system commands to be executed if a specially crafted link is visited...
CVE-2024-4696
CVE-2024-4696 affects Lenovo Service Bridge before version 5.0.2.17. The issue is a command-injection/privilege-escalation flaw in the LscShim module: parsing a crafted URL does not properly validate input, allowing arbitrary code execution in the context of the current user after user interactio...
PT-2024-26892 · Unknown · Wrc-X5400Gsa-B
Name of the Vulnerable Software and Affected Versions: WRC-X5400GS-B versions 1.0.10 and earlier WRC-X5400GSA-B versions 1.0.10 and earlier Description: The issue allows a network-adjacent attacker with administrative privilege to execute arbitrary OS commands by sending a specially crafted reque...
CVE-2024-35306
CVE-2024-35306 describes an OS command injection in Pandora FMS’ Ajax PHP files via HTTP requests, affecting Pandora FMS versions 700–776 (up to but not including 777). Root cause is insufficient sanitization of input variables, enabling an attacker to execute system commands. Impact is potential...
Exploit for Command Injection in Telesquare Tlr-2005Ksh_Firmware
Installation et Exécution du script 💻 Prérequis Avant de...
Exploit for Command Injection in Telesquare Tlr-2005Ksh_Firmware
Installation et Exécution du script 💻 Prérequis Avant de...
The vulnerability of the PHP programming language interpreter arises from the lack of measures taken to eliminate special elements used in operating system commands, allowing attackers to execute arbitrary code.
The vulnerability of the PHP programming language interpreter exists because measures to neutralize the special elements used in operating system commands have not been taken. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending a specially crafted HTTP...
SUSE CVE-2019-9193
In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pgexecuteserverprogram' group to execute arbitrary code in the context of the database's operating system user. This functionality is enabled by default and can be abused to run arbitrary...
CVE-2024-29973
UNSUPPORTED WHEN ASSIGNED The command injection vulnerability in the “setCookie” parameter in Zyxel NAS326 firmware versions before V5.21AAZF.17C0 and NAS542 firmware versions before V5.21ABAG.14C0 could allow an unauthenticated attacker to execute some operating system OS commands by sending a...
CVE-2024-29972
UNSUPPORTED WHEN ASSIGNED The command injection vulnerability in the CGI program "remotehelp-cgi" in Zyxel NAS326 firmware versions before V5.21AAZF.17C0 and NAS542 firmware versions before V5.21ABAG.14C0 could allow an unauthenticated attacker to execute some operating system OS commands by...
CVE-2024-29975
UNSUPPORTED WHEN ASSIGNED The improper privilege management vulnerability in the SUID executable binary in Zyxel NAS326 firmware versions before V5.21AAZF.17C0 and NAS542 firmware versions before V5.21ABAG.14C0 could allow an authenticated local attacker with administrator privileges to execute...
CVE-2024-29972
UNSUPPORTED WHEN ASSIGNED The command injection vulnerability in the CGI program "remotehelp-cgi" in Zyxel NAS326 firmware versions before V5.21AAZF.17C0 and NAS542 firmware versions before V5.21ABAG.14C0 could allow an unauthenticated attacker to execute some operating system OS commands by...
The system’s vulnerability for testing and training SAP IDES arises from the lack of measures taken to neutralize special elements used in the operating system command set. This allows a perpetrator to execute arbitrary code.
The vulnerability of the SAP IDES system for testing and training exists due to the lack of measures taken to neutralize special elements used in the operating system’s command set. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...
RHEL 7 : spamassassin (Unpatched Vulnerability)
The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - spamassassin: Malicious rule configuration files can be configured to run system commands CVE-2020-1946 -...
