D-Link DCS-2530L and DCS-2670L Command Injection Vulnerability

The DCS-2530L and DCS-2670L are Full HD 180-degree Wi-Fi cameras from D-Link. A command injection vulnerability exists in cgi-bin/ddnsenc.cgi in the D-Link DCS-2530L and DCS-2670L. The vulnerability stems from a network system or product not properly filtering specific elements of externally...

CVE-2020-7712

CVE-2020-7712—Initial public details: the vulnerability in json package prior to 10.0.0 enables arbitrary command injection via parseLookup. Connected data from a Nessus plugin (Oracle Siebel Server <= 22.5) cites the CVE and describes a vulnerability in Siebel CRM (component: Loging/APache Zo...

IBM Security Guardium Data Encryption (GDE) Arbitrary Command Execution Vulnerability

IBM Security Guardium Data Encryption GDE provides a modular set of encryption solutions that help security teams effectively implement data-at-rest security across the organization. An arbitrary command execution vulnerability exists in IBM Security Guardium Data Encryption GDE 3.0.0.2, which ca...

CVE-2020-17384 Cellopoint CelloOS - Remote Command Execution (RCE)

Cellopoint CelloOS v4.1.10 Build 20190922 does not validate URL inputted properly. With the cookie of the system administrator, attackers can inject and remotely execute arbitrary command to manipulate the system...

CVE-2020-24364

MineTime through 1.8.5 allows arbitrary command execution via the notes field in a meeting. Could lead to RCE via meeting invite...

CVE-2020-24364

MineTime (version 1.8.5 and earlier) is affected by CVE-2020-24364. The vulnerability allows arbitrary command execution via the notes field in a meeting invitation, potentially leading to remote code execution. The CVSS metrics indicate a high-severity impact (CVSSv3.1 HR, network attack vector,...

CVE-2020-24364

MineTime through 1.8.5 allows arbitrary command execution via the notes field in a meeting. Could lead to RCE via meeting invite...

CVE-2020-24054

The CVE-2020-24054 issue affects Moog EXO Series EXVF5C-2 and EXVP7C2-3 administration consoles. The vulnerability arises from a privileged “statusbroadcast” feature that can spawn a specified binary repeatedly at set intervals as root. Although the feature accepts only a binary path without argu...

CVE-2020-7710

This affects all versions of package safe-eval. It is possible for an attacker to run an arbitrary command on the host machine...

CVE-2020-7710

This affects all versions of package safe-eval. It is possible for an attacker to run an arbitrary command on the host machine...

CVE-2020-7710

This affects all versions of package safe-eval. It is possible for an attacker to run an arbitrary command on the host machine...

CVE-2020-7710 Sandbox Escape

This affects all versions of package safe-eval. It is possible for an attacker to run an arbitrary command on the host machine...

CVE-2020-7710

CVE-2020-7710 affects all versions of the safe-eval package. The vulnerability arises from the package failing to restrict access to the main JavaScript context via Error objects, enabling a sandbox escape and remote code execution. Proof-of-concept payloads in advisory sources demonstrate how an...

CVE-2020-13826

A CSV injection aka Excel Macro Injection or Formula Injection issue in i-doit 1.14.2 allows an attacker to execute arbitrary commands via a Title parameter that is mishandled in a CSV export...

Design/Logic Flaw

In Nim 1.2.4, the standard library browsers mishandles the URL argument to browsers.openDefaultBrowser. This argument can be a local file path that will be opened in the default explorer. An attacker can pass one argument to the underlying open command to execute arbitrary registered system...

Arbitrary Command Execution

spamassassin is vulnerable to command execution. The vulnerability exists as crafted nefarious Configuration .cf files can be configured to run system commands similar to CVE-2018-11805...

Exploit for OS Command Injection in Pi-Hole

CVE 2020-8816 : Pi-holehttps://f...

CVE-2020-5609

Directory traversal vulnerability in CAMS for HIS CENTUM CS 3000 includes CENTUM CS 3000 Small R3.08.10 to R3.09.50, CENTUM VP includes CENTUM VP Small, Basic R4.01.00 to R6.07.00, B/M9000CS R5.04.01 to R5.05.01, and B/M9000 VP R6.01.01 to R8.03.01 allows a remote unauthenticated attacker to crea...

D-Link DSL-7740C Operating System Command Injection Vulnerability

The D-Link DSL-7740C is a modem from AUO D-Link of Taiwan, China. An operating system command injection vulnerability exists in the D-Link DSL-7740C, which originates when the program does not properly validate user input. An attacker could exploit the vulnerability to inject arbitrary commands...

Code Injection in swooningfish/ffmpeg-web-gui

Description The ffmpeg-web-gui project is a simple video converter written in PHP which uses the ffmpeg command to convert videos in HTML formats. The issue arises at the following line: https://github.com/swooningfish/ffmpeg-web-gui/blob/master/upload-and-convert.phpL176. The arbitrary command...