CVE-2020-8947

functionsnetflow.php in Artica Pandora FMS 7.0 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the index.php?operation/netflow/nfliveview ipdst, dstport, or srcport parameter, a different vulnerability than CVE-2019-20224...

PT-2020-20384

Name of the Vulnerable Software and Affected Versions Netis WF2471 version 1.2.30142 Description The issue allows an authenticated attacker to execute arbitrary OS commands. This is achieved by using shell metacharacters in the log 3g type parameter of the "/cgi-bin-igd/sys log clean.cgi" API...

CVE-2020-8654

An issue was discovered in EyesOfNetwork 5.3. An authenticated web user with sufficient privileges could abuse the AutoDiscovery module to run arbitrary OS commands via the /module/moduleframe/index.php autodiscovery.php target field...

Command injection

An issue was discovered in EyesOfNetwork 5.3. An authenticated web user with sufficient privileges could abuse the AutoDiscovery module to run arbitrary OS commands via the /module/moduleframe/index.php autodiscovery.php target field...

CVE-2020-8654

An issue was discovered in EyesOfNetwork 5.3. An authenticated web user with sufficient privileges could abuse the AutoDiscovery module to run arbitrary OS commands via the /module/moduleframe/index.php autodiscovery.php target field...

CVE-2020-8654

An issue was discovered in EyesOfNetwork 5.3. An authenticated web user with sufficient privileges could abuse the AutoDiscovery module to run arbitrary OS commands via the /module/moduleframe/index.php autodiscovery.php target field...

PT-2020-20252

Name of the Vulnerable Software and Affected Versions EyesOfNetwork version 5.3 Description An issue allows an authenticated web user with sufficient privileges to abuse the AutoDiscovery module and run arbitrary OS commands via the "module/module frame/index.php autodiscovery.php" target field...

CVE-2020-8438

Ruckus ZoneFlex R500 104.0.0.0.1347 devices allow an authenticated attacker to execute arbitrary OS commands via the hidden /forms/nslookupHandler form, as demonstrated by the nslookuptarget=|cat$IFS substring...

PT-2020-20138

Name of the Vulnerable Software and Affected Versions Ruckus ZoneFlex R500 version 104.0.0.0.1347 Description The issue allows an authenticated attacker to execute arbitrary OS commands via the hidden /forms/nslookupHandler form. This can be demonstrated by using the nslookuptarget parameter with...

CVE-2019-19824: Improper Neutralization of Special Elements used in an OS Command

On certain TOTOLINK Realtek SDK based routers, an authenticated attacker may execute arbitrary OS commands via the sysCmd parameter to the boafrm/formSysCmd URI, even if the GUI syscmd.htm is not available. This allows for full control over the device's internals. This affects A3002RU through...

CVE-2020-7594

MultiTech Conduit MTCDT-LVW2-24XX 1.4.17-ocea-13592 devices allow remote authenticated administrators to execute arbitrary OS commands by navigating to the Debug Options page and entering shell metacharacters in the interface JSON field of the ping function...

Input validation

MultiTech Conduit MTCDT-LVW2-24XX 1.4.17-ocea-13592 devices allow remote authenticated administrators to execute arbitrary OS commands by navigating to the Debug Options page and entering shell metacharacters in the interface JSON field of the ping function...

CVE-2020-7594: Improper Neutralization of Special Elements used in an OS Command

MultiTech Conduit MTCDT-LVW2-24XX 1.4.17-ocea-13592 devices allow remote authenticated administrators to execute arbitrary OS commands by navigating to the Debug Options page and entering shell metacharacters in the interface JSON field of the ping function...

PT-2020-19643

Name of the Vulnerable Software and Affected Versions MultiTech Conduit MTCDT-LVW2-24XX version 1.4.17-ocea-13592 Description The issue allows remote authenticated administrators to execute arbitrary OS commands. This can be achieved by navigating to the Debug Options page and entering shell...

CVE-2020-7240

Meinberg Lantime M300 and M1000 devices allow attackers with privileges to configure a device to execute arbitrary OS commands by editing the /config/netconf.cmd script aka Extended Network Configuration. Note: According to the description, the vulnerability requires a fully authenticated...

CVE-2020-7240

Meinberg Lantime M300 and M1000 devices allow attackers with privileges to configure a device to execute arbitrary OS commands by editing the /config/netconf.cmd script aka Extended Network Configuration. Note: According to the description, the vulnerability requires a fully authenticated...

CVE-2020-2098

A cross-site request forgery vulnerability in Jenkins Sounds Plugin 0.5 and earlier allows attacker to execute arbitrary OS commands as the OS user account running Jenkins...

CVE-2020-2098

A cross-site request forgery vulnerability in Jenkins Sounds Plugin 0.5 and earlier allows attacker to execute arbitrary OS commands as the OS user account running Jenkins...

CVE-2020-2098

A cross-site request forgery vulnerability in Jenkins Sounds Plugin 0.5 and earlier allows attacker to execute arbitrary OS commands as the OS user account running Jenkins...

CVE-2020-2097: Incorrect Authorization

Jenkins Sounds Plugin 0.5 and earlier does not perform permission checks in URLs performing form validation, allowing attackers with Overall/Read access to execute arbitrary OS commands as the OS user account running Jenkins...