585 matches found
CVE-2018-14558
An issue was discovered on Tenda AC7 devices with firmware through V15.03.06.44CNAC7, AC9 devices with firmware through V15.03.05.196318CNAC9, and AC10 devices with firmware through V15.03.06.23CNAC10. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a craft...
CVE-2018-13802
A vulnerability has been identified in ROX II All versions V2.12.1. An authenticated attacker with a high-privileged user account access via SSH could circumvent restrictions in place and execute arbitrary operating system commands. Successful exploitation requires that the attacker has network...
Command injection
A command injection vulnerability in the web server functionality of Moxa EDR-810 V4.2 build 18041013 allows remote attackers to execute arbitrary OS commands with root privilege via the caname parameter to the /xml/netWebCADELETEGetValue URI...
Input validation
Ubuntu14.04 ORCA Online Receipt Computer Advantage 4.8.0 panda-server 1:1.4.9+p41-u4jma1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via unspecified vectors...
CVE-2018-15887
MainAnalysisContent.asp in ASUS DSL-N12EC1 1.1.2.3345 is prone to Authenticated Remote Command Execution, which allows a remote attacker to execute arbitrary OS commands via service parameters, such as shell metacharacters in the destIP parameter of a cmdMethod=ping request...
Node.js third-party modules: Command Injection is ps Package
I would like to report a command injection in ps package. It allows attacker to inject arbitrary OS commands instead of PID numbers. Module module name: ps version: 0.0.2 npm page: https://www.npmjs.com/package/ps Module Description A Node.js module for looking up running processes. Module Stats ...
Command injection
An OS command injection vulnerability in the web administration component of Micro Focus Secure Messaging Gateway SMG allows a remote attacker authenticated as a privileged user to execute arbitrary OS commands on the SMG server. This can be exploited in conjunction with CVE-2018-12464 to achieve...
CVE-2018-4859
CVE-2018-4859 affects SIEMENS SCALANCE M875 devices. A vulnerability allows an authenticated remote attacker with access to the web interface (443/tcp) to execute arbitrary operating system commands. Successful exploitation requires network access to the web interface and administrative credentia...
CVE-2018-4859
A vulnerability has been identified in SCALANCE M875 All versions. An authenticated remote attacker with access to the web interface 443/tcp, could execute arbitrary operating system commands. Successful exploitation requires that the attacker has network access to the web interface. The attacker...
CVE-2018-0569
baserCMS baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions allows remote authenticated attackers to execute arbitrary OS commands via unspecified vectors...
Nikto 2.1.6 CSV Injection
Exploit Title: Nikto 2.1.6 - CSV Injection Google Dork: N/A Date: 2018-06-01 Exploit Author: Adam Greenhill Vendor Homepage: https://cirt.net/Nikto2 Software Link: https://github.com/sullo/nikto Affected Version: 2.1.6, 2.1.5 Category: Applications Tested on: Kali Linux 4.14 x64 CVE :...
CVE-2017-3936
OS Command Injection vulnerability in McAfee ePolicy Orchestrator ePO 5.9.0, 5.3.2, 5.3.1, 5.1.3, 5.1.2, 5.1.1, and 5.1.0 allows attackers to run arbitrary OS commands with limited privileges via not sanitizing the user input data before exporting it into a CSV format output...
Design/Logic Flaw
QNAP NAS application Proxy Server through version 1.2.0 allows remote attackers to run arbitrary OS commands against the system with root privileges...
HPE iMC 7.3 - Remote Code Execution (Metasploit)
Exploit Title: HPE iMC EL Injection Unauthenticated RCE Date: 6 February, 2018 Exploit Author: TrendyTofu Vendor Homepage: https://www.hpe.com/us/en/home.html Software Link: http://h10145.www1.hpe.com/Downloads/SoftwareReleases.aspx?ProductNumber=JG747AAE&lang=en&cc=us&prodSeriesId=4176535 Versio...
CVE-2018-0545
LXR version 1.0.0 to 2.3.0 allows remote attackers to execute arbitrary OS commands via unspecified vectors...
CVE-2018-0545
CVE-2018-0545 concerns LXR, version 1.0.0 through 2.3.0. The connected sources confirm a remote OS command injection vulnerability (CWE-78) that could allow an attacker to execute arbitrary commands on a server running the affected LXR releases. The vulnerability arises in LXR’s handling of input...
CVE-2018-6911
The VBWinExec function in Node\AspVBObj.dll in Advantech WebAccess 8.3.0 allows remote attackers to execute arbitrary OS commands via a single argument aka the command parameter...
CVE-2018-6911
The VBWinExec function in Node\AspVBObj.dll in Advantech WebAccess 8.3.0 allows remote attackers to execute arbitrary OS commands via a single argument aka the command parameter...