9261 matches found
Sangoma Asterisk Command Injection (CVE-2019-18610)
A command injection vulnerability exists in Sangoma Asterisk. Successful exploitation of this vulnerability could result in arbitrary command execution on the affected system...
CVE-2020-10514
iCatch DVR firmware before 20200103 do not validate function parameter properly, resulting attackers executing arbitrary command...
CVE-2020-10514 iCatch DVR - Command Injection
iCatch DVR firmware before 20200103 do not validate function parameter properly, resulting attackers executing arbitrary command...
Code Injection in elwerene/libreoffice-convert
Description The libreoffice-convert module is vulnerable against RCE since a command is crafted using user inputs not validated and then executed, leading to arbitrary command injection POC 1. Create the following PoC file: js // poc.js const libre = require'libreoffice-convert'; libre.convert'',...
Code Injection in heroku/heroku-exec-util
Description The heroku-exec-util module is vulnerable against RCE since a command is crafted using user inputs not validated and then executed, leading to arbitrary command injection POC 1. Create the following PoC file: js // poc.js var heu = require'heroku-exec-util'; heu.sshargs:,'test; touch...
Arbitrary Command Execution
ibm java is vulnerable to arbitrary command execution. A remote attacker is able to execute arbitrary commands via a malicious web page...
Arbitrary Command Execution
device-mapper-multipath is vulnerable to arbitrary command execution. It was discovered that the multipathd daemon set incorrect permissions on the socket used to communicate with command line clients. An unprivileged, local user could use this flaw to send commands to multipathd, resulting in...
Arbitrary Command Execution
enscript is vulnerable to arbitrary command execution. The vulnerability exists as two buffer overflow flaws were found in GNU enscript. An attacker could craft an ASCII file in such a way that it could execute arbitrary commands if the file was opened with enscript with the "special escapes"...
Arbitrary Command Execution
php is vulnerable to arbitrary command execution. The vulnerability exists as it was discovered that the PHP escapeshellcmd function did not properly escape multi-byte characters which are not valid in the locale used by the script. This could allow an attacker to bypass quoting restrictions...
Clamscan Injection Vulnerability
clamscan is a command line tool that is mainly used to scan files or directories for viruses. An injection vulnerability exists in the 'isclamavbinary' function in the Index.js file in clamscan 1.2.0 and earlier versions. An attacker can exploit this vulnerability by sending a specially crafted...
CVE-2019-14889
A flaw was found with the libssh API function sshscpnew. A user able to connect to a server using SCP could execute arbitrary command using a user-provided path, leading to a compromise of the remote target...
adb-driver injection vulnerability
adb-driver is a universal Android USB driver. An injection vulnerability exists in adb-driver. The vulnerability can be exploited to execute arbitrary commands with the help of the 'command' parameter...
heroku-addonpool command injection vulnerability
heroku-addonpool is a package for managing applications in Heroku. A command injection vulnerability exists in heroku-addonpool version 0.1.15 and earlier. An attacker can exploit this vulnerability to execute arbitrary commands...
The vulnerability of the command-line interface of the Cisco FXOS operating system, allowing a hacker to execute arbitrary commands
The vulnerability of the Cisco FXOS operating system’s command-line interface relates to the lack of measures taken to neutralize special elements used in operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands with root privileges...
CVE-2020-5352
Dell EMC Data Protection Advisor 6.4, 6.5 and 18.1 contain an OS command injection vulnerability. A remote authenticated malicious user may exploit this vulnerability to execute arbitrary commands on the affected system...
XAMPP Arbitrary Command Execution Vulnerability
XAMPP is a free open source cross-platform Web server solution stack package developed by Apache Friends. An arbitrary command execution vulnerability exists in XAMPP. An attacker can exploit this vulnerability by changing the .exe configuration in xampp-contol.ini for all users including...
CVE-2020-7624
effect through 1.0.4 is vulnerable to Command Injection. It allows execution of arbitrary command via the options argument...
CVE-2020-7630
git-add-remote through 1.0.0 is vulnerable to Command Injection. It allows execution of arbitrary commands via the name argument...
