19 matches found
EUVD-2026-76749
A file-transfer interface that requires valid credentials accepts attacker-controlled filenames without restricting shell metacharacters. An automated process later constructs and runs a system command using the uploaded file's name, allowing an authenticated attacker to embed and execute arbitra...
CVE-2026-90444
A file-transfer interface that requires valid credentials accepts attacker-controlled filenames without restricting shell metacharacters. An automated process later constructs and runs a system command using the uploaded file's name, allowing an authenticated attacker to embed and execute arbitra...
CVE-2026-90444 OS Command Injection in Malcolm
A file-transfer interface that requires valid credentials accepts attacker-controlled filenames without restricting shell metacharacters. An automated process later constructs and runs a system command using the uploaded file's name, allowing an authenticated attacker to embed and execute arbitra...
CVE-2026-90444
CVE-2026-90444 describes a shell metacharacter injection vulnerability in a file-transfer interface within an ICS/OT product (per CISA advisory ICSA-26-254-01). The interface requires valid credentials but does not restrict shell metacharacters in uploaded filenames. An automated process later co...
CVE-2026-90444 OS Command Injection in Malcolm
A file-transfer interface that requires valid credentials accepts attacker-controlled filenames without restricting shell metacharacters. An automated process later constructs and runs a system command using the uploaded file's name, allowing an authenticated attacker to embed and execute arbitra...
PT-2026-90512
Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description A file-transfer interface requiring valid credentials fails to restrict shell metacharacters in uploaded filenames. An automated process subsequently uses these...
CVE-2026-90444: Improper Neutralization of Special Elements used in an OS Command
A file-transfer interface that requires valid credentials accepts attacker-controlled filenames without restricting shell metacharacters. An automated process later constructs and runs a system command using the uploaded file's name, allowing an authenticated attacker to embed and execute arbitra...
CVE-2025-15674
Passster (WordPress plugin) before 4.3.7 allows low-privilege users with edit_posts capability to read globally password-protected content via the WordPress REST API when global protection is enabled. Any Contributor or higher can access protected pages/posts without the password. A fix is availa...
PT-2026-31921
An issue was discovered in BMC Control-M/MFT 9.0.20 through 9.0.22. A SQL injection vulnerability in the MFT API's debug interface allows an authenticated attacker to inject malicious queries due to improper input validation and unsafe dynamic SQL handling. Successful exploitation can enable...
BulletProof FTP Server 安全漏洞
BulletProof FTP Server is an FTP server software developed by BulletProof Corporation. Version 2019.0.0.50 of BulletProof FTP Server contains a security vulnerability. This vulnerability stems from a denial-of-service vulnerability in the SMTP configuration interface, which could allow local...
Fleet 安全漏洞
Fleet is Fleet Device Management open source a device management platform that supports a wide range of operating systems and devices to help IT and security teams with device management, vulnerability reporting, MDM and more. An access control error vulnerability exists in Fleet versions prior t...
CVE-2021-30338: Improper Input Validation
Improper input validation in TrustZone memory transfer interface can lead to information disclosure in Snapdragon Compute...
PT-2022-10001
Name of the Vulnerable Software and Affected Versions Snapdragon Compute affected versions not specified Description The issue is related to improper input validation in the TrustZone memory transfer interface, which can result in information disclosure. Recommendations At the moment, there is no...
CVE-2021-30278
Improper input validation in TrustZone memory transfer interface can lead to information disclosure in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking...
Cisco Data Center Network Manager Trust Management Issue Vulnerability
Cisco Data Center Network Manager DCNM is a data center management system from Cisco. The system works with Cisco Nexus and MDS series switches and provides storage visualization, configuration, and troubleshooting. A trust management issue vulnerability exists in the REST API in Cisco DCNM that...
Android Trusted Execution Environment Code Execution
The vulnerability of the message transfer interface Qualcomm Trusted Execution Environment, TEE in the Android operating system is related to improper checking of buffer sizes. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
WordPress Stop User Enumeration User Enumeration Vulnerability
WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports personal blog sites on PHP and MySQL servers.Stop User Enumeration is one of the plug-ins used to stop user enumeration. A user enumeration vulnerability exists in...
PT-2013-4893
Name of the Vulnerable Software and Affected Versions OpenStack Cinder versions 2013.1.3 and earlier Description The issue affects the backup API api/contrib/backups.py and volume transfer API contrib/volume transfer.py in OpenStack Cinder, allowing remote attackers to cause a denial of service...