18169 matches found
CVE-2020-5873
On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.6.1-11.6.5 and BIG-IQ 5.2.0-7.1.0, a user associated with the Resource Administrator role who has access to the secure copy scp utility but does not have access to Advanced Shell bash can execute arbitrary commands...
Authentication flaw
An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate method calls. This allows a remote user to access some methods without authentication. These methods can be used to retrieve user tokens from the...
CVE-2020-11651
An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate method calls. This allows a remote user to access some methods without authentication. These methods can be used to retrieve user tokens from the...
CVE-2020-11651
An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate method calls. This allows a remote user to access some methods without authentication. These methods can be used to retrieve user tokens from the...
Command Injection Vulnerability in DrayTek Vigor Series Routers
The DrayTek Vigor Series routers are dual WAN port security firewall routers designed for mid-sized businesses. A command injection vulnerability exists in the DrayTek Vigor Series routers, which can be exploited by an attacker to execute arbitrary commands to gain privileges on the router...
Huawei EulerOS: Security Advisory for python-pillow (EulerOS-SA-2020-1532)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2019-16011
A vulnerability in the CLI of Cisco IOS XE SD-WAN Software could allow an authenticated, local attacker to inject arbitrary commands that are executed with root privileges. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by authenticating to...
CVE-2019-16011
CVE-2019-16011 affects Cisco IOS XE SD-WAN Software. The issue is due to insufficient input validation in the CLI, allowing an authenticated, local attacker to inject commands that execute with root privileges. Affected component: the CLI utility. Impact per sources: arbitrary command execution w...
CVE-2019-16652
The BPM component in Genius Bytes Genius Server Genius CDDS 3.2.2 allows remote authenticated users to execute arbitrary commands...
Command injection
The BPM component in Genius Bytes Genius Server Genius CDDS 3.2.2 allows remote authenticated users to execute arbitrary commands...
CVE-2019-16652
The CVE-2019-16652 entry concerns Genius Bytes Genius Server (Genius CDDS) BPM component, version 3.2.2, where remote authenticated users can execute arbitrary commands. Multiple connected sources (CNVD-2020-27220; RH: CVE-2019-16652; NVD; CVE records) corroborate that a code/injection-style path...
CVE-2020-7609
node-rules including 3.0.0 and prior to 5.0.0 allows injection of arbitrary commands. The argument rules of function "fromJSON" can be controlled by users without any sanitization...
CVE-2020-7609
node-rules including 3.0.0 and prior to 5.0.0 allows injection of arbitrary commands. The argument rules of function "fromJSON" can be controlled by users without any sanitization...
CVE-2020-7640
pixl-class prior to 1.0.3 allows execution of arbitrary commands. The members argument of the create function can be controlled by users without any sanitization...
CVE-2020-7640
pixl-class prior to 1.0.3 allows execution of arbitrary commands. The members argument of the create function can be controlled by users without any sanitization...
Code injection
pixl-class prior to 1.0.3 allows execution of arbitrary commands. The members argument of the create function can be controlled by users without any sanitization...
CVE-2020-7640
CVE-2020-7640 describes an OS command injection in pixl-class prior to version 1.0.3. The vulnerability arises because the members parameter of the create function is not sanitized, allowing an attacker to execute arbitrary commands. Affected: pixl-class (Node.js module) before 1.0.3. Impact per ...
CVE-2020-11817
The CVE describes a vulnerability in Rukovoditel V2.5.2 where an attacker can upload an arbitrary file by altering the Content-Type, leading to command execution on the server. This occurs in Maintenance Mode and is exposed via a network attack vector with high impact to confidentiality, integrit...
Node.js third-party modules: [wireguard-wrapper] Command Injection via insecure command concatenation
I would like to report a Command Injection issue in the wireguard-wrapper module. It allows to execute arbitrary commands on the victim's PC. Module module name: wireguard-wrapper version: 1.0.2 npm page: https://www.npmjs.com/package/wireguard-wrapper Module Description This project is a nodejs...