CVE-2017-2237

The CVE-2017-2237 issue affects Toshiba Home gateway models HEM-GW16A and HEM-GW26A with firmware

PT-2017-15244

Name of the Vulnerable Software and Affected Versions HOME SPOT CUBE2 firmware versions V101 and earlier Description The issue allows authenticated attackers to execute arbitrary OS commands via the WebUI. Recommendations For HOME SPOT CUBE2 firmware versions V101 and earlier, update to a version...

CVE-2017-2237: Improper Neutralization of Special Elements used in an OS Command

Toshiba Home gateway HEM-GW16A firmware HEM-GW16A-FW-V1.2.0 and earlier. Toshiba Home gateway HEM-GW26A firmware HEM-GW26A-FW-V1.2.0 and earlier allows an attacker to execute arbitrary OS commands via unspecified vectors...

CVE-2017-2185: Improper Neutralization of Special Elements used in an OS Command

HOME SPOT CUBE2 firmware V101 and earlier allows authenticated attackers to execute arbitrary OS commands via WebUI...

CVE-2016-7819

CVE-2016-7819 affects I-O DATA TS-WRLP/TS-WRLA devices running firmware 1.01.02 or earlier. An attacker with administrator rights can execute arbitrary OS commands via unspecified vectors, with impact on confidentiality, integrity, and availability. The issue is mitigated by applying the vendor-p...

Command injection

Atlassian SourceTree v2.5c and prior are affected by a command injection in the handling of the sourcetree:// scheme. It will lead to arbitrary OS command execution with a URL substring of sourcetree://cloneRepo/ext:: or sourcetree://checkoutRef/ext:: followed by the command. The Atlassian ID...

CVE-2017-8768

Atlassian SourceTree v2.5c and prior are affected by a command injection in the handling of the sourcetree:// scheme. It will lead to arbitrary OS command execution with a URL substring of sourcetree://cloneRepo/ext:: or sourcetree://checkoutRef/ext:: followed by the command. The Atlassian ID...

CVE-2017-8768: Improper Neutralization of Special Elements used in an OS Command

Atlassian SourceTree v2.5c and prior are affected by a command injection in the handling of the sourcetree:// scheme. It will lead to arbitrary OS command execution with a URL substring of sourcetree://cloneRepo/ext:: or sourcetree://checkoutRef/ext:: followed by the command. The Atlassian ID...

Design/Logic Flaw

WNC01WH firmware 1.0.0.9 and earlier allows authenticated attackers to execute arbitrary OS commands via unspecified vectors...

CVE-2017-2128

The CVE-2017-2128 entry relates to the IPA’s Security guide for website operators, where loading specially crafted saved data can cause arbitrary OS command execution (CWE-78). Root cause is an issue in loading saved data that enables command execution; the affected component is the Security guid...

CVE-2017-2141

The CVE-2017-2141 entry concerns the WN-G300R3 router from I-O DATA DEVICE. Affects firmware version 1.03 and earlier. The vulnerability is an OS command injection (CWE-78) that can be exploited by an authenticated attacker with administrator rights to execute arbitrary OS commands on the product...

CVE-2017-2141: Improper Neutralization of Special Elements used in an OS Command

WN-G300R3 firmware 1.03 and earlier allows attackers with administrator rights to execute arbitrary OS commands via unspecified vectors...

CVE-2017-2128: Improper Neutralization of Special Elements used in an OS Command

Security guide for website operators allows remote attackers to execute arbitrary OS commands via specially crafted saved data...

CVE-2017-2096: Improper Neutralization of Special Elements used in an OS Command

smalruby-editor v0.4.0 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors...

PT-2017-15163

Name of the Vulnerable Software and Affected Versions smalruby-editor versions prior to 0.4.1 smalruby versions prior to 0.1.11 Description The issue allows remote attackers to execute arbitrary OS commands via unspecified vectors. Recommendations For smalruby-editor versions prior to 0.4.1, upda...

PT-2017-17634

Name of the Vulnerable Software and Affected Versions Unitrends Enterprise Backup versions prior to 9.1.2 Description The issue allows an authenticated user to execute arbitrary OS commands by sending a specially crafted filename to the "/api/restore/download-files" endpoint. This is related to t...

CVE-2017-7283: Improper Input Validation

An authenticated user of Unitrends Enterprise Backup before 9.1.2 can execute arbitrary OS commands by sending a specially crafted filename to the /api/restore/download-files endpoint, related to the downloadFiles function in api/includes/restore.php...

CVE-2017-6334

dnslookup.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the hostname field of an HTTP POST request, a different vulnerability than CVE-2017-6077...

CVE-2017-6334

dnslookup.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the hostname field of an HTTP POST request, a different vulnerability than CVE-2017-6077. Recent assessments: Assessed Attacker...

CVE-2017-6077

ping.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the pingIPAddr field of an HTTP POST request...