Netgear DGN1000 Setup.cgi Remote Command Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Netgear DGN1000 Setup.cgi Unauthenticated RCE', 'Description' = %q This module exploits an unauthenticated OS command execution vulneralbility in...

Netgear DGN1000 1.1.00.48 - 'Setup.cgi' Remote Code Execution (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Netgear DGN1000 Setup.cgi Unauthenticated RCE', 'Description' = %q This module exploits an unauthenticated OS command execution vulneralbility in...

CVE-2017-12796

The Reporting Compatibility Add On before 2.0.4 for OpenMRS, as distributed in OpenMRS Reference Application before 2.6.1, does not authenticate users when deserializing XML input into ReportSchema objects. The result is that remote unauthenticated users are able to execute operating system...

CVE-2017-14867

Git before 2.10.5, 2.11.x before 2.11.4, 2.12.x before 2.12.5, 2.13.x before 2.13.6, and 2.14.x before 2.14.2 uses unsafe Perl scripts to support subcommands such as cvsserver, which allows attackers to execute arbitrary OS commands via shell metacharacters in a module name. The vulnerable code i...

CVE-2017-10813

CG-WLR300NM Firmware version 1.90 and earlier allows an attacker to execute arbitrary OS commands via unspecified vectors...

CVE-2017-10813

CVE-2017-10813 affects Corega CG-WLR300NM firmware 1.90 and earlier. The vulnerability is an OS command injection (OS Command Injection, CWE-78) that can be exploited via an attack vector available to users who can access the device’s administrative console, allowing arbitrary OS commands to be e...

CVE-2017-14135

enigma2-plugins/blob/master/webadmin/src/WebChilds/Script.py in the webadmin plugin for opendreambox 2.0.0 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the command parameter to the /script URI...

Design/Logic Flaw

Buffalo WCR-1166DS devices with firmware 1.30 and earlier allow an attacker to execute arbitrary OS commands via unspecified vectors...

CVE-2017-10811

The CVE-2017-10811 entry affects Buffalo WCR-1166DS devices. Firmware versions 1.30 and earlier are vulnerable to an OS command injection (CWE-78) when an attacker with access to the device’s administrative console can trigger arbitrary OS commands. Root cause is an OS command injection flaw. Imp...

CVE-2017-10811: Improper Neutralization of Special Elements used in an OS Command

Buffalo WCR-1166DS devices with firmware 1.30 and earlier allow an attacker to execute arbitrary OS commands via unspecified vectors...

PT-2017-17309

Name of the Vulnerable Software and Affected Versions Cisco ASR 5000 Series Aggregated Services Routers version 21.0.v0.65839 Description A vulnerability in the CLI could allow an authenticated, local attacker to bypass CLI restrictions and execute commands on the underlying operating system. Thi...

CVE-2017-2281

The CVE-2017-2281 entry affects the I-O DATA WN-AX1167GR wireless router. Firmware version 3.00 and earlier contains an OS command injection vulnerability that could allow an attacker with network access to execute arbitrary OS commands on the device via unspecified vectors. Affected product/vari...

CVE-2017-2281

WN-AX1167GR firmware version 3.00 and earlier allows an attacker to execute arbitrary OS commands via unspecified vectors...

PT-2017-15321

Name of the Vulnerable Software and Affected Versions WN-AX1167GR firmware versions 3.00 and earlier Description The issue allows an attacker to execute arbitrary OS commands. Recommendations For WN-AX1167GR firmware versions 3.00 and earlier, update to a version later than 3.00 to resolve the...

CVE-2017-2275

WG-C10 v3.0.79 and earlier allows an attacker to execute arbitrary OS commands via unspecified vectors...

CVE-2017-2275: Improper Neutralization of Special Elements used in an OS Command

WG-C10 v3.0.79 and earlier allows an attacker to execute arbitrary OS commands via unspecified vectors...

CVE-2017-2275

WG-C10 v3.0.79 and earlier allows an attacker to execute arbitrary OS commands via unspecified vectors...

PT-2017-15315

Name of the Vulnerable Software and Affected Versions WG-C10 versions 3.0.79 and earlier Description The issue allows an attacker to execute arbitrary OS commands. Recommendations For versions 3.0.79 and earlier, at the moment, there is no information about a newer version that contains a fix for...

CVE-2017-2185

HOME SPOT CUBE2 firmware V101 and earlier allows authenticated attackers to execute arbitrary OS commands via WebUI...

CVE-2017-2185

CVE-2017-2185 affects HOME SPOT CUBE2 firmware v101 and earlier. The vulnerability is an OS command injection in the WebUI that allows an authenticated attacker to execute arbitrary OS commands. Root cause: improper handling of commands in the WebUI, enabling arbitrary command execution when mana...