CVE-2020-5636

Aterm SA3500G firmware versions prior to Ver. 3.5.9 allows an attacker with an administrative privilege to send a specially crafted request to a specific URL, which may result in an arbitrary command execution...

CVE-2020-5635

Aterm SA3500G firmware versions prior to Ver. 3.5.9 allows an attacker on the adjacent network to send a specially crafted request to a specific URL, which may result in an arbitrary command execution...

CVE-2020-5636

Aterm SA3500G firmware versions prior to Ver. 3.5.9 allows an attacker with an administrative privilege to send a specially crafted request to a specific URL, which may result in an arbitrary command execution...

Command injection

Aterm SA3500G firmware versions prior to Ver. 3.5.9 allows an attacker on the adjacent network to send a specially crafted request to a specific URL, which may result in an arbitrary command execution...

Command injection

Aterm SA3500G firmware versions prior to Ver. 3.5.9 allows an attacker with an administrative privilege to send a specially crafted request to a specific URL, which may result in an arbitrary command execution...

CVE-2020-5636

Aterm SA3500G firmware versions prior to Ver. 3.5.9 allows an attacker with an administrative privilege to send a specially crafted request to a specific URL, which may result in an arbitrary command execution...

Liftoff GateOne: Input validation vulnerability

Liftoff GateOne is a terminal emulator and SSH client based on an HTML5 implementation. An arbitrary command execution vulnerability exists in Liftoff GateOne. A remote attacker can exploit this vulnerability to execute arbitrary commands via shell metacharacters in the port field when attempting...

CVE-2020-8283: Improper Privilege Management

An authorised user on a Windows host running Citrix Universal Print Server can perform arbitrary command execution as SYSTEM in CVAD versions before 2009, 1912 LTSR CU1 hotfixes CTX285870 and CTX286120, 7.15 LTSR CU6 hotfix CTX285344 and 7.6 LTSR CU9...

CVE-2020-5636: Improper Neutralization of Special Elements used in an OS Command

Aterm SA3500G firmware versions prior to Ver. 3.5.9 allows an attacker with an administrative privilege to send a specially crafted request to a specific URL, which may result in an arbitrary command execution...

PT-2020-18602

Name of the Vulnerable Software and Affected Versions Aterm SA3500G firmware versions prior to Ver. 3.5.9 Description The issue allows an attacker on the adjacent network to send a specially crafted request to a specific URL, which may result in arbitrary command execution. Recommendations For...

PT-2020-18603

Name of the Vulnerable Software and Affected Versions Aterm SA3500G firmware versions prior to Ver. 3.5.9 Description The issue allows an attacker with administrative privilege to send a specially crafted request to a specific URL, which may result in arbitrary command execution. Recommendations...

CVE-2020-5635: Improper Neutralization of Special Elements used in an OS Command

Aterm SA3500G firmware versions prior to Ver. 3.5.9 allows an attacker on the adjacent network to send a specially crafted request to a specific URL, which may result in an arbitrary command execution...

CVE-2020-15375

Brocade Fabric OS versions before v9.0.0, v8.2.2c, v8.2.1e, v8.1.2k, v8.2.0CBN3, v7.4.2g contain an improper input validation weakness in the command line interface when secccrypptocfg is invoked. The vulnerability could allow a local authenticated user to run arbitrary commands and perform...

Command Injection

Overview curljs is a package that wraps the functionality of curl into an easy to use node module Affected versions of this package are vulnerable to Command Injection. PoC var a=require"curljs"; a"' & touch JHU '" Remediation There is no fixed version for curljs. Credit: JHU System Security Lab...

CVE-2020-7789

CVE-2020-7789 affects the package node-notifier prior to 9.0.0. The flaw allows an attacker to run arbitrary commands on Linux machines because the options params are not sanitised when passed as an array. Remediation: upgrade node-notifier to a fixed version (9.0.0 or newer). The connected docum...

Nec Platforms Aterm SAG firmware Operating System Command Injection Vulnerability

The Nec Platforms Aterm SA3500G is an appliance from Japan's Nec Platforms that provides security for corporate intranet environments. The appliance includes features such as antivirus, firewall, intrusion detection defense, routing, and link layer support. A security vulnerability exists in the...

PT-2020-6158

Name of the Vulnerable Software and Affected Versions node-notifier versions prior to 9.0.0 Description The issue allows an attacker to run arbitrary commands on Linux machines due to the options params not being sanitized when being passed an array. This could enable an attacker to execute...

PT-2020-11234

Name of the Vulnerable Software and Affected Versions QNAP QTS versions prior to 4.5.1.1456 build 20201015 QNAP QTS versions prior to 4.4.3.1354 build 20200702 QNAP QuTS hero versions prior to h4.5.1.1472 build 20201031 Description This command injection vulnerability allows attackers to execute...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in PostgreSQL

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of PostgreSQL. Vulnerability Details CVEID: CVE-2020-14349 DESCRIPTION: PostgreSQL could allow a remote authenticated attacker to execute arbitrary command on the system, caused by improper sanitization of...

Lovecraft pc client suffers from dll hijacking vulnerability

Aqiyi pc client is a client software that focuses on video playback under Aqiyi. There is a dll hijacking vulnerability in Aqiyi pc client, which can be exploited by attackers to execute arbitrary commands...