CVE-2018-6530

OS command injection vulnerability in soap.cgi soapcgimain in cgibin in D-Link DIR-880L DIR-880LREVAFIRMWAREPATCH1.08B04 and previous versions, DIR-868L DIR868LA1FW112b04 and previous versions, DIR-65L DIR-865LREVAFIRMWAREPATCH1.08.B01 and previous versions, and DIR-860L DIR860LA1FW110b04 and...

CVE-2017-12552

CVE-2017-12552 is a local arbitrary command-execution flaw in HPE System Management Homepage (SMH) for Windows and Linux, affecting versions prior to 7.6.1. The root cause is an issue in SMH that permits execution of OS commands from a crafted request. The documented impact includes potential com...

The vulnerability of D-Link and TRENDnet’s microprogrammed router services allows attackers to execute arbitrary commands or bypass authentication mechanisms, thereby gaining full control over the device.

The vulnerability of D-Link and TRENDnet’s microprogrammed router software services is related to deficiencies in the authentication process when processing the ping command. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using the pingaddr parameter...

The vulnerability of D-Link and TRENDnet’s microprogrammed router services allows attackers to execute arbitrary commands or bypass authentication mechanisms, thereby gaining full control over the device.

The vulnerability of D-Link and TRENDnet’s microprogrammed router software services is related to deficiencies in the authentication process when processing the ping command. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using the pingaddr parameter...

Design/Logic Flaw

A vulnerability in a specific loopback filter action command, processed in a specific logical order of operation, in a running configuration of Juniper Networks Junos OS, allows an attacker with CLI access and the ability to initiate remote sessions to the loopback interface with the defined...

Command injection

Ruckus Wireless Zone Director Controller firmware releases ZD9.9.x, ZD9.10.x, ZD9.13.0.x less than 9.13.0.0.232 contain OS Command Injection vulnerabilities in the ping functionality that could allow local authenticated users to execute arbitrary privileged commands on the underlying operating...

CVE-2016-10118

Firejail allows local users to truncate /etc/resolv.conf via a chroot command to /...

CVE-2014-5008

Snoopy allows remote attackers to execute arbitrary commands...

Redmi 2A phone has command vulnerability in multiple devices

The Redmi 2A phone is a new model launched by Xiaomi on March 31, 2015, as a derivative of the Redmi 2 phone. The ioctl cmd=0x40046b0a for the Redmi 2A kernel device /dev/hx170dec and the ioctl cmd=0xc00c7503 handler function for /dev/comip-ureg lacks a validity judgment, which allows an attacker...

D-Link DCS IP camera 7411 command execution vulnerability

No description provided by source...

UBUNTU-CVE-2016-4453

The vmsvgafiforun function in hw/display/vmwarevga.c in QEMU allows local guest OS administrators to cause a denial of service infinite loop and QEMU process crash via a VGA command...

DLA-335-1 ntp - security update

Bulletin has no description...

Pygments FontManager._get_nix_font_path Shell Injection Vulnerability

Pygments FontManager.getnixfontpath version 1.2.2-2.0.2 suffers from a shell injection vulnerability. Shell Injection in Pygments FontManager.getnixfontpath Product: Pygments Version: 1.2.2-2.0.2 497:fe62167596bb to 3693:655dbebddc23 Tue Nov 06 17:30:45 2007 +0000 to Aug 21, 2015. Website:...

D-Link/TRENDnet NCC Service Command Injection

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'D-Link/TRENDnet NCC Service Command Injection', 'Description' = %q This module exploits a remote command injection vulnerability on...

HNAP Remote Command Elevation of Privilege Vulnerability in Multiple D-Link Products

D-link specializes in the design and development of hardware products for wireless networks and Ethernet circuits. A remote command elevation of privilege vulnerability exists in several D-Link products HNAP. This vulnerability can be exploited by attackers to elevate privileges and execute...

ElasticSearch command execution vulnerability: by perl to rally the shell-vulnerability warning-the black bar safety net

ElasticSearch is based on Lucene Search Server. It provides a distributed multi-user capability of the full-text search engine, based on the RESTful web interface. Elasticsearch is developed in Java, and as the Apache License under the terms of the open source release, is the second most popular...

FVWM 2.4.17/2.5.8 fvwm_make_browse_menu.sh Scripts Command Execution Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/9922/info It has been reported that the FVWM fvwmmakebrowsemenu.sh script is prone to a command execution vulnerability. This issue is due to the script allowing a user to define which application should be used to execut...

CVE-2014-3981

acinclude.m4, as used in the configure script in PHP 5.5.13 and earlier, allows local users to overwrite arbitrary files via a symlink attack on the /tmp/phpglibccheck file...

CVE-2013-4419

CVE-2013-4419 affects libguestfs guestfish when using --remote/--listen: temporary socket ownership is not properly checked under /tmp/.guestfish-$UID/, allowing a local user to pre-create that directory and then write to the socket to execute commands. Affected are libguestfs versions up to and ...

Quick easy ftp server 4.0.0 plurality of command format string vulnerability-vulnerability warning-the black bar safety net

Version: Quick easy ftp server 4.0.0 other version not test Test: W2K SP4 Quick easy ftp server 4.0.0 is not safe to use wsprintfA function for string operations, resulting in format string vulnerabilities. The affected commands include LS, CD, USER, etc. Wherein the USER command does not need to...