432 matches found
CVE-2023-26866
GreenPacket OH736's WR-1200 Indoor Unit, OT-235 with firmware versions M-IDU-1.6.0.3V1.1 and MH-46360-2.0.3-R5-GP respectively are vulnerable to remote command injection. Commands are executed using pre-login execution and executed with root privileges allowing complete takeover...
CVE-2023-26822
D-Link Go-RT-AC750 revAv101b03 was discovered to contain a command injection vulnerability via the service parameter at soapcgi.main...
CVE-2023-1389
TP-Link Archer AX21 AX1800 firmware versions before 1.1.4 Build 20230219 contained a command injection vulnerability in the country form of the /cgi-bin/luci;stok=/locale endpoint on the web management interface. Specifically, the country parameter of the write operation was not sanitized before...
PT-2023-1568 · Aruba · Arubaos
Name of the Vulnerable Software and Affected Versions: ArubaOS affected versions not specified Description: The issue exists in the ArubaOS web-based management interface due to the lack of measures to neutralize special elements used in the operating system command. This allows an attacker to...
CVE-2023-24145
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the pluginversion parameter in the setUnloadUserData function...
SUSE-SU-2023:0224-1 Security update for ctags
This update for ctags fixes the following issues: - CVE-2022-4515: Fixed a command injection issue via a tag file wih a crafted filename bsc1206543...
EUVD-2022-51947
The webserver in Delta DX-3021 versions prior to 1.24 is vulnerable to command injection through the network diagnosis page. This vulnerability could allow a remote unauthenticated user to add files, delete files, and change file permissions...
CVE-2022-25926
Versions of the package window-control before 1.4.5 are vulnerable to Command Injection via the sendKeys function, due to improper input sanitization...
GHSA-995X-33WQ-8GC9 cycle-import-check vulnerable to Command Injection
The package cycle-import-check before version 1.3.2 is vulnerable to Command Injection via the writeFileToTmpDirAndOpenIt function due to improper user-input sanitization...
CVE-2022-24377
The package cycle-import-check before 1.3.2 are vulnerable to Command Injection via the writeFileToTmpDirAndOpenIt function due to improper user-input sanitization...
CVE-2022-45996
Tenda W20E V16.01.0.63392 is vulnerable to Command injection via cmdgetpingoutput...
CVE-2022-40282
The web server of Hirschmann BAT-C2 before 09.13.01.00R04 allows authenticated command injection. This allows an authenticated attacker to pass commands to the shell of the system because the dir parameter of the FsCreateDir Ajax function is not sufficiently sanitized. The vendor's ID is...
PT-2022-22590 · Usermin · Usermin
Name of the Vulnerable Software and Affected Versions: Usermin versions prior to 1.851 Description: The issue allows a remote authenticated user to execute OS commands via command injection in a filename for the GPG module. Recommendations: For versions prior to 1.851, update to version 1.851 or...
PT-2022-5279 · D Link · D-Link Covr
Name of the Vulnerable Software and Affected Versions: D-Link COVR versions 1200, 1202, 1203 version 1.08 Description: The issue is related to a command injection vulnerability via the system time timezone parameter at the SetNTPServerSettings function. This vulnerability may allow a remote...
Sensormatic Electronics iSTAR
1. EXECUTIVE SUMMARY CVSS v3 10.0 ATTENTION : Exploitable remotely/low attack complexity Vendor: Sensormatic Electronics, a subsidiary of Johnson Controls Inc. Equipment: iSTAR Ultra Vulnerability: Command Injection 2. RISK EVALUATION An unauthenticated user could use a malicious request to run...
PT-2022-23444 · D Link · D-Link Go-Rt-Ac750
Name of the Vulnerable Software and Affected Versions: D-Link Go-RT-AC750 versions GORTAC750 revA v101b03 through GO-RT-AC750 revB FWv200b02 Description: The issue concerns command injection via the "/htdocs/upnpinc/gena.php" API endpoint. This allows for potential malicious commands to be...
PT-2022-8888 · Curljs · Curljs
Name of the Vulnerable Software and Affected Versions: curljs affected versions not specified Description: A command injection issue affects the package. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this...
EUVD-2022-37544
Wavlink WL-WN575A3 RPT75A3.V4300.201217 was discovered to contain a command injection vulnerability via the function obtw. This vulnerability allows attackers to execute arbitrary commands via a crafted POST request...
OS Command Injection
proctree is vulnerable to OS command injection. The vulnerability exists in the getProcessTree function in index.js due to a lack of sanitization in shell metacharacters which allows attackers to execute arbitrary commands via the fix function...