Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
An OS command injection vulnerability exists due to insufficient
sanitization of user-supplied input. The application accepts parameters
that are later incorporated into OS commands without adequate
validation. This could allow an unauthenticated attacker to execute
arbitrary commands remotely.
Opis źródłowy NVD · ENCVSS 10,0 · EPSS 2,4 % · rekomendacja wg zapisanej polityki
An OS command injection vulnerability exists due to incomplete
validation of user-supplied input. Validation fails to enforce
sufficient formatting rules, which could permit attackers to append
arbitrary data. This could allow an unauthenticated attacker to inject
arbitrary commands.
Opis źródłowy NVD · ENCVSS 10,0 · EPSS 2,4 % · rekomendacja wg zapisanej polityki
DB-GPT v0.8.1 contains an unauthenticated path traversal vulnerability that allows remote attackers to write arbitrary files to any location on the server by injecting directory traversal sequences into the user_id HTTP header of the Python file-upload endpoint. Attackers can send a crafted…
Opis źródłowy NVD · ENCVSS 9,3 · EPSS 5,7 % · rekomendacja wg zapisanej polityki
A security vulnerability has been detected in TOTOLINK X6000R 9.4.0cu.652_B20230116. The impacted element is the function firmware_check of the file /cgi-bin/cstecgi.cgi of the component UploadFirmwareFile Handler. Such manipulation of the argument file_name leads to os command injection. The…
Opis źródłowy NVD · ENCVSS 10,0 · EPSS 2,13 % · rekomendacja wg zapisanej polityki
office-converter through 1.0.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying a crafted fileName to generatePdf() or generateHtml(). Attackers can embed $(...), backticks, or a closing quote with shell metacharacters in the file name, which is…
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 3,04 % · rekomendacja wg zapisanej polityki
The Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … plugin for WordPress is vulnerable to Authentication Bypass via a Hardcoded Backdoor in version 10.8.7. The vulnerability exists because the `_arve_uc_init()` function — registered on WordPress's `init` hook at…
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 2,98 % · rekomendacja wg zapisanej polityki
Meshtastic is an open source mesh networking solution. Prior to version 2.7.21.1370b23, the Meshtastic GitHub repository's main_matrix.yml workflow is triggered by pull_request_target and multiple jobs check out the attacker's fork code and execute it with access to repository secrets and…
Opis źródłowy NVD · ENCVSS 10,0 · EPSS 1,8 % · rekomendacja wg zapisanej polityki
win-cli-mcp-server resolveCommandPath Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of win-cli-mcp-server. Authentication is not required to exploit this vulnerability.
The specific flaw exists…
Opis źródłowy NVD · ENCVSS 9,8 · EPSS 2,77 % · rekomendacja wg zapisanej polityki
CVSS
9,8
EPSS
2,77 %
Poprawka
Status poprawki nieustalony
Publikacja
Aktualizacja NVD
Podatności: opis, rekomendacja, CVSS, EPSS i daty źródłowe. Rekomendacja nie potwierdza podatności własnego zasobu.
An OS command injection vulnerability exists due to insufficient
sanitization of user-supplied input. The application accepts parameters
that are later incorporated into OS commands without adequate
validation. This could allow an unauthenticated attacker to execute
arbitrary commands remotely.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 10,0 · EPSS 2,4 % · rekomendacja wg zapisanej polityki
An OS command injection vulnerability exists due to incomplete
validation of user-supplied input. Validation fails to enforce
sufficient formatting rules, which could permit attackers to append
arbitrary data. This could allow an unauthenticated attacker to inject
arbitrary commands.
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 10,0 · EPSS 2,4 % · rekomendacja wg zapisanej polityki
DB-GPT v0.8.1 contains an unauthenticated path traversal vulnerability that allows remote attackers to write arbitrary files to any location on the server by injecting directory traversal sequences into the user_id HTTP header of the Python file-upload endpoint. Attackers can send a crafted…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,3 · EPSS 5,7 % · rekomendacja wg zapisanej polityki
A security vulnerability has been detected in TOTOLINK X6000R 9.4.0cu.652_B20230116. The impacted element is the function firmware_check of the file /cgi-bin/cstecgi.cgi of the component UploadFirmwareFile Handler. Such manipulation of the argument file_name leads to os command injection. The…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 10,0 · EPSS 2,13 % · rekomendacja wg zapisanej polityki
office-converter through 1.0.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying a crafted fileName to generatePdf() or generateHtml(). Attackers can embed $(...), backticks, or a closing quote with shell metacharacters in the file name, which is…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,8 · EPSS 3,04 % · rekomendacja wg zapisanej polityki
The Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … plugin for WordPress is vulnerable to Authentication Bypass via a Hardcoded Backdoor in version 10.8.7. The vulnerability exists because the `_arve_uc_init()` function — registered on WordPress's `init` hook at…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,8 · EPSS 2,98 % · rekomendacja wg zapisanej polityki
Meshtastic is an open source mesh networking solution. Prior to version 2.7.21.1370b23, the Meshtastic GitHub repository's main_matrix.yml workflow is triggered by pull_request_target and multiple jobs check out the attacker's fork code and execute it with access to repository secrets and…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 10,0 · EPSS 1,8 % · rekomendacja wg zapisanej polityki
win-cli-mcp-server resolveCommandPath Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of win-cli-mcp-server. Authentication is not required to exploit this vulnerability.
The specific flaw exists…
Opis źródłowy NVD · EN
W tym tygodniu
CVSS 9,8 · EPSS 2,77 % · rekomendacja wg zapisanej polityki
9,8
2,77 %
Publikacja
Aktualizacja NVD
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.