9999 matches found
OS Command Injection
codecov is vulnerable to OS command injection. Lack of validation and sanitization of the gcov-args allows an attacker to inject and execute arbitrary OS commands on the system...
CVE-2019-19824
On certain TOTOLINK Realtek SDK based routers, an authenticated attacker may execute arbitrary OS commands via the sysCmd parameter to the boafrm/formSysCmd URI, even if the GUI syscmd.htm is not available. This allows for full control over the device's internals. This affects A3002RU through...
CVE-2019-17096
A OS Command Injection vulnerability in the bootstrap stage of Bitdefender BOX 2 allows the manipulation of the getimageurl function in special circumstances to inject a system command...
CVE-2020-7980
Intellian Aptus Web 1.24 allows remote attackers to execute arbitrary OS commands via the Q field within JSON data to the cgi-bin/libagent.cgi URI. NOTE: a valid sid cookie for a login to the intellian default account might be needed...
CVE-2019-19838
emfd in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote attackers to execute OS commands via a POST request with the attribute xcmd=get-platform-depends to admin/cmdstat.jsp via the uploadFile attribute...
CVE-2019-19839
CVE-2019-19839 affects Ruckus Wireless Unleashed emfd; a remote attacker can execute OS commands by sending a POST to admin/_cmdstat.jsp with xcmd=import-category via the uploadFile attribute. Root cause is improper handling of the xcmd=import-category parameter in emfd, enabling command executio...
CVE-2019-19839
emfd in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote attackers to execute OS commands via a POST request with the attribute xcmd=import-category to admin/cmdstat.jsp via the uploadFile attribute...
CVE-2019-19838
CVE-2019-19838 affects Ruckus Wireless Unleashed firmware (emfd) up to and including 200.7.10.102.64. The issue allows remote command execution when an attacker crafts a POST to admin/_cmdstat.jsp with the uploadFile attribute and the xcmd=get-platform-depends parameter, triggering OS commands on...
CVE-2019-19838
emfd in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote attackers to execute OS commands via a POST request with the attribute xcmd=get-platform-depends to admin/cmdstat.jsp via the uploadFile attribute...
OS Command Injection
bibtex-ruby is vulnerable to OS command injection. During opening and parsing of the .bib file at a given path, unescaped user data is passed to an unsafe built-in Kernel.open method through BibTeX.open, allowing the execution of arbitrary OS commands...
D-Link DIR-859 Unauthenticated Remote Command Execution Exploit
D-Link DIR-859 Routers are vulnerable to OS command injection via the UPnP interface. The vulnerability exists in /gena.cgi function genacgimain in /htdocs/cgibin, which is accessible without credentials. This module requires Metasploit: https://metasploit.com/download Current source:...
Huawei EulerOS: Security Advisory for libarchive (EulerOS-SA-2019-1725)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2019-19842
CVE-2019-19842 affects Ruckus Wireless Unleashed firmware (example: 200.7.10.102.64). It allows remote command execution by sending a POST to admin/_cmdstat.jsp with the attribute xcmd=spectra-analysis and the mac attribute. This is a network-accessible issue with an attacker having no authentica...
CVE-2019-19841
emfd in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote attackers to execute OS commands via a POST request with the attribute xcmd=packet-capture to admin/cmdstat.jsp via the mac attribute...
D-Link DIR-859 Unauthenticated Remote Command Execution
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'D-Link DIR-859 Unauthenticated Remote Command Execution', 'Description' = %q D-Link DIR-859 Routers are vulnerable to OS command injection via th...
CVE-2020-7594
The CVE-2020-7594 entry concerns MultiTech Conduit MTCDT-LVW2-24XX devices (version 1.4.17-ocea-13592). The vulnerability arises from allowing remote authenticated administrators to execute arbitrary OS commands by navigating to the Debug Options page and entering shell metacharacters in the inte...
CVE-2020-7240
Affected: Meinberg Lantime M300 and M1000 devices. Vulnerability: remote code execution by editing the /config/netconf.cmd (Extended Network Configuration) script via a webUI function accessible to fully authenticated super-users. Root cause: webUI allows editing a script that executes OS command...
CVE-2020-7237
Cacti 1.2.8 allows Remote Code Execution by privileged users via shell metacharacters in the Performance Boost Debug Log field of pollerautomation.php. OS commands are executed when a new poller cycle begins. The attacker must be authenticated, and must have access to modify the Performance...
Input validation
Jenkins Sounds Plugin 0.5 and earlier does not perform permission checks in URLs performing form validation, allowing attackers with Overall/Read access to execute arbitrary OS commands as the OS user account running Jenkins...