CVE-2018-16200

CVE-2018-16200 affects Toshiba Home gateway HEM-GW16A and HEM-GW26A with firmware versions 1.2.9 and earlier. The provided documents indicate an OS command injection vulnerability that allows an attacker on the same network segment to execute arbitrary OS commands on the affected device. The root...

CVE-2018-0626

The CVE-2018-0626 entry concerns NEC Aterm WG1200HP routers. Affected firmware: Version 1.0.31 and earlier. Vulnerability: an OS command injection via the sysCmd parameter in formWsc, exploitable by an attacker with administrator rights to execute arbitrary OS commands. Impact is demonstrated as ...

CVE-2018-0631

CVE-2018-0631 affects the NEC Aterm W300P router (firmware version: Ver1.0.13 and earlier). The vulnerability allows an attacker with administrative privileges to execute arbitrary operating system commands via the targetAPSsid parameter. Underlying issue is a command injection flaw in the device...

CVE-2018-0629

Aterm W300P (NEC) firmware Ver1.0.13 and earlier is affected by CVE-2018-0629. The vulnerability is an OS command injection (CWE-78) in the device’s HTTP handling that allows an administrator-level attacker to execute arbitrary commands on the OS via HTTP requests/responses. The impact is elevate...

CVE-2018-0637

Aterm HC100RC (NEC) firmware Ver1.0.1 and earlier is affected by CVE-2018-0637 (OS command injection). The vulnerability allows an attacker with administrator privileges to execute arbitrary OS commands via the export.cgi encKey parameter. Impact is execution of commands with high integrity on de...

CVE-2018-0677

CVE-2018-0677 affects Panasonic BN-SDWBP3 firmware versions 1.0.9 and earlier. The JVN entry confirms an OS Command Injection vulnerability exploitable by a user on the same LAN who can access the product with administrative privileges; the exposure is via unspecified vectors, with impact limited...

CVE-2018-0638

Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via import.cgi encKey parameter...

CVE-2018-0639

Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via toolsfirmware.cgi date parameter, time parameter, and offset parameter...

CVE-2018-0637

Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via export.cgi encKey parameter...

CVE-2018-0639

The CVE-2018-0639 issue affects NEC Aterm HC100RC devices (firmware version 1.0.1 and earlier). A command-injection vulnerability exists in the device’s OS that can be exploited by an administrator to execute arbitrary OS commands via the tools_firmware.cgi parameters date, time, and offset. JVN ...

Medium: php56, php70, php71, php72

Issue Overview: ext/imap/phpimap.c in PHP 5.x and 7.x before 7.3.0 allows remote attackers to cause a denial of service NULL pointer dereference and application crash via an empty string in the message argument to the imapmail function.CVE-2018-19935 University of Washington IMAP Toolkit 2007f on...

CVE-2018-20114

On D-Link DIR-818LW Rev.A 2.05.B03 and DIR-860L Rev.B 2.03.B03 devices, unauthenticated remote OS command execution can occur in the soap.cgi service of the cgibin binary via an "&&" substring in the service parameter. NOTE: this issue exists because of an incomplete fix for CVE-2018-6530...

CVE-2018-20114

CVE-2018-20114 affects D-Link DIR-818LW Rev.A 2.05.B03 and DIR-860L Rev.B 2.03.B03. It is tied to an OS command injection in the cgibin soap.cgi service, exploitable via the service parameter containing an ? substring, reflecting an incomplete fix for CVE-2018-6530. Connected documents corrobora...

CVE-2018-20114

On D-Link DIR-818LW Rev.A 2.05.B03 and DIR-860L Rev.B 2.03.B03 devices, unauthenticated remote OS command execution can occur in the soap.cgi service of the cgibin binary via an “&&” substring in the service parameter. NOTE: this issue exists because of an incomplete fix for CVE-2018-6530. Recent...

Sql injection

A Server-Side Template Injection issue was discovered in Crafter CMS 3.0.18. Attackers with developer privileges may execute OS commands by Creating/Editing a template file .ftl filetype that triggers a call to freemarker.template.utility.Execute in the FreeMarker library during rendering of a we...

CVE-2018-19370

A Race condition vulnerability in unzipfile in admin/import/class-import-settings.php in the Yoast SEO wordpress-seo plugin before 9.2.0 for WordPress allows an SEO Manager to perform command execution on the Operating System via a ZIP import...

CVE-2018-19646

The Python CGI scripts in PWS in Imperva SecureSphere 13.0.10, 13.1.10, and 13.2.10 allow remote attackers to execute arbitrary OS commands because command-line arguments are mishandled...

CVE-2018-19518

University of Washington IMAP Toolkit 2007f on UNIX, as used in imapopen in PHP and other products, launches an rsh command by means of the imaprimap function in c-client/imap4r1.c and the tcpaopen function in osdep/unix/tcpunix.c without preventing argument injection, which might allow remote...

CVE-2018-19073

An issue was discovered on Foscam C2 devices with System Firmware 1.11.1.8 and Application Firmware 2.72.1.32, and Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. They allow attackers to execute arbitrary OS commands via shell metacharacters in the modelName,...

CVE-2018-14558

CVE-2018-14558 affects Tenda AC7/AC9/AC10 routers (firmware: AC7 ≤ V15.03.06.44_CN, AC9 ≤ V15.03.05.19(6318)_CN, AC10 ≤ V15.03.06.23_CN). The flaw arises in the formsetUsbUnload function, which calls dosystemCmd with untrusted input via a crafted goform/setUsbUnload request, leading to arbitrary ...