CVE-2020-6779

Use of Hard-coded Credentials in the database of Bosch FSM-2500 server and Bosch FSM-5000 server up to and including version 5.2 allows an unauthenticated remote attacker to log into the database with admin-privileges. This may result in complete compromise of the confidentiality and integrity of...

Hardcoded credentials

Use of Hard-coded Credentials in the database of Bosch FSM-2500 server and Bosch FSM-5000 server up to and including version 5.2 allows an unauthenticated remote attacker to log into the database with admin-privileges. This may result in complete compromise of the confidentiality and integrity of...

Command injection

Zen Cart 1.5.7b allows admins to execute arbitrary OS commands by inspecting an HTML radio input element within the modules edit page and inserting a command...

CVE-2020-23160

Remote code execution in Pyrescom Termod4 time management devices before 10.04k allows authenticated remote attackers to arbitrary commands as root on the devices...

Command Injection

Overview deferred-exec is a tool to run exec commands. Lets you use exec, execFile and spawn in a sane way. Affected versions of this package are vulnerable to Command Injection. The injection point is located in line 42 in lib/deferred-exec.js PoC var a = require"deferred-exec"; a" touch JHU ",;...

CVE-2020-6779

CVE-2020-6779 affects Bosch FSM-2500 and FSM-5000 servers (up to v5.2). The root cause is hard-coded credentials in the database, enabling an unauthenticated remote attacker to log in with admin privileges. Impact stated: complete compromise of confidentiality and integrity of stored data and hig...

CVE-2020-6779 Hard-coded Credentials in the Database of Bosch FSM-2500 Server and Bosch FSM-5000 Server

Use of Hard-coded Credentials in the database of Bosch FSM-2500 server and Bosch FSM-5000 server up to and including version 5.2 allows an unauthenticated remote attacker to log into the database with admin-privileges. This may result in complete compromise of the confidentiality and integrity of...

D-Link DNS-320 ShareCenter Command Injection (CVE-2019-16057)

A command injection vulnerability exists in D-Link DNS-320 ShareCenter. Successful exploitation of this vulnerability could allow a remote unauthenticated attacker to execute arbitrary commands on the affected system...

Contact Form 7 Database Addon < 1.2.5.6 - CSV Injection

The plugin was prone to a vulnerability that lets remote attackers inject arbitrary formulas into CSV files. Attackers can possibly exploit this issue to execute arbitrary commands on the victim's system, by the use of Microsoft Excel DDE function, or to leak data via maliciously injected...

Command Execution Vulnerability in phpok

PHPOK is a website building content management system to achieve customized open source free website building cms system. phpok there is a command execution vulnerability , an attacker can exploit the vulnerability to execute arbitrary commands...

IBM Security Guardium Command Injection Vulnerability

IBM Security Guardium is a comprehensive data protection solution that provides comprehensive data security capabilities from compliance support to dynamic data shielding. A command injection vulnerability exists in IBM Security Guardium 10.6, 11.2. A local attacker could exploit this vulnerabili...

Cisco Smart Software Manager Satellite Web UI Command Injection Vulnerability (CNVD-2021-09936)

Cisco Smart Software Manager Satellite is software designed to provide intelligent management of licenses. A command injection vulnerability exists in the WEB UI of Cisco Smart Software Manager Satellite 5.1.0 and prior versions. The vulnerability stems from the program not properly validating...

The Guild Graphql Tools Command Injection Vulnerability

The Guild Graphql Tools is a tool from The Guild that generates graphql query statements based on a specific syntax. A command injection vulnerability exists in graphql-tools/git-loader prior to version 6.2.6, which stems from the use of exec and execSync in packages/loaders/git/src/load-git.ts t...

Exploit for OS Command Injection in Linksys Re6500_Firmware

Description Belkin LINKSYS RE6500 devices before 1.0.012.001...

VulnCheck KEV: CVE-2017-1182

IBM Tivoli Monitoring Portal v6 could allow a local network adjacent attacker to execute arbitrary commands on the system, when default client-server default communications, HTTP, are being used. IBM X-Force ID: 123493...

CVE-2021-1138

Multiple vulnerabilities in the web UI of Cisco Smart Software Manager Satellite could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system. For more information about these vulnerabilities, see the Details section of this advisory...

CVE-2021-1139

Multiple vulnerabilities in the web UI of Cisco Smart Software Manager Satellite could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system. For more information about these vulnerabilities, see the Details section of this advisory...

CVE-2021-1142

Multiple vulnerabilities in the web UI of Cisco Smart Software Manager Satellite could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system. For more information about these vulnerabilities, see the Details section of this advisory...

Design/Logic Flaw

Multiple vulnerabilities in the web UI of Cisco Smart Software Manager Satellite could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system. For more information about these vulnerabilities, see the Details section of this advisory...

Design/Logic Flaw

Multiple vulnerabilities in the web UI of Cisco Smart Software Manager Satellite could allow an unauthenticated, remote attacker to execute arbitrary commands on the underlying operating system. For more information about these vulnerabilities, see the Details section of this advisory...