CVE-2024-26260

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The functionality for synchronization in HGiga OAKlouds' certain moudules has an OS Command Injection vulnerability, allowing remote attackers to inject system commands within specific request parameters. This enables the execution of arbitrary code on the remote server without permission.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
Hgiga	OAKlouds	>= earlier, < 188
Hgiga	OAKlouds	>= earlier, < 1051
hgiga	oaklouds	< 188; < 1051

References

https://www.chtsecurity.com/news/e456f679-9091-4de4-8f78-9262d20d6a96Third Party Advisory
https://www.twcert.org.tw/tw/cp-132-7673-688b7-1.htmlThird Party Advisory
https://www.chtsecurity.com/news/e456f679-9091-4de4-8f78-9262d20d6a96Third Party Advisory
https://www.twcert.org.tw/tw/cp-132-7673-688b7-1.htmlThird Party Advisory

Timeline

Published: Feb 15, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-262619.8The functionality for file download in HGiga OAKlouds' certain modules contains an Arbitrary File Read and Delete vulnerability. Attackers c CVE-2024-262628.8EBM Technologies Uniweb/SoliPACS WebServer's query functionality lacks proper restrictions of user input, allowing remote attackers authenti CVE-2024-262637.5EBM Technologies RISWEB's specific URL path is not properly controlled by permission, allowing attackers to browse specific pages and query CVE-2024-262649.8EBM Technologies RISWEB's specific query function parameter does not properly restrict user input, and this feature page is accessible witho CVE-2024-262656.5The Image Uploader module in Liferay Portal 7.2.0 through 7.4.3.15, and older unsupported versions, and Liferay DXP 7.4 before update 16, 7.CVE-2024-262665.4Multiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.2.0 through 7.4.3.13, and older unsupported versions, and Lif CVE-2024-262675.3In Liferay Portal 7.2.0 through 7.4.3.25, and older unsupported versions, and Liferay DXP 7.4 before update 26, 7.3 before update 5, 7.2 bef CVE-2024-262685.3User enumeration vulnerability in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported versions, and Liferay DXP 7.4 before update 2 CVE-2024-262696.1Cross-site scripting (XSS) vulnerability in the Frontend JS module's portlet.js in Liferay Portal 7.2.0 through 7.4.3.37, and Liferay DXP 7.CVE-2024-26278.8Use after free in Canvas in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to potentially exploit heap corruption via a craf CVE-2024-262705.3The Account Settings page in Liferay Portal 7.4.3.76 through 7.4.3.99, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 76 through 92 CVE-2024-262718.8Cross-site request forgery (CSRF) vulnerability in the My Account widget in Liferay Portal 7.4.3.75 through 7.4.3.111, and Liferay DXP 2023.