CVE-2019-19838

CVE-2019-19838 affects Ruckus Wireless Unleashed firmware (emfd) up to and including 200.7.10.102.64. The issue allows remote command execution when an attacker crafts a POST to admin/_cmdstat.jsp with the uploadFile attribute and the xcmd=get-platform-depends parameter, triggering OS commands on...

PT-2020-10254

Name of the Vulnerable Software and Affected Versions Ruckus Wireless Unleashed versions through 200.7.10.102.64 Description The issue allows remote attackers to execute OS commands. This can be achieved by sending a POST request with the attribute xcmd=import-category to "admin/ cmdstat.jsp" via...

CVE-2019-19839: Improper Neutralization of Special Elements used in an OS Command

emfd in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote attackers to execute OS commands via a POST request with the attribute xcmd=import-category to admin/cmdstat.jsp via the uploadFile attribute...

PT-2020-10253

Name of the Vulnerable Software and Affected Versions Ruckus Wireless Unleashed versions through 200.7.10.102.64 Description The issue allows remote attackers to execute OS commands. This can be achieved by sending a POST request with the attribute xcmd set to get-platform-depends to the "admin/...

CVE-2019-19842

CVE-2019-19842 affects Ruckus Wireless Unleashed firmware (example: 200.7.10.102.64). It allows remote command execution by sending a POST to admin/_cmdstat.jsp with the attribute xcmd=spectra-analysis and the mac attribute. This is a network-accessible issue with an attacker having no authentica...

CVE-2019-19841

emfd in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote attackers to execute OS commands via a POST request with the attribute xcmd=packet-capture to admin/cmdstat.jsp via the mac attribute...

PT-2020-10256

Name of the Vulnerable Software and Affected Versions Ruckus Wireless Unleashed versions 200.7.10.102.64 and earlier Description The issue allows remote attackers to execute OS commands via a POST request with the attribute xcmd=packet-capture to "admin/ cmdstat.jsp" via the mac attribute. This...

PT-2020-10257

Name of the Vulnerable Software and Affected Versions Ruckus Wireless Unleashed versions through 200.7.10.102.64 Description The issue allows remote attackers to execute OS commands. This can be achieved by sending a POST request with the attribute xcmd=spectra-analysis to the "admin/ cmdstat.jsp...

CVE-2019-19842: Improper Neutralization of Special Elements used in an OS Command

emfd in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote attackers to execute OS commands via a POST request with the attribute xcmd=spectra-analysis to admin/cmdstat.jsp via the mac attribute...

CVE-2019-19841: Improper Neutralization of Special Elements used in an OS Command

emfd in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote attackers to execute OS commands via a POST request with the attribute xcmd=packet-capture to admin/cmdstat.jsp via the mac attribute...

CVE-2020-7594

The CVE-2020-7594 entry concerns MultiTech Conduit MTCDT-LVW2-24XX devices (version 1.4.17-ocea-13592). The vulnerability arises from allowing remote authenticated administrators to execute arbitrary OS commands by navigating to the Debug Options page and entering shell metacharacters in the inte...

CVE-2020-7240

Affected: Meinberg Lantime M300 and M1000 devices. Vulnerability: remote code execution by editing the /config/netconf.cmd (Extended Network Configuration) script via a webUI function accessible to fully authenticated super-users. Root cause: webUI allows editing a script that executes OS command...

CVE-2020-7237

Cacti 1.2.8 allows Remote Code Execution by privileged users via shell metacharacters in the Performance Boost Debug Log field of pollerautomation.php. OS commands are executed when a new poller cycle begins. The attacker must be authenticated, and must have access to modify the Performance...

Input validation

Jenkins Sounds Plugin 0.5 and earlier does not perform permission checks in URLs performing form validation, allowing attackers with Overall/Read access to execute arbitrary OS commands as the OS user account running Jenkins...

CVE-2020-2098

A cross-site request forgery vulnerability in Jenkins Sounds Plugin 0.5 and earlier allows attacker to execute arbitrary OS commands as the OS user account running Jenkins...

CVE-2020-2097

Jenkins Sounds Plugin 0.5 and earlier does not perform permission checks in URLs performing form validation, allowing attackers with Overall/Read access to execute arbitrary OS commands as the OS user account running Jenkins...

CVE-2020-2097

Jenkins Sounds Plugin

CSRF vulnerability and missing permission checks in sounds allow OS command execution

sounds 0.5 and earlier does not perform permission checks in URLs performing form validation. This allows attackers with Overall/Read access to execute arbitrary OS commands as the OS user account running Jenkins. Additionally, these form validation URLs do not require POST requests, resulting in...

CVE-2019-18894

In Avast Premium Security 19.8.2393, attackers can send a specially crafted request to the local web server run by Avast Antivirus on port 27275 to support Bank Mode functionality. A flaw in the processing of a command allows execution of arbitrary OS commands with the privileges of the currently...

Design/Logic Flaw

netflowgetstats in functionsnetflow.php in Pandora FMS 7.0NG allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the ipsrc parameter in an index.php?operation/netflow/nfliveview request. This issue has been fixed in Pandora FMS 7.0 NG 742...