KATALOG INFORMACJI
Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
Brak sanitizacji nazw plików w handlerze przesyłania plików umożliwia wstrzyknięcie poleceń.
Niekompletna blokada wstrzyknięcia poleceń w GitPython pozwala na wykonanie dowolnych poleceń.
Dell PowerProtect One, versions 20.1.0.0 and below, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote execution.
Deserialization of untrusted data in Microsoft Dynamics 365 allows an authorized attacker to execute code over a network.
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
Deserialization of untrusted data in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network.
Deserializacja niezaufanych danych w Microsoft Office SharePoint umożliwia zdalne wykonanie kodu.
Wstrzyknięcie poleceń w OpenHarness umożliwia zdalne wykonanie komend administracyjnych.
Wstrzyknięcie poleceń w Composerze pozwala na wykonanie dowolnych komend przez złośliwe metadane.
databasement before 1.8.2 allows remote code execution because it runs certain commands (e.g., mariadb-dump) with a database name that can be specified by any authenticated user. For example, --result-file=/app/public/index.php can write to index.php. In other words, quoting prevents OS command…
Przepełnienie bufora w D-Link DIR-600 umożliwia zdalne wykonanie kodu.
Wstrzyknięcie poleceń w COMFAST CF-N1-S umożliwia zdalne wykonanie kodu.
A vulnerability was found in Tenda WH450 1.0.0.18. This affects an unknown function of the file /goform/PPTPDClient of the component HTTP Request Handler. Performing a manipulation of the argument Username results in stack-based buffer overflow. The attack can be initiated remotely. The exploit…
Nagios XI versions prior to 5.4.13 contain a remote code execution vulnerability in the Component Download page. The download/import handler used unsafe command construction with attacker-controlled input and lacked sufficient validation and output encoding, allowing an authenticated user to…
Wstrzyknięcie poleceń w Panabit PAP-XM320 umożliwia wykonanie dowolnych komend z uprawnieniami roota.
Multiple OS Command Injection vulnerabilities exist in the management interface and session processing routines of Brocade Fabric OS versions before 10.0.1. Input processing flaws during remote management connection validation and session verification for directory-based user accounts allow…
OS Command Injection vulnerability in Ruijie RG-YST EST, YSTAP_3.0(1)B11P280YST250F V1.xxV2.xx allowing attackers to execute arbitrary commands via a crafted POST request to the pwdmodify in file /usr/lib/lua/luci/modules/common.lua.
OS Command Injection vulnerability in Ruijie RG-YST AP_3.0(1)B11P280YST250F allowing attackers to execute arbitrary commands via a crafted POST request to the pwdmodify in file /usr/lib/lua/luci/modules/common.lua.
This vulnerability allows an unauthenticated remote attacker with control over the OCPP backend via firewall-bypass to perform an OS command injection, resulting in the execution of arbitrary commands as the limited user charx-oa. Charging could be interrupted.
Dell OpenManage Integration with Microsoft Windows Admin Center, versions prior to 3.7.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability,…
Nagios XI versions prior to 2024R1 contain a missing access control vulnerability via the Web SSH Terminal. A remote, low-privileged attacker could access or interact with the terminal interface without sufficient authorization, potentially allowing unauthorized command execution or disclosure of…
Luka w Wolf CMS umożliwia zdalne wykonanie kodu przez uwierzytelnionych atakujących.
Koha is vulnerable to OS command injection in the Task Scheduler deletion path. The tools/scheduler.pl handler accepts the jobid request parameter for op=cud-delete and passes it to C4::Scheduler::remove_at_job without validating it. Schedule::At::remove substitutes the supplied job ID into an…
Przepełnienie bufora w Wavlink WL-NU516U1 umożliwia zdalne wykonanie kodu.
Przepełnienie bufora w Totolink NR1800X umożliwia zdalne wykonanie kodu.
| Producent / podatność | Opis | Rekomendacja i powód | CVSS | EPSS | Daty źródłowe | Zapis |
|---|---|---|---|---|---|---|
| Brak sanitizacji nazw plików w handlerze przesyłania plików umożliwia wstrzyknięcie poleceń. | Brak sanitizacji nazw plików w handlerze przesyłania plików umożliwia wstrzyknięcie poleceń. |
Obserwuj | 8,7 | 2,24 % | ||
| Niekompletna blokada wstrzyknięcia poleceń w GitPython pozwala na wykonanie dowolnych poleceń. | Niekompletna blokada wstrzyknięcia poleceń w GitPython pozwala na wykonanie dowolnych poleceń. |
W tym tygodniu | 8,7 | 2,21 % | ||
| Dell PowerProtect One, versions 20.1.0.0 and below, contain an Improper Neutralization of Special Elements used in an OS Command ('OS… | Dell PowerProtect One, versions 20.1.0.0 and below, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote execution. |
Obserwuj | 8,8 | 1,7 % | ||
| Deserialization of untrusted data in Microsoft Dynamics 365 allows an authorized attacker to execute code over a network. | Deserialization of untrusted data in Microsoft Dynamics 365 allows an authorized attacker to execute code over a network. |
Obserwuj | 8,8 | 1,69 % | ||
| Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. |
Obserwuj | 8,8 | 1,69 % | ||
| Deserialization of untrusted data in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network. | Deserialization of untrusted data in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network. |
Obserwuj | 8,8 | 1,69 % | ||
| Deserializacja niezaufanych danych w Microsoft Office SharePoint umożliwia zdalne wykonanie kodu. | Deserializacja niezaufanych danych w Microsoft Office SharePoint umożliwia zdalne wykonanie kodu. |
Obserwuj | 8,8 | 1,69 % | ||
| Wstrzyknięcie poleceń w OpenHarness umożliwia zdalne wykonanie komend administracyjnych. | Wstrzyknięcie poleceń w OpenHarness umożliwia zdalne wykonanie komend administracyjnych. |
W tym tygodniu | 8,8 | 1,69 % | ||
| Wstrzyknięcie poleceń w Composerze pozwala na wykonanie dowolnych komend przez złośliwe metadane. | Wstrzyknięcie poleceń w Composerze pozwala na wykonanie dowolnych komend przez złośliwe metadane. |
Obserwuj | 8,8 | 1,69 % | ||
| databasement before 1.8.2 allows remote code execution because it runs certain commands (e.g., mariadb-dump) with a database name that can… | databasement before 1.8.2 allows remote code execution because it runs certain commands (e.g., mariadb-dump) with a database name that can be specified by any authenticated user. For example, --result-file=/app/public/index.php can write to index.php. In other words, quoting prevents OS command… |
Obserwuj | 8,8 | 1,69 % | ||
| Przepełnienie bufora w D-Link DIR-600 umożliwia zdalne wykonanie kodu. | Przepełnienie bufora w D-Link DIR-600 umożliwia zdalne wykonanie kodu. |
W tym tygodniu | 8,9 | 1,18 % | ||
| Wstrzyknięcie poleceń w COMFAST CF-N1-S umożliwia zdalne wykonanie kodu. | Wstrzyknięcie poleceń w COMFAST CF-N1-S umożliwia zdalne wykonanie kodu. |
Obserwuj | 8,5 | 3,18 % | ||
| A vulnerability was found in Tenda WH450 1.0.0.18. | A vulnerability was found in Tenda WH450 1.0.0.18. This affects an unknown function of the file /goform/PPTPDClient of the component HTTP Request Handler. Performing a manipulation of the argument Username results in stack-based buffer overflow. The attack can be initiated remotely. The exploit… |
W tym tygodniu | 8,9 | 1,18 % | ||
| Nagios XI versions prior to 5.4.13 contain a remote code execution vulnerability in the Component Download page. | Nagios XI versions prior to 5.4.13 contain a remote code execution vulnerability in the Component Download page. The download/import handler used unsafe command construction with attacker-controlled input and lacked sufficient validation and output encoding, allowing an authenticated user to… |
Obserwuj | 8,8 | 1,68 % | ||
| Wstrzyknięcie poleceń w Panabit PAP-XM320 umożliwia wykonanie dowolnych komend z uprawnieniami roota. | Wstrzyknięcie poleceń w Panabit PAP-XM320 umożliwia wykonanie dowolnych komend z uprawnieniami roota. |
Obserwuj | 8,8 | 1,67 % | ||
| Multiple OS Command Injection vulnerabilities exist in the management interface and session processing routines of Brocade Fabric OS… | Multiple OS Command Injection vulnerabilities exist in the management interface and session processing routines of Brocade Fabric OS versions before 10.0.1. Input processing flaws during remote management connection validation and session verification for directory-based user accounts allow… |
Obserwuj | 8,8 | 1,67 % | ||
| OS Command Injection vulnerability in Ruijie RG-YST EST, YSTAP_3.0(1)B11P280YST250F V1.xxV2.xx allowing attackers to execute arbitrary… | OS Command Injection vulnerability in Ruijie RG-YST EST, YSTAP_3.0(1)B11P280YST250F V1.xxV2.xx allowing attackers to execute arbitrary commands via a crafted POST request to the pwdmodify in file /usr/lib/lua/luci/modules/common.lua. |
Obserwuj | 8,8 | 1,66 % | ||
| OS Command Injection vulnerability in Ruijie RG-YST AP_3.0(1)B11P280YST250F allowing attackers to execute arbitrary commands via a crafted… | OS Command Injection vulnerability in Ruijie RG-YST AP_3.0(1)B11P280YST250F allowing attackers to execute arbitrary commands via a crafted POST request to the pwdmodify in file /usr/lib/lua/luci/modules/common.lua. |
Obserwuj | 8,8 | 1,66 % | ||
| This vulnerability allows an unauthenticated remote attacker with control over the OCPP backend via firewall-bypass to perform an OS… | This vulnerability allows an unauthenticated remote attacker with control over the OCPP backend via firewall-bypass to perform an OS command injection, resulting in the execution of arbitrary commands as the limited user charx-oa. Charging could be interrupted. |
Obserwuj | 8,8 | 1,66 % | ||
| Dell OpenManage Integration with Microsoft Windows Admin Center, versions prior to 3.7.0, contains an Improper Neutralization of Special… | Dell OpenManage Integration with Microsoft Windows Admin Center, versions prior to 3.7.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability,… |
Obserwuj | 8,8 | 1,66 % | ||
| Nagios XI versions prior to 2024R1 contain a missing access control vulnerability via the Web SSH Terminal. | Nagios XI versions prior to 2024R1 contain a missing access control vulnerability via the Web SSH Terminal. A remote, low-privileged attacker could access or interact with the terminal interface without sufficient authorization, potentially allowing unauthorized command execution or disclosure of… |
Obserwuj | 8,8 | 1,66 % | ||
| Luka w Wolf CMS umożliwia zdalne wykonanie kodu przez uwierzytelnionych atakujących. | Luka w Wolf CMS umożliwia zdalne wykonanie kodu przez uwierzytelnionych atakujących. |
Obserwuj | 8,7 | 2,13 % | ||
| Koha is vulnerable to OS command injection in the Task Scheduler deletion path. | Koha is vulnerable to OS command injection in the Task Scheduler deletion path. The tools/scheduler.pl handler accepts the jobid request parameter for op=cud-delete and passes it to C4::Scheduler::remove_at_job without validating it. Schedule::At::remove substitutes the supplied job ID into an… |
Obserwuj | 8,8 | 1,61 % | ||
| Przepełnienie bufora w Wavlink WL-NU516U1 umożliwia zdalne wykonanie kodu. | Przepełnienie bufora w Wavlink WL-NU516U1 umożliwia zdalne wykonanie kodu. |
Obserwuj | 8,9 | 1,1 % | ||
| Przepełnienie bufora w Totolink NR1800X umożliwia zdalne wykonanie kodu. | Przepełnienie bufora w Totolink NR1800X umożliwia zdalne wykonanie kodu. |
Obserwuj | 8,9 | 1,1 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.