CVE-2015-7774

PC-EGG pWebManager before 3.3.10, and before 2.2.2 for PHP 4.x, allows remote authenticated users to execute arbitrary OS commands by leveraging the editor role...

b374k 3.2.3 2.8 CSRF / Command Injection Vulnerabilities

b374k web shell versions 2.8 and 3.2.3 suffer from a cross site request forgery vulnerability that allows for remote command injection. Vendor: ============================================ github.com/b374k/b374k code.google.com/p/b374k-shell/downloads/list code.google.com/archive/p/b374k-shell/...

JVN#25323093: pWebManager vulnerable to OS command injection

pWebManager provided by PC-EGG Co.,Ltd. contains an OS command injection vulnerability CWE-78. Impact An arbitrary OS command may be executed on the server by a user logged in with editor permissions. Solution Update the Software Update to the latest version according to the information provided ...

WAP - Web Application Protection

WAP is a source code static analysis and data mining tool to detect and correct input validation vulnerabilities in web applications written in PHP version 4.0 or higher with a low rate of false positives. WAP detects and corrects the following vulnerabilities: SQL Injection SQLI Cross-site...

CVE-2015-5672

TYPE-MOON Fate/stay night, Fate/hollow ataraxia, Witch on the Holy Night, and Fate/stay night + hollow ataraxia set allow remote attackers to execute arbitrary OS commands via crafted saved data...

JVN#80144272: Multiple TYPE-MOON games vulnerable to OS command injection

Multiple games provided by TYPE-MOON contain an OS command injection vulnerability CWE-78 due to an issue in loading save data. Impact When specially crafted save data is loaded, an arbitrary OS command may be executed. Solution Apply a Workaround The following workaround can mitigate the affects...

Design/Logic Flaw

The Web Console in Commvault Edge Server 10 R2 allows remote attackers to execute arbitrary OS commands via crafted serialized data in a cookie...

Commvault Edge Server deserializes cookie data insecurely

Overview Commvault Edge Server, version 10 R2, deserializes untrusted, user-provided cookie data, resulting in arbitrary OS command execution with the web server's privileges. Description CWE-502: Deserialization of Untrusted Data - CVE-2015-7253Commvault Edge Server, version 10 R2, deserializes...

JVN#04281281: ISUCON5 qualifier portal web application (eventapp) vulnerable to OS command injection

ISUCON5 qualifier portal web application eventapp provided by ISUCON organizers contains an OS command injection CWE-78 vulnerability. Impact A logged in attacker may execute arbitrary OS commands on the server. Solution Update the Software Update to the latest version according to the informatio...

CVE-2015-7901

Infinite Automation Mango Automation 2.5.x and 2.6.x through 2.6.0 build 430 allows remote authenticated users to execute arbitrary OS commands via unspecified vectors...

CVE-2015-7901

Infinite Automation Mango Automation versions 2.5.x–2.6.0 beta (builds prior to 430) contain an OS command injection vulnerability that can be exploited by an authenticated remote user to execute arbitrary commands. Affected component/issue is demonstrated by public exploit references (e.g., Expl...

Xtreme Vulnerable Web Application: XVWA

XVWA is a badly coded web application written in PHP/MySQL that helps security enthusiasts to learn application security. It’s not advisable to host this application online as it is designed to be “Xtremely Vulnerable”. It is recommended to host this application in local/controlled environment an...

ZyXEL PMG5318-B20A OS Command Injection

Exploit Title: ZyXEL PMG5318-B20A OS Command Injection Vulnerability Discovered by: Karn Ganeshen CERT VU 870744 Vendor Homepage: www.zyxel.com Version Reported: Firmware version V100AANC0b5 CVE-2015-6018 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6018 Vulnerability Details CWE-20 :...

ZyXEL PMG5318-B20A - OS Command Injection Vulnerability

Exploit for hardware platform in category web applications Exploit Title: ZyXEL PMG5318-B20A OS Command Injection Vulnerability Discovered by: Karn Ganeshen CERT VU 870744 Vendor Homepage: www.zyxel.com Version Reported: Firmware version V100AANC0b5 CVE-2015-6018...

ZYXEL PMG5318-B20A - OS Command Injection

ZYXEL PMG5318-B20A - OS Command Injection Exploit Title: ZyXEL PMG5318-B20A OS Command Injection Vulnerability Discovered by: Karn Ganeshen CERT VU 870744 Vendor Homepage: www.zyxel.com Version Reported: Firmware version V100AANC0b5 CVE-2015-6018...

NETGEAR Voice Gateway 2.3.0.23_2.3.23 - Multiple Vulnerabilities

NETGEAR Voice Gateway 2.3.0.232.3.23 - Multiple Vulnerabilities Exploit Title: Netgear Voice Gateway Multiple Vulnerabilities Date: May 01, 2015 No response from Vendor Discovered by: Karn Ganeshen Vendor Homepage: www.netgear.com Version: Firmware Version: V2.3.0.232.3.23 Netgear Voice Gateway...

Netgear Voice Gateway 2.3.0.23_2.3.23 - Multiple Vulnerabilities

Exploit Title: Netgear Voice Gateway Multiple Vulnerabilities Date: May 01, 2015 No response from Vendor Discovered by: Karn Ganeshen Vendor Homepage: www.netgear.com Version: Firmware Version: V2.3.0.232.3.23 Netgear Voice Gateway Multiple Vulnerabilities Device Info Device Type: Netgear Voice...

Netgear Voice Gateway 2.3.0.23_2.3.23 - Multiple Vulnerabilities

Netgear Voice Gateway with firmware version 2.3.0.232.3.23 suffers from command injection, insecurely configured passwords, and cross site scripting vulnerabilities. Exploit Title: Netgear Voice Gateway Multiple Vulnerabilities Date: May 01, 2015 No response from Vendor Discovered by: Karn Ganesh...

PIXORD Vehicle 3G Wi-Fi Router Command Injection / Information Disclosure

Exploit Title: Vehicle 3G Wi-Fi Router - PIXORD - Multiple Vulnerabilities Date: May 01, 2015 No response from Vendor till date Discovered by: Karn Ganeshen Vendor Homepage: http://www.pixord.com/en/productsshow.php?show=17 Version: Model Name :3GR-431P Software Version :RTA-A00102 Wireless Drive...

PIXORD Vehicle 3G Wi-Fi Router 3GR-431P - Multiple Vulnerabilities

PIXORD Vehicle 3G Wi-Fi Router 3GR-431P - Multiple Vulnerabilities Exploit Title: Vehicle 3G Wi-Fi Router - PIXORD - Multiple Vulnerabilities Date: May 01, 2015 No response from Vendor till date Discovered by: Karn Ganeshen Vendor Homepage: http://www.pixord.com/en/productsshow.php?show=17 Versio...