CMSWing Code Execution Vulnerability

CMSWing is a ThinkJS-based e-commerce platform and CMS builder. A code execution vulnerability exists in CMSWing 1.3.8. The vulnerability stems from the log function not checking the log parameter. An attacker can exploit this vulnerability to execute arbitrary commands via malicious parameters...

ThinkJS SQL Injection Vulnerability

ThinkJS is a Node.js framework for future-proof development that integrates a wide range of project best practices to make enterprise-level development easier and more efficient. A SQL injection vulnerability exists in the model.increment and model.decrease functions in ThinkJS 3.2.10. A remote...

Amino Communications EntoneWebEngine Command Injection (CVE-2020-10208)

A command injection vulnerability exists in Amino Communications EntoneWebEngine. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

CVE-2020-20294

An issue was found in CMSWing project version 1.3.8. Because the log function does not check the log parameter, malicious parameters can execute arbitrary commands...

CVE-2020-20294

An issue was found in CMSWing project version 1.3.8. Because the log function does not check the log parameter, malicious parameters can execute arbitrary commands...

Command injection

An issue was found in CMSWing project version 1.3.8. Because the log function does not check the log parameter, malicious parameters can execute arbitrary commands...

Sql injection

An issue was found in CMSWing project version 1.3.8, Because the rechargeAction function does not check the balance parameter, malicious parameters can execute arbitrary SQL commands...

CVE-2020-20294

An issue was found in CMSWing project version 1.3.8. Because the log function does not check the log parameter, malicious parameters can execute arbitrary commands...

CVE-2020-15836

An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.1.5-std devices. The authentication function passes untrusted data to the operating system without proper sanitization. A crafted request can be sent to execute arbitrary commands as root...

Authentication flaw

An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.1.5-std devices. The authentication function passes untrusted data to the operating system without proper sanitization. A crafted request can be sent to execute arbitrary commands as root...

CVE-2020-15836

An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.1.5-std devices. The authentication function passes untrusted data to the operating system without proper sanitization. A crafted request can be sent to execute arbitrary commands as root...

LOGITEC CORPORATION LAN-W300N/PGRB Operating System Command Injection Vulnerability

LOGITEC CORPORATION LAN-W300N/PGRB is a wireless router device. LOGITEC CORPORATION LAN-W300N/PGRB is vulnerable to OS command injection, which can be exploited by attackers to execute arbitrary OS commands via unspecified vectors...

LOGITEC CORPORATION LAN-W300N/PGRB OS Command Injection Vulnerability (CNVD-2021-58248)

LOGITEC CORPORATION LAN-W300N/PGRB is a wireless router device. LOGITEC CORPORATION LAN-W300N/PGRB is vulnerable to OS command injection, which can be exploited by attackers to execute arbitrary OS commands via unspecified vectors...

Deserialization of untrusted data

IBM QRadar SIEM 7.4.0 to 7.4.2 Patch 1 and 7.3.0 to 7.3.3 Patch 7 could allow a remote attacker to execute arbitrary commands on the system, caused by insecure deserialization of user-supplied content by the Java deserialization function. By sending a malicious serialized Java object, an attacker...

CVE-2020-4888

IBM QRadar SIEM 7.4.0 to 7.4.2 Patch 1 and 7.3.0 to 7.3.3 Patch 7 could allow a remote attacker to execute arbitrary commands on the system, caused by insecure deserialization of user-supplied content by the Java deserialization function. By sending a malicious serialized Java object, an attacker...

CVE-2020-4888

IBM QRadar SIEM is vulnerable to deserialization of untrusted data (CVE-2020-4888). Affected versions are QRadar SIEM 7.4.0–7.4.2 Patch 1 and 7.3.0–7.3.3 Patch 7. The issue arises from insecure Java deserialization of user-supplied content, enabling a remote attacker to execute arbitrary commands...

SonicWall Secure Mobile Access Command Injection

A command injection vulnerability exists in SonicWall Secure Mobile Access devices. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

Tp-link TL-WR841N Injection Vulnerability

The Tp-link TL-WR841N is a wireless router from China P&L Tp-link. The TP-Link TL-WR841N suffers from a parameter injection vulnerability that allows a remote authenticated malicious user to execute arbitrary commands on the system, which can be exploited by an attacker to execute arbitrary...

CVE-2021-22159

Insider Threat Management Windows Agent Local Privilege Escalation Vulnerability The Proofpoint Insider Threat Management formerly ObserveIT Agent for Windows before 7.4.3, 7.5.4, 7.6.5, 7.7.5, 7.8.4, 7.9.3, 7.10.2, and 7.11.0.25 as well as versions 7.3 and earlier is missing authentication for a...

CVE-2021-22159

Insider Threat Management Windows Agent Local Privilege Escalation Vulnerability The Proofpoint Insider Threat Management formerly ObserveIT Agent for Windows before 7.4.3, 7.5.4, 7.6.5, 7.7.5, 7.8.4, 7.9.3, 7.10.2, and 7.11.0.25 as well as versions 7.3 and earlier is missing authentication for a...