Linux 13140
Google 12536
Microsoft 12379
Oracle 6843
Apple 6692
Adobe 6387
Ibm 6336
Cisco 5759
Debian 3919
Mozilla 2895
Apache 2864
Redhat 2592
This affects all versions of package npos-tesseract. The injection point is located in line 55 in lib/ocr.js.
The package get-npm-package-version before 1.0.7 are vulnerable to Command Injection via main function in index.js.
Improper neutralization of special elements used in a user input allows an authenticated malicious user to perform remote code execution in the host …
Realtek rtl819x-SDK before v3.6.1 allows command injection over the web interface.
Input passed to the Pdf() function is shell escaped and passed to child_process.exec() during PDF rendering. However, the shell escape does not prope…
This affects all versions of package ffmpeg-sdk. The injection point is located in line 9 in index.js.
This affects all versions of package google-cloudstorage-commands.
This affects all versions of package deferred-exec. The injection point is located in line 42 in lib/deferred-exec.js
This affects all versions of package sonar-wrapper. The injection point is located in lib/sonarRunner.js.
This affects all versions of package npm-help. The injection point is located in line 13 in index.js file in export.latestVersion() function.
The package ntesseract before 0.2.9 are vulnerable to Command Injection via lib/tesseract.js.
This affects all versions of package xopen. The injection point is located in line 14 in index.js in the exported function xopen(filepath)
All versions of package git-archive are vulnerable to Command Injection via the exports function.
The affected product is vulnerable to two instances of command injection, which may allow an attacker to remotely execute arbitrary code.
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of Special Elements used in a Command ('Comma…
Roxy-WI is a Web interface for managing HAProxy, Nginx and Keepalived servers. Prior to version 6.1.1.0, the system command can be run remotely via t…
A vulnerability has been identified in SIMATIC CP 1242-7 V2 (All versions < V3.3.46), SIMATIC CP 1243-1 (All versions < V3.3.46), SIMATIC CP 1243-7 L…
A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < 2.15.1), RUGGEDCOM ROX MX5000RE (All versions < 2.15.1), RUGGEDCOM ROX RX…
TOTOLINK EX300_V2 V4.0.3c.7484 was discovered to contain a command injection vulnerability via the langType parameter in the setLanguageCfg function.…
Wavlink WL-WN575A3 RPT75A3.V4300.201217 was discovered to contain a command injection vulnerability via the function obtw. This vulnerability allows …
Totolink A830R V5.9c.4729_B20191112, Totolink A3100R V4.1.2cu.5050_B20200504, Totolink A950RG V4.1.2cu.5161_B20200903, Totolink A800R V4.1.2cu.5137_B…
The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability. Due to the insufficient input validat…
ASUS RT-N53 3.0.0.4.376.3754 has a command injection vulnerability in the SystemCmd parameter of the apply.cgi interface.
Dashboards in Splunk Enterprise versions before 9.0 might let an attacker inject risky search commands into a form token when the token is used in a …
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). The affected application contains a file upload server tha…
Debian Linux
HIGH 8.8
PhoneSystem Terminal in 3CX Phone System (Debian based installation) 16.0.0.1570 allows an authenticated attacker to run arbitrary commands with the …
A vulnerability classified as critical has been found in SevOne Network Management System up to 5.7.2.22. This affects the file traceroute.php of the…
LibreNMS v22.3.0 was discovered to contain multiple command injection vulnerabilities via the service_ip, hostname, and service_param parameters.
sharp is an application for Node.js image processing. Prior to version 0.30.5, there is a possible vulnerability in logic that is run only at `npm in…
go-getter up to 1.5.11 and 2.0.2 allowed arbitrary host access via go-getter path traversal, symlink processing, and command injection flaws. Fixed i…