CVE-2018-0514

MP Form Mail CGI eCommerce Edition Ver 2.0.13 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors...

Design/Logic Flaw

MP Form Mail CGI eCommerce Edition Ver 2.0.13 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors...

CVE-2018-0512

Devices with IP address setting tool "MagicalFinder" provided by I-O DATA DEVICE, INC. allow authenticated attackers to execute arbitrary OS commands via unspecified vectors...

CVE-2018-0512

CVE-2018-0512 involves the IP address setting tool “MagicalFinder” from I-O DATA DEVICE, INC. and is a confirmed OS command injection (CWE-78) vulnerability. The NVD/JVN entries describe that an attacker who can log in to affected devices may execute arbitrary OS commands via unspecified vectors....

Design/Logic Flaw

iBall iB-WRA150N 1.2.6 build 110401 Rel.47776n devices allow remote authenticated users to execute arbitrary OS commands via shell metacharacters in the ping test arguments on the Diagnostics page...

Design/Logic Flaw

Nootka 1.4.4 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors...

CVE-2018-0506

CVE-2018-0506 affects Nootka 1.4.4 and earlier. The vulnerability is an OS command injection that lets remote attackers execute arbitrary commands via unspecified vectors in the mobile app. Public sources (NVD, JVN, CNVD) consistently describe a remote impact and the same affected product version...

CVE-2018-0506

Nootka 1.4.4 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors...

CVE-2016-10709

pfSense before 2.3 allows remote authenticated users to execute arbitrary OS commands via a '|' character in the statusrrdgraphimg.php graph parameter, related to rrdgraphimg.php...

CVE-2016-10709

pfSense before 2.3 allows remote authenticated users to execute arbitrary OS commands via a '|' character in the statusrrdgraphimg.php graph parameter, related to rrdgraphimg.php...

Design/Logic Flaw

pfSense before 2.3 allows remote authenticated users to execute arbitrary OS commands via a '|' character in the statusrrdgraphimg.php graph parameter, related to rrdgraphimg.php...

CVE-2016-10709

pfSense before 2.3 allows remote authenticated users to execute arbitrary OS commands via a '|' character in the statusrrdgraphimg.php graph parameter, related to rrdgraphimg.php...

Server side request forgery (ssrf)

diagping.cmd on D-Link DSL-2640U devices with firmware IM1.00 and ME1.00, and DSL-2540U devices with firmware ME1.00, allows authenticated remote attackers to execute arbitrary OS commands via shell metacharacters in the ipaddr field of an HTTP GET request...

CVE-2017-18025

cgi-bin/drknow.cgi in Innotube ITGuard-Manager 0.0.0.1 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the username field, as demonstrated by a username beginning with "admin|" to use the '|' metacharacter...

Design/Logic Flaw

cgi-bin/drknow.cgi in Innotube ITGuard-Manager 0.0.0.1 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the username field, as demonstrated by a username beginning with "admin|" to use the '|' metacharacter...

CVE-2017-17867

Inteno iopsys 2.0-3.14 and 4.0 devices allow remote authenticated users to execute arbitrary OS commands by modifying the leasetrigger field in the odhcpd configuration to specify an arbitrary program, as demonstrated by a program located on an SMB share. This issue existed because the...

Design/Logic Flaw

Inteno iopsys 2.0-3.14 and 4.0 devices allow remote authenticated users to execute arbitrary OS commands by modifying the leasetrigger field in the odhcpd configuration to specify an arbitrary program, as demonstrated by a program located on an SMB share. This issue existed because the...

CVE-2017-17867

Inteno iopsys 2.0-3.14 and 4.0 devices allow remote authenticated users to execute arbitrary OS commands by modifying the leasetrigger field in the odhcpd configuration to specify an arbitrary program, as demonstrated by a program located on an SMB share. This issue existed because the...

CVE-2017-17867

CVE-2017-17867 concerns Inteno IOPSYS devices (2.0–3.14 and 4.0) where remote authenticated users can execute arbitrary OS commands by manipulating the leasetrigger field in the odhcpd config via an SMB share, due to insufficient protection of OpenWrt config (not using /etc/uci-defaults). Connect...

Xplico Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Xplico Remote Code Execution', 'Description' = %q This module exploits command injection vulnerability. Unauthenticated users can register a new...