Unspecified vulnerability in MySource Classic 2.14.6 and possibly earlier allows remote authenticated users with superuser privileges to inject arbitrary PHP code via unspecified vectors related to the Equation attribute in Web_Extensions - Notitia (I/II). NOTE: due to lack of details it is not clear whether this issue is file inclusion static code injection or another type of issue.


Direct static code injection vulnerability in util.php in the NukeAI 0.0.3 Beta module for PHP-Nuke aka Program E is an AIML chatterbot allows remote attackers to upload and execute arbitrary PHP code via a filename with a .php extension in the filename parameter and code in the moreinfo parameter which is saved to a filename under descriptions/ which is accessible via a direct request.


Direct static code injection vulnerability in WebText CMS 0.4.5.2 and earlier allows remote attackers to inject arbitrary PHP code into a script in wt/users/ via the im parameter during a profile edit (edycja) operation which is then executed via a direct request for this script.


Direct static code injection vulnerability in admin.php in PHP-Stats 0.1.9.1b and earlier allows remote attackers to execute arbitrary PHP code via a crafted option_newreport_w_day parameter in a preferenze action which can be later accessed via option/php-stats-options.php.


PHP code injection in TinyWebGallery before 1.8.8 allows remote authenticated users with admin privileges to inject arbitrary code into the .htusers.php file.


IBM Scale Out Network Attached Storage (SONAS) 1.1 through 1.3.1 allows remote authenticated administrators to execute arbitrary Linux commands via the (1) Command Line Interface or (2) Graphical User Interface related to a \code injection\ issue.


Static code injection vulnerability in administration/install.php in YVS Image Gallery allows remote attackers to inject arbitrary PHP code into functions/db_connect.php via unspecified vectors. NOTE: this is only a vulnerability when the administrator does not follow recommendations in the product's installation documentation.


The Battle for Wesnoth Project version 1.7.0 through 1.14.3 contains a Code Injection vulnerability in the Lua scripting engine that can result in code execution outside the sandbox. This attack appear to be exploitable via Loading specially-crafted saved games networked games replays and player content.


Pydio

version

and

earlier

contains

a

Cross

Site

Scripting

(XSS)

vulnerability

in

line

lines:

that

can

result

in

an

unauthenticated

remote

attacker

manipulating

the

web

client

via

XSS

code

injection.

This

attack

appear

to

be

exploitable

via

the

victim

openning

a

specially

crafted

URL.

This

vulnerability

appears

to

have

been

fixed

in

version


A code injection vulnerability in /type.php in PHPCMS 2008 allows attackers to write arbitrary content to a website cache file with a controllable filename leading to arbitrary code execution. The PHP code is sent via the template parameter and is written to a data/cache_template/*.tpl.php file along with a \<?php function \ substring.


The bbp-move-topics plugin before 1.1.6 for WordPress has code injection.


An issue was discovered in zzcms 8.2. It allows PHP code injection via the siteurl parameter to install/index.php as demonstrated by injecting a phpinfo() call into /inc/config.php.


ymlref allows code injection.


The yaml_parse.load method in Pylearn2 allows code injection.


cPanel before 71.9980.37 allows code injection in the WHM cPAddons interface (SEC-394).


The PGObject::Util::DBAdmin module before 0.120.0 for Perl as used in LedgerSMB through 1.5.x insufficiently sanitizes or escapes variable values used as part of shell command execution resulting in shell code injection via the create() run_file() backup() or restore() function. The vulnerability allows unauthorized users to execute code with the same privileges as the running application.


A code injection in cryo 0.0.6 allows an attacker to arbitrarily execute code due to insecure implementation of deserialization.


Apache SpamAssassin 3.4.2 fixes a local user code injection in the meta rule syntax.


PbootCMS

allows

PHP

code

injection

via

an

IF

label

in

or

related

to

the

parserIfLabel

function

in


PbootCMS

has

CSRF

via

an

admin.php/Message/mod/id/19.html?backurl=/index.php

request

resulting

in

PHP

code

injection

in

the

recontent

parameter.


IBM SDK Java Technology Edition Version 8 on the AIX platform uses absolute RPATHs which may facilitate code injection and privilege elevation by local users. IBM X-Force ID: 152081.


IBM WebSphere Commerce 9.0.0.0 through 9.0.0.6 could allow some server-side code injection due to inadequate input control. IBM X-Force ID: 149828.


WordPress version 4.8 + contains a Cross Site Scripting (XSS) vulnerability in plugins.php or core wordpress on delete function that can result in An attacker can perform client side attacks which could be from stealing a cookie to code injection. This attack appear to be exploitable via an attacker must craft an URL with payload and send to the user. Victim need to open the link to be affected by reflected XSS. .


Trovebox version <= 4.0.0-rc6 contains a SQL Injection vulnerability in album component that can result in SQL code injection. This attack appear to be exploitable via HTTP request. This vulnerability appears to have been fixed in after commit 742b8ed.


Traccar Traccar Server version 4.0 and earlier contains a CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability in ComputedAttributesHandler.java that can result in Remote Command Execution. This attack appear to be exploitable via Remote: web application request by a self-registered user. This vulnerability appears to have been fixed in 4.1 and later.


MiniCMS

version

contains

a

Cross

Site

Scripting

(XSS)

vulnerability

in

that

can

result

in

code

injection.


An issue was discovered in UCMS 1.4.6 and 1.6. It allows PHP code injection during installation via the systemdomain parameter to install/index.php as demonstrated by injecting a phpinfo() call into /inc/config.php.


An issue was discovered in ClusterLabs Hawk 2.x through 2.3.0-x. There is a Ruby shell code injection issue via the hawk_remember_me_id parameter in the login_from_cookie cookie. The user logout routine could be used by unauthenticated remote attackers to execute code as hauser.


Portable Ltd Playable v9.18 contains a code injection vulnerability in the filename parameter which allows attackers to execute arbitrary web scripts or HTML via a crafted POST request.


The is a code injection vulnerability in versions of Rails prior to 5.0.1 that wouldallow an attacker who controlled the `locals` argument of a `render` call to perform a RCE.


An issue was discovered in Avira Free-Antivirus before 15.0.2004.1825. The Self-Protection feature does not prohibit a write operation from an external process. Thus code injection can be used to turn off this feature. After that one can construct an event that will modify a file at a specific location and pass this event to the driver thereby defeating the anti-virus functionality.


A code injection in Nextcloud Desktop Client 2.6.4 allowed to load arbitrary code when placing a malicious OpenSSL config into a fixed directory.


Reflected code injection in Citrix ADC and Citrix Gateway versions before 13.0-58.30 12.1-57.18 12.0-63.21 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a 11.0.3d and 10.2.7 allows the modification of a file download.


A code injection in Nextcloud Desktop Client 2.6.2 for macOS allowed to load arbitrary code when starting the client with DYLD_INSERT_LIBRARIES set in the environment.


A too lax check in Nextcloud Talk 6.0.4 7.0.2 and 8.0.7 allowed a code injection when a not correctly sanitized talk command was added by an administrator.


Acrobat Reader DC versions 2020.012.20048 (and earlier) 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) for macOS are affected by a security feature bypass that could result in dynamic library code injection by the Adobe Reader process. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


A remote code injection vulnerability was discovered in HPE KVM IP Console Switches version(s): G2 4x1Ex32 Prior to 2.8.3.


openmediavault before 4.1.36 and 5.x before 5.5.12 allows authenticated PHP code injection attacks via the sortfield POST parameter of rpc.php because json_encode_safe is not used in config/databasebackend.inc. Successful exploitation allows arbitrary command execution on the underlying operating system as root.


SAP AS ABAP(DMIS) versions - 2011_1_620 2011_1_640 2011_1_700 2011_1_710 2011_1_730 2011_1_731 2011_1_752 2020 and SAP S4 HANA(DMIS) versions - 101 102 103 104 105 allows an authenticated attacker to inject arbitrary code into function module leading to code injection that can be executed in the application which affects the confidentiality availability and integrity of the application.


SAP Business Warehouse versions - 700 701 702 731 740 750 751 752 753 754 755 782 and SAP BW4HANA versions - 100 200 allows an attacker authenticated with (high) developer privileges to submit a crafted request to generate and execute code without requiring any user interaction. It is possible to craft a request which will result in the execution of Operating System commands leading to Code Injection vulnerability which could completely compromise the confidentiality integrity and availability of the server and any data or other applications running on it.


An issue was discovered in Foxit Reader and PhantomPDF before 4.1 on macOS. Because the Hardened Runtime protection mechanism is not applied to code signing code injection (or an information leak) can occur.


SAP Adaptive Server Enterprise (Backup Server) version 16.0 does not perform the necessary validation checks for an authenticated user while executing DUMP or LOAD command allowing arbitrary code execution or Code Injection.


Under certain conditions SAP Adaptive Server Enterprise (XP Server on Windows Platform) versions 15.7 16.0 does not perform the necessary checks for an authenticated user while executing the extended stored procedure allowing an attacker to read modify delete restricted data on connected servers leading to Code Injection.


SAP Solution Manager and SAP Focused Run (update provided in WILY_INTRO_ENTERPRISE 9.7 10.1 10.5 10.7) allows an attacker to modify a cookie in a way that OS commands can be executed and potentially gain control over the host running the CA Introscope Enterprise Manager leading to Code Injection. With this the attacker is able to read and modify all system files and also impact system availability.


Service Data Download in SAP Application Server ABAP (ST-PI before versions 2008_1_46C 2008_1_620 2008_1_640 2008_1_700 2008_1_710 740) allows an attacker to inject code that can be executed by the application. An attacker could thereby control the behavior of the application and the whole ABAP system leading to Code Injection.


grammar-parser.jison in the hot-formula-parser package before 3.0.1 for Node.js is vulnerable to arbitrary code injection. The package fails to sanitize values passed to the parse function and concatenates them in an eval call. If a value of the formula is taken from user-controlled input it may allow attackers to run arbitrary commands on the server.


SAP NetWeaver (ABAP Server) and ABAP Platform versions - 700 701 702 710 711 730 731 740 750 751 753 755 allows an attacker to inject code that can be executed by the application leading to Code Injection. An attacker could thereby control the behavior of the application.


SAP OrientDB version 3.0 allows an authenticated attacker with script execute/write permissions to inject code that can be executed by the application and lead to Code Injection. An attacker could thereby control the behavior of the application.


The ping page of the administration panel in Telmat AccessLog <= 6.0 (TAL_20180415) allows an attacker to get root shell access via authenticated code injection over the network.


HP nagios plugin for iLO (nagios-plugins-hpilo v1.50 and earlier) has a php code injection vulnerability.


A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists in Andover Continuum (All versions) which could cause files on the application server filesystem to be viewable when an attacker interferes with an application's processing of XML data.


Pi-hole through 5.0 allows code injection in piholedhcp (the Static DHCP Leases section) by modifying Teleporter backup files and then restoring them. This occurs in settings.php. To exploit this an attacker would request a backup of limited files via teleporter.php. These are placed into a .tar.gz archive. The attacker then modifies the host parameter in dnsmasq.d files and then compresses and uploads these files again.


Brocade Fabric OS versions before Brocade Fabric OS v9.0.0 v8.2.2c v8.2.1e v8.1.2k v8.2.0_CBN3 contains code injection and privilege escalation vulnerability.


TerraMaster TOS before 4.1.29 has Invalid Parameter Checking that leads to code injection as root. This is a dynamic class method invocation vulnerability in include/exportUser.php in which an attacker can trigger a call to the exec method with (for example) OS commands in the opt parameter.


Nette versions before 2.0.19 2.1.13 2.2.10 2.3.14 2.4.16 3.0.6 are vulnerable to an code injection attack by passing specially formed parameters to URL that may possibly leading to RCE. Nette is a PHP/Composer MVC Framework.


An issue was discovered in Titan SpamTitan 7.07. Due to improper sanitization of the parameter quid used in the page mailqueue.php code injection can occur. The input for this parameter is provided directly by an authenticated user via an HTTP GET request.


Go before 1.14.12 and 1.15.x before 1.15.5 allows Code Injection.


A flaw was found in Ansible Engine all versions 2.7.x 2.8.x and 2.9.x prior to 2.7.17 2.8.9 and 2.9.6 respectively when using ansible_facts as a subkey of itself and promoting it to a variable when inject is enabled overwriting the ansible_facts after the clean. An attacker could take advantage of this by altering the ansible_facts such as ansible_hosts users and any other key data which would lead into privilege escalation or code injection.


Client-Side code injection through Mermaid markup in GitLab CE/EE 12.9 and later through 13.0.1 allows a specially crafted Mermaid payload to PUT requests on behalf of other users via clicking on a link


An arbitrary code injection vector was found in PouchDB 6.0.4 and lesser via the map/reduce functions used in PouchDB temporary views and design documents. The code execution engine for this branch is not properly sandboxed and may be used to run arbitrary JavaScript as well as system commands.


Arbitrary code execution is possible in reduce-css-calc node module <=1.2.4 through crafted css. This makes cross sites scripting (XSS) possible on the client and arbitrary code injection possible on the server and user input is passed to the `calc` function.


The npm module \shell-quote\ 1.6.0 and earlier cannot correctly escape \>\ and \<\ operator used for redirection in shell. Applications that depend on shell-quote may also be vulnerable. A malicious user could perform code injection.


SetsucoCMS all versions allows remote authenticated attackers to conduct code injection attacks via unspecified vectors.


setup/frames/index.inc.php in phpMyAdmin 4.0.10.x before 4.0.10.16 4.4.15.x before 4.4.15.7 and 4.6.x before 4.6.3 allows remote attackers to conduct BBCode injection attacks against HTTP sessions via a crafted URI.


A code injection in the supportconfig data collection tool in supportutils in SUSE Linux Enterprise Server 12 and 12-SP1 and SUSE Linux Enterprise Desktop 12 and 12-SP1 could be used by local attackers to execute code as the user running supportconfig (usually root).


Direct code injection vulnerability in FlatNuke 2.5.3 allows remote attackers to execute arbitrary PHP code by placing the code into the Referer header of an HTTP request which causes the code to be injected into referer.php which can then be accessed by the attacker.


** DISPUTED ** NOTE: this issue has been disputed by the vendor. PHP remote code injection vulnerability in loader.php for Ariadne CMS 2.4 allows remote attackers to execute arbitrary PHP code by modifying the ariadne parameter to reference a URL on a remote web server that contains the code. NOTE: the vendor has disputed this issue saying that loader.php first requires the \ariadne.inc\ file which defines the $ariadne variable and thus it cannot be modified by an attacker. In addition CVE personnel have partially verified the dispute via source code inspection of Ariadne 2.4 as available on July 5 2005.


Direct static code injection vulnerability in the flood protection feature in inc/shows.inc.php in CuteNews 1.4.0 and earlier allows remote attackers to execute arbitrary PHP code via the HTTP_CLIENT_IP header (Client-Ip) which is injected into data/flood.db.php.


Direct static code injection vulnerability in admin_options_manage.php in AlstraSoft Affiliate Network Pro 7.2 allows attackers to execute arbitrary PHP code via the number parameter. NOTE: it is not clear from the original report whether administrator privileges are required. If not then this does not cross privilege boundaries and is not a vulnerability.


Direct static code injection vulnerability in error.php in GuppY 4.5.9 and earlier when register_globals is disabled allows remote attackers to execute arbitrary PHP code via the _SERVERREMOTE_ADDR parameter which is injected into a .inc script that is later included by the main script.


Direct static code injection vulnerability in setcookie.php in PBLang 4.65 and possibly earlier versions allows remote attackers to execute arbitrary PHP code via the username (u parameter) which is directly injected into a file that is later executed upon login.


Direct static code injection vulnerability in Yet Another PHP Image Gallery (YaPIG) 0.95b and earlier allows remote authenticated administrators to inject arbitrary PHP code via the TestGallery parameter in a mod_info action to modify_gallery.php which inserts the code into guid_info.php. NOTE: this issue is easier to exploit due to a separate CSRF vulnerability.


Multiple direct static code injection vulnerabilities in PHPGedView 3.3.7 and earlier allow remote attackers to execute arbitrary PHP code via (1) the username field in login.php or the (2) user_language (3) user_email and (4) user_gedcomid parameters in login_register.php which is directly inserted into authenticate.php.


The management interface in F5 BIG-IP 9.4.3 allows remote authenticated users with Resource Manager privileges to inject arbitrary Perl code via unspecified configuration settings related to Perl EP3 with templates probably triggering static code injection.


Static

code

injection

vulnerability

in

in

Goople

CMS

allows

remote

attackers

to

inject

arbitrary

PHP

code

into

admin/userandpass.php

via

the

username

and

password

parameters.

NOTE:

the

provenance

of

this

information

is

unknown;

the

details

are

obtained

solely

from

third

party

information.


Static

code

injection

vulnerability

in

in

YourPlace

and

earlier

allows

remote

authenticated

users

to

execute

arbitrary

PHP

code

into

via

the

or

parameters.


change.php in Ananta CMS 1.0b5 with magic_quotes_gpc disabled allows remote attackers to gain administrator privileges via a crafted email parameter possibly related to code injection.


Static code injection vulnerability in admin/admin.php in mxCamArchive 2.2 allows remote authenticated administrators to inject arbitrary PHP code into an unspecified program via the description parameter which is executed by invocation of index.php. NOTE: some of these details are obtained from third party information.


Static code injection vulnerability in Sanus|artificium (aka Sanusart) Free simple guestbook PHP script when downloaded before 20081111 allows remote attackers to inject arbitrary PHP code into messages.txt via the message parameter to act.php which is executed when guestbook/guestbook.php is accessed. NOTE: some of these details are obtained from third party information.


Static code injection vulnerability in admin/install.php in Flexcustomer 0.0.6 might allow remote attackers to inject arbitrary PHP code into const.inc.php via the installdbname parameter (aka the Database Name field). NOTE: the installation instructions specify deleting admin/install.php.


Static code injection vulnerability in admin/configuration/modifier.php in zKup CMS 2.0 through 2.3 allows remote attackers to inject arbitrary PHP code into fichiers/config.php via a null byte (%00) in the login parameter in an ajout action which bypasses the regular expression check.


Variable overwrite vulnerability in libsecure.php in Turnkey PHP Live Helper 2.0.1 and earlier when register_globals is enabled allows remote attackers to overwrite arbitrary variables related to the db config file. NOTE: this can be leveraged for code injection by overwriting the language file.


setup/lib/ConfigGenerator.class.php in phpMyAdmin 3.x before 3.3.10.2 and 3.4.x before 3.4.3.1 does not properly restrict the presence of comment closing delimiters which allows remote attackers to conduct static code injection attacks by leveraging the ability to modify the SESSION superglobal array.


In the web ui of the openbuildservice before 2.3.0 a code injection of the project rebuildtimes statistics could be used by authorized attackers to execute shellcode.


Code injection in openSUSE when running some source services used in the open build service 2.1 before March 11 2011.


Static code injection vulnerability in Simploo CMS 1.7.1 and earlier allows remote authenticated users to inject arbitrary PHP code into config/custom/base.ini.php via the ftpserver parameter (FTP-Server field) to the sicore/updates/optionssav operation for index.php.


Static code injection vulnerability in inc/function.base.php in Ajax File and Image Manager before 1.1 as used in tinymce before 1.4.2 phpMyFAQ 2.6 before 2.6.19 and 2.7 before 2.7.1 and possibly other products allows remote attackers to inject arbitrary PHP code into data.php via crafted parameters.


Static code injection vulnerability in ajax_save_name.php in the Ajax File Manager module in the tinymce plugin in FreeWebshop 2.2.9 R2 and earlier allows remote attackers to inject arbitrary PHP code into data.php via the selected document as demonstrated by a call to ajax_file_cut.php and then to ajax_save_name.php.


Zenphoto versions prior to 1.5.7 allows an attacker to conduct PHP code injection attacks by leading a user to upload a specially crafted .zip file.


D-link DIR-816 A2 v1.10 is affected by a remote code injection vulnerability. An HTTP request parameter can be used in command string construction in the handler function of the /goform/dir_setWanWifi which can lead to command injection via shell metacharacters in the statuscheckpppoeuser parameter.


Multiple cross-site request forgery (CSRF) vulnerabilities in TinyWebGallery (TWG) before 1.8.8 allow remote attackers to hijack the authentication of administrators for requests that (1) add a user via an adduser action to admin/index.php or (2) conduct static PHP code injection attacks in .htusers.php via the user parameter to admin/index.php.

code injection
cross site request forgery


Multiple cross-site request forgery (CSRF) vulnerabilities in Template CMS 2.1.1 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) create an administrator user via an add action to admin/index.php or (2) conduct static PHP code injection attacks via the themes_editor parameter in an edit_template action to admin/index.php.


A command execution vulnerability in SonicWall GMS 9.3 allows a remote unauthenticated attacker to locally escalate privilege to root.


A command execution vulnerability exists in the default legacy spellchecker plugin in Moodle 3.10. A specially crafted series of HTTP requests can lead to command execution. An attacker must have administrator privileges to exploit this vulnerabilities.


A command execution vulnerability exists in the wifi_country_code_update functionality of the home_security binary of Anker Eufy Homebase 2 2.1.6.9h. A specially-crafted set of network packets can lead to arbitrary command execution.


A

command

execution

vulnerability

exists

in

via

com.jflyfox.component.controller.Ueditor.


A command execution vulnerability exists in Jenkins Absint Astree Plugin 1.0.5 and older in AstreeBuilder.java that allows attackers with Overall/Read access to execute a command on the Jenkins master.


Arbitrary command execution vulnerability in Intel Security McAfee Security Scan Plus (SSP) 3.11.469 and earlier allows authenticated users to gain elevated privileges via unspecified vectors.


On BIG-IP 14.1.0-14.1.0.5 14.0.0-14.0.0.5 13.0.0-13.1.1.4 12.1.0-12.1.4.1 and 11.5.1-11.6.4 and BIG-IQ 6.0.0-6.1.0 and 5.1.0-5.4.0 an undisclosed iControl REST worker vulnerable to command injection for an Administrator user.


In Apache Airflow prior to version 2.2.4 some example DAGs did not properly sanitize user-provided params making them susceptible to OS Command Injection from the web UI.


In IBOS 4.5.4 Open the database backup has Command Injection Vulnerability.


In Limdu before 0.95 the trainBatch function has a command injection vulnerability. Clients of the Limdu library are unlikely to be aware of this so they might unwittingly write code that contains a vulnerability. This has been patched in 0.95.


Trendnet AC2600 TEW-827DRU version 2.08B01 is vulnerable to command injection. The system log functionality of the firmware allows for command injection as root by supplying a malformed parameter.


Trendnet AC2600 TEW-827DRU version 2.08B01 contains a command injection vulnerability in the smb functionality of the device. The username parameter used when configuring smb functionality for the device is vulnerable to command injection as root.


The affected product is vulnerable to an authenticated OS command injection which may allow an attacker to inject and execute arbitrary shell commands as the Admin (root) user.


This affects the package @graphql-tools/git-loader before 6.2.6. The use of exec and execSync in packages/loaders/git/src/load-git.ts allows arbitrary command injection.


This affects the package systeminformation before 4.27.11. This package is vulnerable to Command Injection. The attacker can concatenate curl's parameters to overwrite Javascript files and then execute any OS commands.


Tenda AX1806 v1.0.0.1 was discovered to contain a command injection vulnerability in `SetIPv6Status` function


The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a command injection vulnerability in libifc.so websetdefaultlangcfg function.


The Baseboard Management Controller (BMC) firmware in HPE Apollo 70 System prior to version 3.0.14.0 has a command injection vulnerability in libifc.so uploadsshkey function.


In Bender/ebee Charge Controllers in multiple versions are prone to Command injection via Web interface. An authenticated attacker could enter shell commands into some input fields that are executed with root privileges.


In Bender/ebee Charge Controllers in multiple versions are prone to Command injection via Web interface. An authenticated attacker could enter shell commands into some input fields.


A vulnerability in the web management interface of Cisco Small Business 220 Series Smart Switches could allow an authenticated remote attacker to perform a command injection attack. The vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a malicious request to certain parts of the web management interface. To send the malicious request the attacker needs a valid login session in the web management interface as a privilege level 15 user. Depending on the configuration of the affected switch the malicious request must be sent via HTTP or HTTPS. A successful exploit could allow the attacker to execute arbitrary shell commands with the privileges of the root user.


A vulnerability in the log subscription subsystem of the Cisco Web Security Appliance (WSA) could allow an authenticated local attacker to perform command injection and elevate privileges to root. The vulnerability is due to insufficient validation of user-supplied input on the web and command-line interface. An attacker could exploit this vulnerability by authenticating to the affected device and injecting scripting commands in the scope of the log subscription subsystem. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system and elevate privileges to root.


A vulnerability in the local management CLI implementation for specific commands on the Cisco UCS B-Series Blade Servers could allow an authenticated local attacker to overwrite an arbitrary file on disk. It is also possible the attacker could inject CLI command parameters that should not be allowed for a specific subset of local management CLI commands. The vulnerability is due to lack of proper input validation of user input for local management CLI commands. An attacker could exploit this vulnerability by authenticating to the device and issuing a crafted form of a limited subset of local management CLI commands. An exploit could allow the attacker to overwrite an arbitrary files on disk or inject CLI command parameters that should have been disabled. This vulnerability is fixed in software version 4.0(2a) and later.


The Crestron AM-100 firmware 1.6.0.2 Crestron AM-101 firmware 2.7.0.1 Barco wePresent WiPG-1000P firmware 2.3.0.10 Barco wePresent WiPG-1600W before firmware 2.4.1.19 Extron ShareLink 200/250 firmware 2.0.3.4 Teq AV IT WIPS710 firmware 1.1.0.7 SHARP PN-L703WA firmware 1.4.2.3 Optoma WPS-Pro firmware 1.0.0.5 Blackbox HD WPS firmware 1.0.0.5 InFocus LiteShow3 firmware 1.0.16 and InFocus LiteShow4 2.0.0.7 are vulnerable to command injection via the file_transfer.cgi HTTP endpoint. A remote unauthenticated attacker can use this vulnerability to execute operating system commands as root.


Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 are vulnerable to command injection via SNMP OID iso.3.6.1.4.1.3212.100.3.2.9.3. A remote unauthenticated attacker can use this vulnerability to execute operating system commands as root.


The 7520V3V1.0.0B09P27 version and all earlier versions of ZTE product ZX297520V3 are impacted by a Command Injection vulnerability. Unauthorized users can exploit this vulnerability to control the user terminal system.


The Alcatel Lucent I-240W-Q GPON ONT using firmware version 3FE54567BOZJ19 is vulnerable to authenticated command injection via crafted HTTP request sent by a remote authenticated attacker to /GponForm/device_Form?script/.


All versions up to UKBB_WF820+_1.0.0B06 of ZTE WF820+ LTE Outdoor CPE product are impacted by command injection vulnerability. Due to inadequate parameter verification unauthorized users can take advantage of this vulnerability to control the user terminal system.


The Alcatel Lucent I-240W-Q GPON ONT using firmware version 3FE54567BOZJ19 is vulnerable to command injection via crafted HTTP request sent by a remote authenticated attacker to /GponForm/usb_restore_Form?script/.


Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D3600 before 1.0.0.76 D6000 before 1.0.0.76 and XR500 before 2.3.2.32.


Certain

NETGEAR

devices

are

affected

by

command

injection

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Upgrade Firmware functionality in the Web interface using shell metacharacters in the admin.cgi?action=upgrade firmwareRestore or firmwareServerip parameter.


Certain

NETGEAR

devices

are

affected

by

command

injection

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Save Configuration functionality in the Web interface using shell metacharacters in the admin.cgi?action=config_save configBackup or downloadServerip parameter.


Certain NETGEAR devices are affected by command injection by an authenticated user. This affects R6400v2 before 1.0.4.84 R6700 before 1.0.2.8 R6700v3 before 1.0.4.84 R6900 before 1.0.2.8 and R7900 before 1.0.3.10.


Certain NETGEAR devices are affected by command injection by an authenticated user. This affects XR500 before 2.3.2.56 and XR700 before 1.0.1.20.


Certain

NETGEAR

devices

are

affected

by

command

injection

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


Certain NETGEAR devices are affected by command injection by an authenticated user. This affects WAC505 before 8.2.1.16 and WAC510 before 8.2.1.16.


D-Link DWL-2600AP 4.2.0.15 Rev A devices have an authenticated OS command injection vulnerability via the Restore Configuration functionality in the Web interface using shell metacharacters in the admin.cgi?action=config_restore configRestore or configServerip parameter.


NETGEAR R7800 devices before 1.0.2.62 are affected by command injection by an authenticated user.


Certain

NETGEAR

devices

are

affected

by

command

injection

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

before

before

before

and

before


Certain NETGEAR devices are affected by command injection by an authenticated user. This affects WAC505 before 5.0.10.2 and WAC510 before 5.0.10.2.


Certain NETGEAR devices are affected by command injection by an authenticated user. This affects R7800 before 1.0.2.60 and XR500 before 2.3.2.32.


Certain

NETGEAR

devices

are

affected

by

command

injection

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


Goverlan Reach Console before 9.50 Goverlan Reach Server before 3.50 and Goverlan Client Agent before 9.20.50 have an Untrusted Search Path that leads to Command Injection and Local Privilege Escalation via DLL hijacking.


Certain

NETGEAR

devices

are

affected

by

command

injection

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

command

injection

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

before

before

before

before

before

and

before


An issue was discovered on D-Link DIR-823G devices with firmware through 1.02B03. A command Injection vulnerability allows attackers to execute arbitrary OS commands via shell metacharacters in a crafted /HNAP1 request. This occurs when the GetNetworkTomographyResult function calls the system function with an untrusted input parameter named Address. Consequently an attacker can execute any command remotely when they control this input.


Adobe Campaign Classic version 18.10.5-8984 and earlier versions have a Command injection vulnerability. Successful exploitation could lead to Arbitrary Code Execution in the context of the current user.


An authenticated shell command injection issue has been discovered in Raisecom ISCOM HT803G-U HT803G-W HT803G-1GE and HT803G GPON products with the firmware version ISCOMHT803G-U_2.0.0_140521_R4.1.47.002 or below The values of the newpass and confpass parameters in /bin/WebMGR are used in a system call in the firmware. Because there is no user input validation this leads to authenticated code execution on the device.


An authenticated shell command injection issue has been discovered in Raisecom ISCOM HT803G-U HT803G-W HT803G-1GE and HT803G GPON products with the firmware version ISCOMHT803G-U_2.0.0_140521_R4.1.47.002 or below. The value of the fmgpon_loid parameter is used in a system call inside the boa binary. Because there is no user input validation this leads to authenticated code execution on the device.


Linear eMerge 50P/5000P devices allow Authenticated Command Injection with root Code Execution.


An issue was discovered on D-Link DIR-823G devices with firmware through 1.02B03. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 request. This occurs when any HNAP API function triggers a call to the system function with untrusted input from the request body such as a body of ' /bin/telnetd' for the GetDeviceSettingsset API function. Consequently an attacker can execute any command remotely when they control this input.


ColdFusion versions Update 3 and earlier Update 10 and earlier and Update 18 and earlier have a command injection vulnerability. Successful exploitation could lead to arbitrary code execution.


LifeSize Team Room Passport and Networker 220 devices allow Authenticated Remote OS Command Injection as demonstrated by shell metacharacters in the support/mtusize.php mtu_size parameter. The lifesize default password for the cli account may sometimes be used for authentication.


An issue was discovered on Systrome Cumilon ISG-600C ISG-600H and ISG-800W devices with firmware V1.1-R2.1_TRUNK-20181105.bin. A shell command injection occurs by editing the description of an ISP file. The file network/isp/isp_update_edit.php does not properly validate user input which leads to shell command injection via the des parameter.


pacman before 5.2 is vulnerable to arbitrary command injection in conf.c in the download_with_xfercommand() function. This can be exploited when unsigned databases are used. To exploit the vulnerability the user must enable a non-default XferCommand and retrieve an attacker-controlled crafted database and package.


Barco ClickShare Button R9861500D01 devices before 1.9.0 allow OS Command Injection. The embedded 'dongle_bridge' program used to expose the functionalities of the ClickShare Button to a USB host is vulnerable to OS command injection vulnerabilities. These vulnerabilities could lead to code execution on the ClickShare Button with the privileges of the user 'nobody'.


pacman before 5.2 is vulnerable to arbitrary command injection in lib/libalpm/sync.c in the apply_deltas() function. This can be exploited when unsigned databases are used. To exploit the vulnerability the user must enable the non-default delta feature and retrieve an attacker-controlled crafted database and delta file.


An issue was discovered on Xiaomi Mi WiFi R3G devices before 2.28.23-stable. The backup file is in tar.gz format. After uploading the application uses the tar zxf command to decompress so one can control the contents of the files in the decompressed directory. In addition the application's sh script for testing upload and download speeds reads a URL list from /tmp/speedtest_urls.xml and there is a command injection vulnerability as demonstrated by api/xqnetdetect/netspeed.


The Untangle NG firewall 14.2.0 is vulnerable to an authenticated command injection when logged in as an admin user.


On SuperMicro X8STi-F motherboards with IPMI firmware 2.06 and BIOS 02.68 the Virtual Media feature allows OS Command Injection by authenticated attackers who can send HTTP requests to the IPMI IP address. This requires a POST to /rpc/setvmdrive.asp with shell metacharacters in ShareHost or ShareName. The attacker can achieve a persistent backdoor.


Command Injection in minPlayCommand.php in Centreon (19.04.4 and below) allows an attacker to achieve command injection via a plugin test.


BMC Control-M/Agent 7.0.00.000 allows OS Command Injection (issue 2 of 2).


BMC Control-M/Agent 7.0.00.000 allows OS Command Injection.


In

Zmanda

Management

Console

ZMC_Admin_Advanced?form=adminTasks&action=Apply&command=

allows

CSRF

as

demonstrated

by

command

injection

with

shell

metacharacters.

This

may

depend

on

weak

default

credentials.


An issue was discovered in Selesta Visual Access Manager (VAM) 4.15.0 through 4.29. It allows blind Command Injection. An attacker without authentication is able to execute arbitrary operating system command by injecting the vulnerable parameter in the PHP Web page /common/vam_monitor_sap.php.


An issue was discovered in Dillon Kane Tidal Workload Automation Agent 3.2.0.5 (formerly known as Cisco Workload Automation or CWA). The Enterprise Scheduler for AIX allows local users to gain privileges via Command Injection in crafted Tidal Job Buffers (TJB) parameters. NOTE: this vulnerability exists because the CVE-2014-3272 solution did not address AIX operating systems.


Edgecore ECS2020 Firmware 1.0.0.0 devices allow Unauthenticated Command Injection via the command1 HTTP header to the /EXCU_SHELL URI.


On BIG-IP 14.1.0-14.1.0.5 14.0.0-14.0.0.5 13.0.0-13.1.1.4 12.1.0-12.1.4.1 and 11.5.1-11.6.4 an undisclosed iControl REST worker is vulnerable to command injection by an administrator or resource administrator user. This attack is only exploitable on multi-bladed systems.


On BIG-IP 14.1.0-14.1.0.5 14.0.0-14.0.0.4 13.0.0-13.1.1.4 12.1.0-12.1.4.1 11.6.1-11.6.3.4 and 11.5.2-11.5.8 and BIG-IQ 7.0.0-7.1.0.2 6.0.0-6.1.0 and 5.1.0-5.4.0 an undisclosed iControl REST worker is vulnerable to command injection by an admin/resource admin user. This issue impacts both iControl REST and tmsh implementations.


IBM API Connect 5.0.0.0 and 5.0.8.6 Developer Portal is vulnerable to command injection. An attacker with a specially crafted request can run arbitrary code on the server and gain complete access to the system. IBM X-Force ID: 159123.


An exploitable command injection vulnerability exists in the cloud connectivity functionality of WAGO PFC200 versions 03.02.02(14) 03.01.07(13) and 03.00.39(12). An attacker can inject operating system commands into the TimeoutPrepared parameter value contained in the firmware update command.


A command injection have been found in YouPHPTube Encoder. A successful attack could allow an attacker to compromise the server. Exploitable unauthenticated command injections exist in YouPHPTube Encoder 2.3 a plugin for providing encoder functionality in YouPHPTube. The parameter base64Url in /objects/getImageMP4.php is vulnerable to a command injection attack.


NPM package gitlabhook version 0.0.17 is vulnerable to a Command Injection vulnerability. Arbitrary commands can be injected through the repository name.


An exploitable command injection vulnerability exists in the /goform/WanParameterSetting functionality of Tenda AC9 Router AC1200 Smart Dual-Band Gigabit WiFi Route (AC9V1.0 Firmware V15.03.05.16multiTRU). A specially crafted HTTP POST request can cause a command injection in the DNS1 post parameters resulting in code execution. An attacker can send HTTP POST request with command to trigger this vulnerability.


Accellion File Transfer Appliance version FTA_8_0_540 suffers from an instance of CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection').


An exploitable command injection vulnerability exists in encrypted diagnostic script functionality of the Moxa AWK-3131A firmware version 1.13. A specially crafted diagnostic script file can cause arbitrary busybox commands to be executed resulting in remote control over the device. An attacker can send diagnostic while authenticated as a low privilege user to trigger this vulnerability.


An exploitable command injection vulnerability exists in the hostname functionality of the Moxa AWK-3131A firmware version 1.13. A specially crafted entry to network configuration information can cause execution of arbitrary system commands resulting in full control of the device. An attacker can send various authenticated requests to trigger this vulnerability.


An exploitable command injection vulnerability exists in the Cloud Connectivity functionality of WAGO PFC200 Firmware versions 03.02.02(14) 03.01.07(13) and 03.00.39(12). An attacker can inject OS commands into the TimeoutUnconfirmed parameter value contained in the Firmware Update command.


A command injection have been found in YouPHPTube Encoder. A successful attack could allow an attacker to compromise the server. Exploitable unauthenticated command injections exist in YouPHPTube Encoder 2.3 a plugin for providing encoder functionality in YouPHPTube. The parameter base64Url in /objects/getSpiritsFromVideo.php is vulnerable to a command injection attack.


An exploitable command injection vulnerability exists in the /goform/WanParameterSetting functionality of Tenda AC9 Router AC1200 Smart Dual-Band Gigabit WiFi Route (AC9V1.0 Firmware V15.03.05.16multiTRU). A specially crafted HTTP POST request can cause a command injection in the DNS2 post parameters resulting in code execution. An attacker can send HTTP POST request with command to trigger this vulnerability.


A command injection have been found in YouPHPTube Encoder. A successful attack could allow an attacker to compromise the server. Exploitable unauthenticated command injections exist in YouPHPTube Encoder 2.3 a plugin for providing encoder functionality in YouPHPTube. The parameter base64Url in /objects/getImage.php is vulnerable to a command injection attack.


An exploitable command injection vulnerability exists in the iw_webs functionality of the Moxa AWK-3131A firmware version 1.13. A specially crafted iw_serverip parameter can cause user input to be reflected in a subsequent iw_system call resulting in remote control over the device. An attacker can send commands while authenticated as a low privilege user to trigger this vulnerability.


An exploitable command injection vulnerability exists in the cloud connectivity feature of WAGO PFC200. An attacker can inject operating system commands into any of the parameter values contained in the firmware update command. This affects WAGO PFC200 Firmware version 03.02.02(14) version 03.01.07(13) and version 03.00.39(12)


An exploitable command injection vulnerability exists in the Config editor of the Exhibitor Web UI versions 1.0.9 to 1.7.1. Arbitrary shell commands surrounded by backticks or $() can be inserted into the editor and will be executed by the Exhibitor process when it launches ZooKeeper. An attacker can execute any command as the user running the Exhibitor process.


A command injection vulnerability in Nokogiri v1.10.3 and earlier allows commands to be executed in a subprocess via Ruby's `Kernel.open` method. Processes are vulnerable only if the undocumented method `Nokogiri::CSS::Tokenizer#load_file` is being called with unsafe user input as the filename. This vulnerability appears in code generated by the Rexical gem versions v1.0.6 and earlier. Rexical is used by Nokogiri to generate lexical scanner code for parsing CSS queries. The underlying vulnerability was addressed in Rexical v1.0.7 and Nokogiri upgraded to this version of Rexical in Nokogiri v1.10.4.


Command Injection in EdgeMAX EdgeSwitch prior to 1.8.2 allow an Admin user to execute commands as root.


There are command injection vulnerabilities present in the AirWave application. Certain input fields controlled by an administrative user are not properly sanitized before being parsed by AirWave. If conditions are met an attacker can obtain command execution on the host.


An exploitable command injection vulnerability exists in the iwwebs functionality of the Moxa AWK-3131A firmware version 1.13. A specially crafted diagnostic script file name can cause user input to be reflected in a subsequent iwsystem call resulting in remote control over the device. An attacker can send commands while authenticated as a low privilege user to trigger this vulnerability.


A remote command injection vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.


An issue was discovered in TRENDnet TEW-827DRU firmware before 2.05B11. There is a command injection in apply.cgi (exploitable with authentication) via the Private Port in Add Virtual Server.


TP-Link

devices

through

Build

allow

internalPort

OS

Command

Injection

(issue

of


Pi-Hole 4.3 allows Command Injection.


In Docker before 18.09.4 an attacker who is capable of supplying or manipulating the build path for the \docker build\ command would be able to gain command execution. An issue exists in the way \docker build\ processes remote git URLs and results in command injection into the underlying \git clone\ command leading to code execution in the context of the user executing the \docker build\ command. This occurs because git ref can be misinterpreted as a flag.


TRENDnet TEW-827DRU with firmware up to and including 2.04B03 contains multiple command injections when processing user input for the setup wizard allowing an unauthenticated user to run arbitrary commands on the device. The vulnerability can be exercised on the local intranet or remotely if remote administration is enabled.


In qBittorrent before 4.1.7 the function Application::runExternalProgram() located in app/application.cpp allows command injection via shell metacharacters in the torrent name parameter or current tracker parameter as demonstrated by remote command execution via a crafted name within an RSS feed.


An issue was discovered in TRENDnet TEW-827DRU firmware before 2.05B11. There is a command injection in apply.cgi (exploitable with authentication) via the IP Address in Add Gaming Rule.


An issue was discovered on D-Link DIR-823G devices with firmware 1.02B03. There is a command injection in HNAP1 (exploitable with Authentication) via shell metacharacters in the IPAddress or Gateway field to SetStaticRouteSettings.


TP-Link

devices

through

Build

allow

portMappingProtocol

OS

Command

Injection

(issue

of


An issue was discovered on D-Link DIR-818LW devices with firmware 2.06betab01. There is a command injection in HNAP1 (exploitable with Authentication) via shell metacharacters in the MTU field to SetWanSettings.


TP-Link

devices

through

Build

allow

externalPort

OS

Command

Injection

(issue

of


An issue was discovered in TRENDnet TEW-827DRU firmware before 2.05B11. There is a command injection in apply.cgi (exploitable with authentication). The command injection exists in the key ip_addr.


An issue was discovered in TRENDnet TEW-827DRU firmware before 2.05B11. There is a command injection in apply.cgi (exploitable with authentication) via the UDP Ports To Open in Add Gaming Rule.


TP-Link

devices

through

Build

allow

triggerPort

OS

Command

Injection

(issue

of


An issue was discovered in TRENDnet TEW-827DRU firmware before 2.05B11. There is a command injection in apply.cgi (exploitable with authentication) via the TCP Ports To Open in Add Gaming Rule.


An issue was discovered in TRENDnet TEW-827DRU firmware before 2.05B11. There is a command injection in apply.cgi (exploitable with authentication) via the action set_sta_enrollee_pin_5g and the key wps_sta_enrollee_pin.


An issue was discovered in TRENDnet TEW-827DRU firmware before 2.05B11. There is a command injection in apply.cgi (exploitable with authentication) via the key passwd in Routing RIP Settings.


TP-Link

devices

through

Build

allow

serviceName

OS

Command

Injection

(issue

of


An issue was discovered in TRENDnet TEW-827DRU firmware before 2.05B11. There is a command injection in apply.cgi (exploitable with authentication) via the IP Address in Add Virtual Server.


An issue was discovered on D-Link DIR-818LW devices with firmware 2.06betab01. There is a command injection in HNAP1 (exploitable with Authentication) via shell metacharacters in the Type field to SetWanSettings.


GNU patch through 2.7.6 is vulnerable to OS shell command injection that can be exploited by opening a crafted patch file that contains an ed style diff payload with shell metacharacters. The ed editor does not need to be present on the vulnerable system. This is different from CVE-2018-1000156.


A command injection (missing input validation) issue in the IP address field for the logging server in the configuration web interface on the Akuvox R50P VoIP phone with firmware 50.0.6.156 allows an authenticated remote attacker in the same network to trigger OS commands via shell metacharacters in a POST request.


A command injection (missing input validation) issue in the remote phonebook configuration URI in the web interface of the Atcom A10W VoIP phone with firmware 2.6.1a2421 allows an authenticated remote attacker in the same network to trigger OS commands via shell metacharacters in a POST request.


An issue was discovered on D-Link DIR-818LW devices from 2.05.B03 to 2.06B01 BETA. There is a command injection in HNAP1 SetWanSettings via an XML injection of the value of the Gateway key.


An issue was discovered on D-Link DIR-818LW devices from 2.05.B03 to 2.06B01 BETA. There is a command injection in HNAP1 SetWanSettings via an XML injection of the value of the IPAddress key.


The web-based configuration interface of the TP-Link M7350 V3 with firmware before 190531 is affected by several post-authentication command injection vulnerabilities.


The Netskope client service v57 before 57.2.0.219 and v60 before 60.2.0.214 running with NT\\SYSTEM privilege accepts network connections from localhost. The connection handling function in this service suffers from command injection vulnerability. Local users can use this vulnerability to execute code with NT\\SYSTEM privilege.


Command injection is possible in ThinStation through 6.1.1 via shell metacharacters after the cgi-bin/CdControl.cgi action= substring or after the cgi-bin/VolControl.cgi OK= substring.


The Belkin Wemo Enabled Crock-Pot allows command injection in the Wemo UPnP API via the SmartDevURL argument to the SetSmartDevInfo action. A simple POST request to /upnp/control/basicevent1 can allow an attacker to execute commands without authentication.


An issue was discovered in GitLab Community and Enterprise Edition 11.11. A specially crafted payload would allow an authenticated malicious user to execute commands remotely through the repository download feature. It allows Command Injection.


In OpenWrt LuCI through 0.10 the endpoints admin/status/realtime/bandwidth_status and admin/status/realtime/wireless_status of the web application are affected by a command injection vulnerability.


JetBrains Ktor framework before 1.2.0-rc does not sanitize the username provided by the user for the LDAP protocol leading to command injection.


The web-based configuration interface of the TP-Link M7350 V3 with firmware before 190531 is affected by a pre-authentication command injection vulnerability.


NETGEAR Insight Cloud with firmware before Insight 5.6 allows remote authenticated users to achieve command injection.


Citrix SD-WAN Center 10.2.x before 10.2.1 and NetScaler SD-WAN Center 10.0.x before 10.0.7 allow Command Injection.


All versions including 0.0.4 of lsof npm module are vulnerable to Command Injection. Every exported method used by the package uses the exec function to parse user input.


Jenkins Git Client Plugin 2.8.4 and earlier and 3.0.0-rc did not properly restrict values passed as URL argument to an invocation of 'git ls-remote' resulting in OS command injection.


An

issue

was

discovered

in

LibreNMS

through

There

is

a

command

injection

vulnerability

in

where

user

supplied

parameters

are

filtered

with

the

function.

This

function

is

not

the

appropriate

function

to

sanitize

command

arguments

as

it

does

not

escape

a

number

of

command

line

syntax

characters

such

as

(backtick)

allowing

an

attacker

to

inject

commands

into

the

variable

which

gets

executed

via

passthru().


A command injection vulnerability exists in TeemIp versions before 2.4.0. The new_config parameter of exec.php allows one to create a new PHP file with the exception of config information. The malicious PHP code sent is executed instantaneously and is not saved on the server.


Computrols CBAS 18.0.0 allows Authenticated Command Injection.


BibTeX-ruby before 5.1.0 allows shell command injection due to unsanitized user input being passed directly to the built-in Ruby Kernel.open method through BibTeX.open.


Within multiple XEROX products a vulnerability allows remote command execution on the Linux system as the \nobody\ user through a crafted \HTTP\ request (OS Command Injection vulnerability in the HTTP interface). Depending upon configuration authentication may not be necessary.


promise-probe before 0.10.0 allows remote attackers to perform a command injection attack. The file outputFile and options functions can be controlled by users without any sanitization.


All versions of curling.js are vulnerable to Command Injection via the run function. The command argument can be controlled by users without any sanitization.


php-shellcommand versions before 1.6.1 have a command injection vulnerability. Successful exploitation could lead to arbitrary code execution.


An issue was discovered in D-Link DIR-806 devices. There is a command injection in function hnap_main which calls system() without checking the parameter that can be controlled by user and finally allows remote attackers to execute arbitrary shell commands with a special HTTP header.


PHKP

including

commit

is

affected

by:

Improper

Neutralization

of

Special

Elements

used

in

a

Command

('Command

Injection').

The

impact

is:

It

is

possible

to

manipulate

gpg-keys

or

execute

commands

remotely.

The

component

is:

function

The

attack

vector

is:

HKP-Api:

/pks/lookup?search.


CImg The CImg Library v.2.3.3 and earlier is affected by: command injection. The impact is: RCE. The component is: load_network() function. The attack vector is: Loading an image from a user-controllable url can lead to command injection because no string sanitization is done on the url. The fixed version is: v.2.3.4.


Several potential command injections vulnerabilities exist in the AT command interface of ALEOS before 4.11.0 and 4.9.4.


An

issue

was

discovered

on

TRENDnet

and

devices.

OS

command

injection

occurs

through

the

parameter.


The SUNNET WMPro v5.0 and v5.1 for eLearning system has OS Command Injection via \/teach/course/doajaxfileupload.php\. The target server can be exploited without authentication.


An

OS

Command

Injection

vulnerability

in

Snare

Central

before

allows

remote

authenticated

attackers

to

inject

arbitrary

OS

commands

via

the

parameter.


HARMAN AMX MVP5150 v2.87.13 devices allow remote OS Command Injection.


An issue was discovered in Softing uaGate SI 1.60.01. A CGI script is vulnerable to command injection with a maliciously crafted url parameter.


app/backup/index.php in the Backup Module in FusionPBX 4.4.3 suffers from a command injection vulnerability due to a lack of input validation which allows authenticated administrative attackers to execute commands on the host.


An issue was discovered on D-Link DIR-823G devices with firmware V1.0.2B05. There is a command injection in HNAP1 (exploitable with Authentication) via shell metacharacters in the LoginPassword field to Login.


An issue was discovered on D-Link DIR-823G devices with firmware V1.0.2B05. There is a command injection in HNAP1 (exploitable with Authentication) via shell metacharacters in the Interface field to SetStaticRouteSettings.


An issue was discovered in Softing uaGate (SI MB 840D) firmware through 1.71.00.1225. A CGI script is vulnerable to command injection via a maliciously crafted form parameter.


A

problem

was

found

in

Centreon

Web

through

An

authenticated

command

injection

is

present

in

the

page

This

page

is

called

from

the

Centreon

administration

interface.

This

is

the

mibs

management

feature

that

contains

a

file

filing

form.

At

the

time

of

submission

of

a

file

the

mnftr

parameter

is

sent

to

the

page

and

is

not

filtered

properly.

This

allows

one

to

inject

Linux

commands

directly.


An OS command injection vulnerability in FortiExtender 4.1.0 to 4.1.1 4.0.0 and below under CLI admin console may allow unauthorized administrators to run arbitrary system level commands via specially crafted \execute date\ commands.


An issue was discovered on D-Link DIR-823G devices with firmware V1.0.2B05. There is a command injection in HNAP1 (exploitable with Authentication) via shell metacharacters in the Username field to Login.


A system command injection vulnerability in the FortiAP-S/W2 6.2.1 6.2.0 6.0.5 and below FortiAP 6.0.5 and below and FortiAP-U below 6.0.0 under CLI admin console may allow unauthorized administrators to run arbitrary system level commands via specially crafted ifconfig commands.


An issue was discovered on D-Link DIR-823G devices with firmware V1.0.2B05. There is a command injection in HNAP1 (exploitable with Authentication) via shell metacharacters in the MaxIdTime field to SetWanSettings.


An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnerability.


The kill-port-process package version < 2.2.0 is vulnerable to a Command Injection vulnerability.


An issue was discovered on D-Link DIR-823G devices with firmware V1.0.2B05. There is a command injection in HNAP1 (exploitable with Authentication) via shell metacharacters in the Type field to SetWanSettings a related issue to CVE-2019-13482.


A command injection exists in GitLab CE/EE <v12.3.2 <v12.2.6 and <v12.1.12 that allowed an attacker to inject commands via the API through the blobs scope.


On the Alcatel-Lucent Enterprise (ALE) 8008 Cloud Edition Deskphone VoIP phone with firmware 1.50.13 a command injection (missing input validation) issue in the password change field for the Change Password interface allows an authenticated remote attacker in the same network to trigger OS commands via shell commands in a POST request.


Verifone MX900 series Pinpad Payment Terminals with OS 30251000 allow multiple arbitrary command injections as demonstrated by the file manager.


On the Polycom Obihai Obi1022 VoIP phone with firmware 5.1.11 a command injection (missing input validation) issue in the NTP server IP address field for the \Time Service Settings web\ interface allows an authenticated remote attacker in the same network to trigger OS commands via shell commands in a POST request.


Verifone MX900 series Pinpad Payment Terminals with OS 30251000 have Insecure Permissions with resultant svc_netcontrol arbitrary command injection and privilege escalation.


In radare2 before 3.7.0 a command injection vulnerability exists in bin_symbols() in libr/core/cbin.c. By using a crafted executable file it's possible to execute arbitrary shell commands with the permissions of the victim. This vulnerability is due to improper handling of symbol names embedded in executables.


A vulnerability was found in Ansible Engine versions 2.9.x before 2.9.3 2.8.x before 2.8.8 2.7.x before 2.7.16 and earlier where in Ansible's nxos_file_copy module can be used to copy files to a flash or bootflash on NXOS devices. Malicious code could craft the filename parameter to perform OS command injections. This could result in a loss of confidentiality of the system among other issues.


An issue was discovered in CMS Made Simple 2.2.8. It is possible with an administrator account to achieve command injection by modifying the path of the e-mail executable in Mail Settings setting \sendmail\ in the \Mailer\ option and launching the \Forgot your password\ feature.


An issue was discovered on PHOENIX CONTACT RAD-80211-XD and RAD-80211-XD/HP-BUS devices. Command injection can occur in the WebHMI component.


Gemalto DS3 Authentication Server 2.6.1-SP01 allows OS Command Injection.


elFinder before 2.1.48 has a command injection vulnerability in the PHP connector.


Command injection in Nagios XI before 5.5.11 allows an authenticated users to execute arbitrary remote commands via a new autodiscovery job.


In the Bootloader there is a possible kernel command injection due to missing command sanitization. This could lead to a local elevation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-80316910


In radare2 before 3.9.0 a command injection vulnerability exists in bin_symbols() in libr/core/cbin.c. By using a crafted executable file it's possible to execute arbitrary shell commands with the permissions of the victim. This vulnerability is due to an insufficient fix for CVE-2019-14745 and improper handling of symbol names embedded in executables.


In MobaXterm 11.1 and 12.1 the protocol handler is vulnerable to command injection. A crafted link can trigger a popup asking whether the user wants to run MobaXterm to handle the link. If accepted another popup appears asking for further confirmation. If this is also accepted command execution is achieved as demonstrated by the MobaXterm://`calc` URI.


app/call_centers/cmd.php in the Call Center Queue Module in FusionPBX up to 4.5.7 suffers from a command injection vulnerability due to a lack of input validation which allows authenticated attackers (with at least the permission call_center_queue_add or call_center_queue_edit) to execute any commands on the host as www-data.


resources/cmd.php in FusionPBX up to 4.5.7 suffers from a command injection vulnerability due to a lack of input validation which allows authenticated administrative attackers to execute any commands on the host as www-data.


The login_mgr.cgi script in D-Link DNS-320 through 2.05.B10 is vulnerable to remote command injection.


On TCL Alcatel Cingular Flip 2 B9HUAH1 devices there is an engineering application named omamock that is vulnerable to OS command injection. An attacker with physical access to the device can abuse this vulnerability to execute arbitrary OS commands as the root user via the application's UI.


A OS Command Injection vulnerability in the bootstrap stage of Bitdefender BOX 2 allows the manipulation of the `get_image_url()` function in special circumstances to inject a system command.


Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in firmware versions prior to x.xx of Netatmo Smart Indoor Camera allows an attacker to execute commands on the device. This issue affects: Netatmo Smart Indoor Camera version and prior versions.


A command injection vulnerability has been discovered in the bootstrap stage of Bitdefender BOX 2 versions 2.1.47.42 and 2.1.53.45. The API method `/api/download_image` unsafely handles the production firmware URL supplied by remote servers leading to arbitrary execution of system commands. In order to exploit the condition an unauthenticated attacker should impersonate a infrastructure server to trigger this vulnerability.


rssh version 2.3.4 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in allowscp permission that can result in Local command execution. This attack appear to be exploitable via An authorized SSH user with the allowscp permission.


daemonControl in includes/functions.php in ZoneMinder before 1.32.3 allows command injection via shell metacharacters.


Adobe Acrobat and Reader versions 2019.012.20035 and earlier 2019.012.20035 and earlier 2017.011.30142 and earlier 2017.011.30143 and earlier 2015.006.30497 and earlier and 2015.006.30498 and earlier have a command injection vulnerability. Successful exploitation could lead to arbitrary code execution .


Brackets versions 1.14 and earlier have a command injection vulnerability. Successful exploitation could lead to arbitrary code execution.


ColdFusion 2018- update 4 and earlier and ColdFusion 2016- update 11 and earlier have a Command Injection via Vulnerable component vulnerability. Successful exploitation could lead to Arbitrary code execution in the context of the current user.


The Etherpad Lite ep_imageconvert Plugin has a Remote Command Injection Vulnerability


An issue was discovered in soap.cgi?service=WANIPConn1 on D-Link DIR-845 before v1.02b03 DIR-600 before v2.17b01 DIR-645 before v1.04b11 DIR-300 rev. B and DIR-865 devices. There is Command Injection via shell metacharacters in the NewInternalClient NewExternalPort or NewInternalPort element of a SOAP POST request.


Vulnerability in FileUtils v0.7 Ruby Gem Fileutils <= v0.7 Command Injection vulnerability in user supplied url variable that is passed to the shell.


rubygem-openshift-origin-controller: API can be used to create applications via cartridge_cache.rb URI.prase() to perform command injection


TP-Link wifi router TL-WR802N V4(JP) with firmware version prior to 211202 is vulnerable to OS command injection.


An issue was discovered in D-Link DIR816_A1_FW101CNB04 750m11ac wireless router The HTTP request parameter is used in the handler function of /goform/form2userconfig.cgi route which can construct the user name string to delete the user function. This can lead to command injection through shell metacharacters.


Authenticated

Semi-Blind

Command

Injection

(via

Parameter

Injection)

exists

on

Altus

Nexto

Nexto

Xpress

and

Hadron

Xtorm

devices

via

the

getlogs.cgi

tcpdump

feature.

This

affects

Nexto

Nexto

Nexto

Nexto

Nexto

Nexto

Nexto

Nexto

Nexto

Nexto

Nexto

Xpress

Nexto

Xpress

Nexto

Xpress

Nexto

Xpress

and

Hadron

Xtorm


Certain

MOXA

devices

allow

Authenticated

Command

Injection

via

This

affects

OnCell

OnCell

and


An issue was discovered in D-Link DIR-816 DIR-816A2_FWv1.10CNB05_R1B011D88210 The HTTP request parameter is used in the handler function of /goform/form2userconfig.cgi route which can construct the user name string to delete the user function. This can lead to command injection through shell metacharacters.


A command injection vulnerability has been reported to affect QNAP device VioStor. If exploited this vulnerability allows remote attackers to run arbitrary commands. We have already fixed this vulnerability in the following versions of QVR: QVR FW 5.1.6 build 20211109 and later


Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects D7800 before 1.0.1.56 R7800 before 1.0.2.68 R8900 before 1.0.4.26 and R9000 before 1.0.4.26.


Certain

NETGEAR

devices

are

affected

by

command

injection

by

an

authenticated

user.

This

affects

before

before

before

before

before

and

before


Certain NETGEAR devices are affected by command injection by an authenticated user. This affects R6400 before 1.0.1.50 R7900P before 1.4.1.50 R8000P before 1.4.1.50 RAX75 before 1.0.1.62 and RAX80 before 1.0.1.62.


Apache James prior to release 3.6.1 is vulnerable to a buffering attack relying on the use of the STARTTLS command. This can result in Man-in -the-middle command injection attacks leading potentially to leakage of sensible information.


Certain

NETGEAR

devices

are

affected

by

command

injection

by

an

unauthenticated

attacker.

This

affects

before

before

before

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

command

injection

by

an

unauthenticated

attacker.

This

affects

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

command

injection

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


includes/configure_client.php in RaspAP 2.6.6 allows attackers to execute commands via command injection.


Network

Attached

Storage

on

LG

devices

allows

an

unauthenticated

attacker

to

gain

root

access

via

OS

command

injection

in

the

destServer

parameter.


Roxy-WI through 5.2.2.0 allows command injection via /app/funct.py and /api/api_funct.py.


Certain

NETGEAR

devices

are

affected

by

command

injection

by

an

unauthenticated

attacker.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


/jsonrpc on D-Link DIR-841 3.03 and 3.04 devices allows authenticated command injection via ping ping6 or traceroute (under System Tools).


The text-to-speech engine in libretro RetroArch for Windows 1.9.0 passes unsanitized input to PowerShell through platform_win32.c via the accessibility_speak_windows function which allows attackers who have write access on filesystems that are used by RetroArch to execute code via command injection using specially a crafted file and directory names.


Hongdian H8922 3.0.5 devices allow OS command injection via shell metacharacters into the ip-address (aka Destination) field to the tools.cgi ping command which is accessible with the username guest and password guest.


Adobe After Effects version 18.1 (and earlier) is affected by a potential Command injection vulnerability when chained with a development and debugging tool for JavaScript scripts. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK852 before 3.2.17.12 RBK853 before 3.2.17.12 RBK854 before 3.2.17.12 RBR850 before 3.2.17.12 and RBS850 before 3.2.17.12.


Certain NETGEAR devices are affected by command injection by an authenticated user. This affects RBK852 before 3.2.17.12 RBK853 before 3.2.17.12 RBK854 before 3.2.17.12 RBR850 before 3.2.17.12 and RBS850 before 3.2.17.12.


Certain

NETGEAR

devices

are

affected

by

command

injection

by

an

unauthenticated

attacker.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

and

before


** UNSUPPORTED WHEN ASSIGNED ** An issue was discovered on D-Link DIR-802 A1 devices through 1.00b05. Universal Plug and Play (UPnP) is enabled by default on port 1900. An attacker can perform command injection by injecting a payload into the Search Target (ST) field of the SSDP M-SEARCH discover packet. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.


Certain

NETGEAR

devices

are

affected

by

command

injection

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

before

before

before

before

and

before


Certain NETGEAR devices are affected by command injection by an authenticated user. This affects XR450 before 2.3.2.114 XR500 before 2.3.2.114 and WNR2000v5 before 1.0.0.76.


The @ronomon/opened library before 1.5.2 is vulnerable to a command injection vulnerability which would allow a remote attacker to execute commands on the system if the library was used with untrusted input.


Certain

NETGEAR

devices

are

affected

by

command

injection

by

an

unauthenticated

attacker.

This

affects

before

before

before

before

before

before

before

before

before

before

and

before


** UNSUPPORTED WHEN ASSIGNED ** EVOLUCARE ECSIMAGING (aka ECS Imaging) through 6.21.5 has an OS Command Injection vulnerability via shell metacharacters and an IFS manipulation. The parameter \file\ on the webpage /showfile.php can be exploited to gain root access. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.


On

Netshield

NANO

devices

allows

OS

command

injection

(after

authentication

by

the

attacker)

because

the

system

C

library

function

is

used

unsafely.


KLog Server through 2.4.1 allows authenticated command injection. async.php calls shell_exec() on the original value of the source parameter.


The async-git package before 1.13.2 for Node.js allows OS Command Injection via shell metacharacters as demonstrated by git.reset and git.tag.


An issue was discovered in SaltStack Salt before 3002.5. Sending crafted web requests to the Salt API can result in salt.utils.thin.gen_thin() command injection because of different handling of single versus double quotes. This is related to salt/utils/thin.py.


Vulnerability

in

`rand-quote`

and

`hitokoto`

plugins

**Description**:

the

`rand-quote`

and

`hitokoto`

fetch

quotes

from

quotationspage.com

and

hitokoto.cn

respectively

do

some

process

on

them

and

then

use

`print

-P`

to

print

them.

If

these

quotes

contained

the

proper

symbols

they

could

trigger

command

injection.

Given

that

they're

an

external

API

it's

not

possible

to

know

if

the

quotes

are

safe

to

use.

**Fixed

in**:

**Impacted

areas**:

`rand-quote`

plugin

(`quote`

function).

`hitokoto`

plugin

(`hitokoto`

function).


A flaw was found in SSSD where the sssctl command was vulnerable to shell command injection via the logs-fetch and cache-expire subcommands. This flaw allows an attacker to trick the root user into running a specially crafted sssctl command such as via sudo to gain root access. The highest threat from this vulnerability is to confidentiality integrity as well as system availability.


A command injection vulnerability was reported in the Integrated Management Module (IMM) of legacy IBM System x 3550 M3 and IBM System x 3650 M3 servers that could allow the execution of operating system commands over an authenticated SSH or Telnet session.


An OS command injection vulnerability in the Palo Alto Networks PAN-OS command line interface (CLI) enables an authenticated administrator with access to the CLI to execute arbitrary OS commands to escalate privileges. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.20-h1; PAN-OS 9.0 versions earlier than PAN-OS 9.0.14-h3; PAN-OS 9.1 versions earlier than PAN-OS 9.1.11-h2; PAN-OS 10.0 versions earlier than PAN-OS 10.0.8; PAN-OS 10.1 versions earlier than PAN-OS 10.1.3. Prisma Access customers that have Prisma Access 2.1 firewalls are impacted by this issue.


An OS command injection vulnerability in the Palo Alto Networks PAN-OS web interface enables an authenticated administrator to execute arbitrary OS commands to escalate privileges. This issue impacts: PAN-OS 9.0 version 9.0.10 through PAN-OS 9.0.14; PAN-OS 9.1 version 9.1.4 through PAN-OS 9.1.10; PAN-OS 10.0 version 10.0.7 and earlier PAN-OS 10.0 versions; PAN-OS 10.1 version 10.1.0 through PAN-OS 10.1.1. Prisma Access firewalls and firewalls running PAN-OS 8.1 versions are not impacted by this issue.


A flaw was found in Ansible where a user's controller is vulnerable to template injection. This issue can occur through facts used in the template if the user is trying to put templates in multi-line YAML strings and the facts being handled do not routinely include special template characters. This flaw allows attackers to perform command injection which discloses sensitive information. The highest threat from this vulnerability is to confidentiality and integrity.


An OS command injection vulnerability in the Palo Alto Networks PAN-OS web interface enables an authenticated administrator with permissions to use XML API the ability to execute arbitrary OS commands to escalate privileges. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.20-h1; PAN-OS 9.0 versions earlier than PAN-OS 9.0.14-h3; PAN-OS 9.1 versions earlier than PAN-OS 9.1.11-h2; PAN-OS 10.0 versions earlier than PAN-OS 10.0.8; PAN-OS 10.1 versions earlier than PAN-OS 10.1.3. This issue does not impact Prisma Access firewalls.


Vulnerability in dirhistory plugin Description: the widgets that go back and forward in the directory history triggered by pressing Alt-Left and Alt-Right use functions that unsafely execute eval on directory names. If you cd into a directory with a carefully-crafted name then press Alt-Left the system is subject to command injection. Impacted areas: - Functions pop_past and pop_future in dirhistory plugin.


D-Link router DSL-2750U with firmware vME1.16 or prior versions is vulnerable to OS command injection. An unauthenticated attacker on the local network may exploit this with CVE-2021-3707 to execute any OS commands on the vulnerable device.


Multiple vulnerabilities in the web-based management interface of Cisco HyperFlex HX could allow an unauthenticated remote attacker to perform command injection attacks against an affected device. For more information about these vulnerabilities see the Details section of this advisory.


Multiple vulnerabilities in Cisco SD-WAN products could allow an authenticated attacker to perform command injection attacks against an affected device which could allow the attacker to take certain actions with root privileges on the device. For more information about these vulnerabilities see the Details section of this advisory.


Multiple vulnerabilities in the web UI and API endpoints of Cisco Application Policy Infrastructure Controller (APIC) or Cisco Cloud APIC could allow a remote attacker to perform a command injection or file upload attack on an affected system. For more information about these vulnerabilities see the Details section of this advisory.


A vulnerability in Cisco IOx application hosting environment of Cisco IOS XE Software could allow an authenticated remote attacker to inject commands into the underlying operating system as the root user. This vulnerability is due to incomplete validation of fields in the application packages loaded onto IOx. An attacker could exploit this vulnerability by creating a crafted application .tar file and loading it onto the device. A successful exploit could allow the attacker to perform command injection into the underlying operating system as the root user.


A vulnerability in Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructure (ACI) mode could allow an authenticated local attacker to elevate privileges on an affected device. This vulnerability is due to insufficient restrictions during the execution of a specific CLI command. An attacker with administrative privileges could exploit this vulnerability by performing a command injection attack on the vulnerable command. A successful exploit could allow the attacker to access the underlying operating system as root.


A command injection vulnerability in install package validation subsystem of Juniper Networks Junos OS that may allow a locally authenticated attacker with privileges to execute commands with root privilege. To validate a package in Junos before installation an administrator executes the command 'request system software add validate-on-host' via the CLI. An attacker with access to this CLI command may be able to exploit this vulnerability. This issue affects Juniper Networks Junos OS: all versions prior to 17.3R3-S10; 17.4 versions prior to 17.4R2-S12 17.4R3-S3; 18.1 versions prior to 18.1R3-S11; 18.2 versions prior to 18.2R2-S8 18.2R3-S6; 18.3 versions prior to 18.3R3-S4; 18.4 versions prior to 18.4R1-S8 18.4R2-S7 18.4R3-S6; 19.1 versions prior to 19.1R1-S6 19.1R2-S2 19.1R3-S3; 19.2 versions prior to 19.2R3-S1; 19.3 versions prior to 19.3R2-S5 19.3R3-S1; 19.4 versions prior to 19.4R2-S2 19.4R3-S1; 20.1 versions prior to 20.1R2; 20.2 versions prior to 20.2R1-S2 20.2R2; 20.3 versions prior to 20.3R1-S1 20.3R2.


A command injection vulnerability in the license-check daemon of Juniper Networks Junos OS that may allow a locally authenticated attacker with low privileges to execute commands with root privilege. license-check is a daemon used to manage licenses in Junos OS. To update licenses a user executes the command 'request system license update' via the CLI. An attacker with access to this CLI command may be able to exploit the vulnerability. This issue affects Juniper Networks Junos OS: 17.3 versions prior to 17.3R3-S9; 17.4 versions prior to 17.4R2-S12 17.4R3-S3; 18.1 versions prior to 18.1R3-S11; 18.2 versions prior to 18.2R3-S6; 18.3 versions prior to 18.3R3-S4; 18.4 versions prior to 18.4R3-S6; 19.1 versions prior to 19.1R1-S6 19.1R2-S2 19.1R3-S3; 19.2 versions prior to 19.2R3-S1; 19.3 versions prior to 19.3R2-S5 19.3R3; 19.4 versions prior to 19.4R2-S2 19.4R3; 20.1 versions prior to 20.1R1-S4 20.1R2; 20.2 versions prior to 20.2R1-S2 20.2R2.


A command injection vulerability found in quick game engine allows arbitrary remote code in quick app. Allows remote attacke0rs to gain arbitrary code execution in quick game engine


This affects the package celery before 5.2.2. It by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend the data is deserialized. Given that an attacker can gain access to or somehow manipulate the metadata within a celery backend they could trigger a stored command injection vulnerability and potentially gain further access to the system.


There is remote authenticated OS command injection on TP-Link Archer C20i 0.9.1 3.2 v003a.0 Build 170221 Rel.55462n devices vie the X_TP_ExternalIPv6Address HTTP parameter allowing a remote attacker to run arbitrary commands on the router with root privileges.


Embedded web server command injection vulnerability in Lexmark devices through 2021-12-07.


Git-it through 4.4.0 allows OS command injection at the Branches Aren't Just For Birds challenge step. During the verification process it attempts to run the reflog command followed by the current branch name (which is not sanitized for execution).


Multiple Tenda devices are affected by authentication bypass such as AC15V1.0 Firmware V15.03.05.20_multi?AC5V1.0 Firmware V15.03.06.48_multi and so on. an attacker can obtain sensitive information and even combine it with authenticated command injection to implement RCE.


A command injection vulnerability has been reported to affect QNAP NAS running QuTScloud QuTS hero and QTS. If exploited this vulnerability allows remote attackers to run arbitrary commands. We have already fixed this vulnerability in the following versions of QuTScloud QuTS hero and QTS: QuTScloud c5.0.1.1949 and later QuTS hero h5.0.0.1986 build 20220324 and later QTS 5.0.0.1986 build 20220324 and later


The network address administrative settings web portal for the Zoom on-premise Meeting Connector before version 4.6.360.20210325 Zoom on-premise Meeting Connector MMR before version 4.6.360.20210325 Zoom on-premise Recording Connector before version 3.8.44.20210326 Zoom on-premise Virtual Room Connector before version 4.4.6752.20210326 and Zoom on-premise Virtual Room Connector Load Balancer before version 2.5.5495.20210326 fails to validate input sent in requests to update the network configuration which could lead to remote command injection on the on-premise image by the web portal administrators.


A command injection vulnerability has been reported to affect QNAP device running QVR. If exploited this vulnerability could allow remote attackers to run arbitrary commands. We have already fixed this vulnerability in the following versions of QVR: QVR 5.1.5 build 20210902 and later


A command injection vulnerability has been reported to affect QNAP device running Media Streaming add-on. If exploited this vulnerability allow remote attackers to run arbitrary commands. We have already fixed this vulnerability in the following versions of Media Streaming add-on: QTS 5.0.0: Media Streaming add-on 500.0.0.3 ( 2021/08/20 ) and later QTS 4.5.4: Media Streaming add-on 500.0.0.3 ( 2021/08/20 ) and later QTS 4.3.6: Media Streaming add-on 430.1.8.12 ( 2021/08/20 ) and later QTS 4.3.3: Media Streaming add-on 430.1.8.12 ( 2021/09/29 ) and later QuTS-Hero 5.0.0: Media Streaming add-on 500.0.0.3 ( 2021/08/20 ) and later


The network proxy page on the web portal for the Zoom On-Premise Meeting Connector Controller before version 4.6.365.20210703 Zoom On-Premise Meeting Connector MMR before version 4.6.365.20210703 Zoom On-Premise Recording Connector before version 3.8.45.20210703 Zoom On-Premise Virtual Room Connector before version 4.4.6868.20210703 and Zoom On-Premise Virtual Room Connector Load Balancer before version 2.5.5496.20210703 fails to validate input sent in requests to set the network proxy password. This could lead to remote command injection by a web portal administrator.


A command injection vulnerability has been reported to affect QNAP device running QVR. If exploited this vulnerability could allow remote attackers to run arbitrary commands. We have already fixed this vulnerability in the following versions of QVR: QVR 5.1.5 build 20210803 and later


The network proxy page on the web portal for the Zoom on-premise Meeting Connector Controller before version 4.6.348.20201217 Zoom on-premise Meeting Connector MMR before version 4.6.348.20201217 Zoom on-premise Recording Connector before version 3.8.42.20200905 Zoom on-premise Virtual Room Connector before version 4.4.6620.20201110 and Zoom on-premise Virtual Room Connector Load Balancer before version 2.5.5495.20210326 fails to validate input sent in requests to update the network proxy configuration which could lead to remote command injection on the on-premise image by a web portal administrator.


Multiple vulnerabilities in the web-based management interface of the Cisco Catalyst Passive Optical Network (PON) Series Switches Optical Network Terminal (ONT) could allow an unauthenticated remote attacker to perform the following actions: Log in with a default credential if the Telnet protocol is enabled Perform command injection Modify the configuration For more information about these vulnerabilities see the Details section of this advisory.


Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the web interface. The vulnerability could allow a specially crafted HTTP request to execute system commands on the CommandPost and return results in an HTTP response in an authenticated session. The vulnerability is present in Fidelis Network and Deception versions prior to 9.3.7 and in version 9.4. Patches and updates are available to address this vulnerability.


Certain

NETGEAR

devices

are

affected

by

command

injection

by

an

authenticated

user.

This

affects

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

command

injection

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

command

injection

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

command

injection

by

an

unauthenticated

attacker.

This

affects

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

command

injection

by

an

unauthenticated

attacker.

This

affects

before

before

before

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

command

injection

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

command

injection

by

an

unauthenticated

attacker.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

command

injection

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

command

injection

by

an

unauthenticated

attacker.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

command

injection

by

an

unauthenticated

attacker.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


NETGEAR D6220 devices before 1.0.0.76 are affected by command injection by an authenticated user.


Certain

NETGEAR

devices

are

affected

by

command

injection

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

before

before

and

before


Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects CBR750 before 4.6.3.6 RBK852 before 3.2.17.12 RBR850 before 3.2.17.12 and RBS850 before 3.2.17.12.


Certain NETGEAR devices are affected by command injection by an authenticated user. This affects R7000 before 1.0.11.126 R6900P before 1.3.2.126 and R7000P before 1.3.2.126.


Certain

NETGEAR

devices

are

affected

by

command

injection

by

an

unauthenticated

attacker.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


Certain NETGEAR devices are affected by command injection by an authenticated user. This affects CBR40 before 2.5.0.24 CBR750 before 4.6.3.6 RBR850 before 3.2.17.12 RBS850 before 3.2.17.12 and RBS850 before 3.2.17.12.


Certain

NETGEAR

devices

are

affected

by

command

injection

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

command

injection

by

an

unauthenticated

attacker.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects R7800 before 1.0.2.74 R9000 before 1.0.5.2 and XR500 before 2.3.2.66.


Certain

NETGEAR

devices

are

affected

by

command

injection

by

an

authenticated

user.

This

affects

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

command

injection

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

before

before

before

before

before

and

before


Multiple versions of GARO Wallbox GLB/GTB/GTC are affected by unauthenticated command injection. The url parameter of the function module downloadAndUpdate is vulnerable to an command Injection. Unfiltered user input is used to generate code which then gets executed when downloading new firmware.


Certain

NETGEAR

devices

are

affected

by

command

injection

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

command

injection

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


lib/cmd.js in the node-windows package before 1.0.0-beta.6 for Node.js allows command injection via the PID parameter.


Certain

NETGEAR

devices

are

affected

by

command

injection

by

an

unauthenticated

attacker.

This

affects

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

command

injection

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects XR300 before 1.0.3.68 R7000P before 1.3.3.140 and R6900P before 1.3.3.140.


Certain

NETGEAR

devices

are

affected

by

command

injection

by

an

unauthenticated

attacker.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

command

injection

by

an

authenticated

user

This

affects

before

before

before

before

before

before

before

before

and

before


Certain NETGEAR devices are affected by command injection by an authenticated user. This affects R7900P before 1.4.2.84 R7960P before 1.4.2.84 and R8000P before 1.4.2.84.


Certain

NETGEAR

devices

are

affected

by

command

injection

by

an

unauthenticated

attacker.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


Certain NETGEAR devices are affected by command injection by an authenticated user. This affects CBR40 before 2.5.0.24 CBR750 before 4.6.3.6 RBK852 before 3.2.17.12 RBR850 before 3.2.17.12 and RBS850 before 3.2.17.12.