CVE-2020-25802 Authenticated attackers with developer privileges in Crafter Studio may execute OS commands via Groovy scripting.

Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy scripting. This issue affects: Crafter Software Crafter CMS 3.0 versions prior to 3.0.27; 3.1 versions prior to 3.1.7...

CVE-2020-5634

ELECOM LAN routers WRC-2533GST2 firmware versions prior to v1.14, WRC-1900GST2 firmware versions prior to v1.14, WRC-1750GST2 firmware versions prior to v1.14, and WRC-1167GST2 firmware versions prior to v1.10 allow an attacker on the same network segment to execute arbitrary OS commands with a...

CVE-2020-5634

CVE-2020-5634 affects ELECOM LAN routers (WRC-2533GST2, WRC-1900GST2, WRC-1750GST2, WRC-1167GST2). The root cause is an OS command injection vulnerability that allows a remote attacker on the same network segment to execute arbitrary commands with root privileges via unspecified vectors. Affected...

CVE-2020-25802: Improper Control of Dynamically-Managed Code Resources

Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via Groovy scripting. This issue affects: Crafter Software Crafter CMS 3.0 versions prior to 3.0.27; 3.1 versions prior to 3.1.7...

PT-2020-16220

Name of the Vulnerable Software and Affected Versions Crafter CMS versions prior to 3.0.27 Crafter CMS versions prior to 3.1.7 Description The issue is related to improper control of dynamically-managed code resources in Crafter Studio, allowing authenticated developers to execute OS commands via...

CVE-2020-25803: Improper Control of Dynamically-Managed Code Resources

Improper Control of Dynamically-Managed Code Resources vulnerability in Crafter Studio of Crafter CMS allows authenticated developers to execute OS commands via FreeMarker template exposed objects. This issue affects: Crafter Software Crafter CMS 3.0 versions prior to 3.0.27; 3.1 versions prior t...

PT-2020-16221

Name of the Vulnerable Software and Affected Versions Crafter Software Crafter CMS versions prior to 3.0.27 Crafter Software Crafter CMS versions prior to 3.1.7 Description The issue allows authenticated developers to execute OS commands via FreeMarker template exposed objects due to improper...

OS command execution vulnerability in perfecto

perfecto allows specifying Perfecto Connect Path and Perfecto Connect File Name in job configurations. This command is executed on the Jenkins controller in perfecto 1.17 and earlier, allowing attackers with Job/Configure permission to run arbitrary commands on the Jenkins controller. perfecto 1....

CVE-2020-3451: Improper Restriction of Operations within the Bounds of a Memory Buffer

Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV340 Series Routers could allow an authenticated, remote attacker with administrative credentials to execute arbitrary commands on the underlying operating system OS as a restricted user. For more information...

CVE-2020-23934: Improper Neutralization of Special Elements used in an OS Command

An issue was discovered in RiteCMS 2.2.1. An authenticated user can directly execute system commands by uploading a php web shell in the "Filemanager" section...

PT-2020-6642

Name of the Vulnerable Software and Affected Versions TP-Link TL-WPA4220 versions 2 through 4 Description The issue is related to the httpd daemon on TP-Link TL-WPA4220 devices, which fails to neutralize special elements used in an operating system command. This allows a remote authenticated user...

PT-2020-13341

Name of the Vulnerable Software and Affected Versions SABnzbd versions 2.3.9 through 3.0.0Alpha2 Description The issue allows an authenticated user to execute arbitrary Python commands on the underlying operating system due to a command injection vulnerability in the web configuration interface...

CVE-2020-13376

SecurEnvoy SecurMail 9.3.503 allows attackers to upload executable files and achieve OS command execution via a crafted SecurEnvoyReply cookie...

Command injection

SecurEnvoy SecurMail 9.3.503 allows attackers to upload executable files and achieve OS command execution via a crafted SecurEnvoyReply cookie...

CVE-2020-13376

SecurEnvoy SecurMail 9.3.503 allows attackers to upload executable files and achieve OS command execution via a crafted SecurEnvoyReply cookie...

CVE-2020-13376

CVE-2020-13376 affects SecurEnvoy SecurMail 9.3.503. A vulnerability in the SecurEnvoyReply cookie allows an attacker to upload executable files and achieve OS command execution. The issue is described as a file-upload/command-injection vector enabling remote code execution; CVSS metrics in sourc...

CVE-2020-13376: Improper Limitation of a Pathname to a Restricted Directory

SecurEnvoy SecurMail 9.3.503 allows attackers to upload executable files and achieve OS command execution via a crafted SecurEnvoyReply cookie...

PT-2020-13504

Name of the Vulnerable Software and Affected Versions SecurEnvoy SecurMail version 9.3.503 Description The issue allows attackers to upload executable files and achieve OS command execution via a crafted SecurEnvoyReply cookie. This enables attackers to potentially execute system commands, posing...

CVE-2020-15900

A memory corruption issue was found in Artifex Ghostscript 9.50 and 9.52. Use of a non-standard PostScript operator can allow overriding of file access controls. The ‘rsearch’ calculation for the ‘post’ size resulted in a size that was too large, and could underflow to max uint32t. This was fixed...

: Parallels RAS OS Command Execution

1. Advisory Information Title : Parallels RAS OS Command Execution Advisory ID : CORE-2020-0011 Advisory URL:https://www.coresecurity.com/core-labs/advisories/parallels-ras-os-command-execution Date published : 2020-07-23 Date of last update : 2020-07-21 Vendors contacted : Parallels Release mode...