Command injection

An OS command injection vulnerability in FortiExtender 4.1.0 to 4.1.1, 4.0.0 and below under CLI admin console may allow unauthorized administrators to run arbitrary system level commands via specially crafted "execute date" commands...

Command injection

OS command injection vulnerability in the "qs" procedure from the "utils" module in Chicken before 4.9.0...

CVE-2013-2024

In Chicken, CVE-2013-2024 describes an OS command injection vulnerability in the qs procedure from the utils module, affecting versions before 4.9.0. The root cause is unsafely handling or composing OS commands within that path, enabling an attacker to execute arbitrary commands on the host. The ...

CVE-2019-15710

FortiExtender OS command injection affects versions prior to 4.1.2. In the FortiExtender CLI admin console, authenticated administrators can execute arbitrary system commands via specially crafted “execute date” inputs, due to improper input sanitization. The vulnerability is documented in Fortin...

Exploit for OS Command Injection in Rambox

CVE-2019-17625 There is a stored XSS vulnerability in rambox...

Central Security Project: OS Command Injection in Nexus Repository Manager 2.x -- Bypass for Nexus Repository Manage 2.14.15-01 Command Injection fix

https://support.sonatype.com/hc/en-us/articles/360033490774 An OS command injection vulnerability has been discovered in Nexus Repository Manager requiring immediate action. The vulnerability allows for an attacker with administrative access to nxrm to execute arbitrary commands on the system. We...

CVE-2019-14931

An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. An unauthenticated remote OS Command Injection vulnerability allows an attacker to execute arbitrary commands on the RTU due to the passing of unsafe user supplied data to t...

CVE-2019-14931

CVE-2019-14931 describes an unauthenticated remote OS command injection in Mitsubishi Electric ME-RTU (firmware ≤2.02) and INEA ME-RTU (≤3.0), exploitable via unsafe data in the Mobile Connection Test host parameter (shell command separator ';'). Impact is remote command execution with high sever...

CVE-2019-14931

An issue was discovered on Mitsubishi Electric Europe B.V. ME-RTU devices through 2.02 and INEA ME-RTU devices through 3.0. An unauthenticated remote OS Command Injection vulnerability allows an attacker to execute arbitrary commands on the RTU due to the passing of unsafe user supplied data to t...

Exploit for OS Command Injection in Fudforum

FUDforum-XSS-RCE FUDForum 3.0.9 - XSS / Remote Code Execution...

Amazon Linux 2 : patch (ALAS-2019-1317)

doedscript in pch.c in GNU patch through 2.7.6 does not block strings beginning with a ! character. NOTE: this is the same commit as for CVE-2019-13638 , but the ! syntax is specific to ed, and is unrelated to a shell metacharacter.CVE-2018-20969 GNU patch through 2.7.6 is vulnerable to OS shell...

CVE-2019-13652

TP-Link M7350 devices through 1.0.16 Build 181220 Rel.1116n allow serviceName OS Command Injection issue 4 of 5...

CVE-2019-13651

TP-Link M7350 devices through 1.0.16 Build 181220 Rel.1116n allow portMappingProtocol OS Command Injection issue 3 of 5...

Command injection

TP-Link M7350 devices through 1.0.16 Build 181220 Rel.1116n allow portMappingProtocol OS Command Injection issue 3 of 5...

Command injection

TP-Link M7350 devices through 1.0.16 Build 181220 Rel.1116n allow triggerPort OS Command Injection issue 5 of 5...

Command injection

TP-Link M7350 devices through 1.0.16 Build 181220 Rel.1116n allow internalPort OS Command Injection issue 2 of 5...

CVE-2019-13653

TP-Link M7350 devices through 1.0.16 Build 181220 Rel.1116n allow triggerPort OS Command Injection issue 5 of 5...

CVE-2019-13653

The CVE-2019-13653 entry applies to TP-Link M7350 devices up to and including firmware 1.0.16 Build 181220 Rel.1116n. The vulnerability is a triggerPort OS Command Injection in TP-Link M7350, allowing execution of OS commands (root cause not explicitly detailed in provided documents). Connected s...

CVE-2019-13652

TP-Link M7350 devices through 1.0.16 Build 181220 Rel.1116n allow serviceName OS Command Injection issue 4 of 5...

CVE-2019-13652

CVE-2019-13652 affects TP-Link M7350 devices running firmware up to 1.0.16 Build 181220 Rel.1116n. The issue is a serviceName OS Command Injection , enabling an attacker to execute OS commands on the device. Public sources in the connected documents consistently describe this vulnerability as a h...