2843 matches found
Design/Logic Flaw
enigma2-plugins/blob/master/webadmin/src/WebChilds/Script.py in the webadmin plugin for opendreambox 2.0.0 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the command parameter to the /script URI...
CVE-2017-14135
enigma2-plugins/blob/master/webadmin/src/WebChilds/Script.py in the webadmin plugin for opendreambox 2.0.0 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the command parameter to the /script URI...
Command injection
Command Injection in the Ping Module in the Web Interface on Technicolor TD5336 OIFwv7 devices allows remote attackers to execute arbitrary OS commands as root via shell metacharacters in the pingAddr parameter to mntping.cgi...
CVE-2017-14127
Command Injection in the Ping Module in the Web Interface on Technicolor TD5336 OIFwv7 devices allows remote attackers to execute arbitrary OS commands as root via shell metacharacters in the pingAddr parameter to mntping.cgi...
CVE-2017-14127
Command Injection in the Ping Module in the Web Interface on Technicolor TD5336 OIFwv7 devices allows remote attackers to execute arbitrary OS commands as root via shell metacharacters in the pingAddr parameter to mntping.cgi...
CVE-2017-14127
The Technicolor TD5336 router, running OI_Fw_v7 firmware, is susceptible to a Command Injection vulnerability in the Ping Module of its web interface. The root cause is the failure to neutralize special shell metacharacters within the pingAddr parameter sent to the mnt_ping.cgi file. A remote att...
Mako Server v2.5, 2.6 OS Command Injection RCE
This module exploits a vulnerability found in Mako Server v2.5, 2.6. It's possible to inject arbitrary OS commands in the Mako Server tutorial page through a PUT request to save.lsp. Attacker input will be saved on the victims machine and can be executed by sending a GET request to manage.lsp...
Design/Logic Flaw
"Dokodemo eye Smart HD" SCR02HD Firmware 1.0.3.1000 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors...
CVE-2017-10832: Improper Neutralization of Special Elements used in an OS Command
"Dokodemo eye Smart HD" SCR02HD Firmware 1.0.3.1000 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors...
CVE-2017-10832
"Dokodemo eye Smart HD" SCR02HD Firmware 1.0.3.1000 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors...
PT-2017-11540
Name of the Vulnerable Software and Affected Versions Dokodemo eye Smart HD SCR02HD Firmware versions 1.0.3.1000 and earlier Description The issue allows remote attackers to execute arbitrary OS commands. Recommendations For Firmware versions 1.0.3.1000 and earlier, update to a version later than...
Cross site request forgery (csrf)
A Cross-Site Request Forgery CWE-352 vulnerability in Directory Server aka Enterprise Server Administration web UI in Micro Focus Enterprise Developer and Enterprise Server 2.3 and earlier, 2.3 Update 1 before Hotfix 8, and 2.3 Update 2 before Hotfix 9 allows remote unauthenticated attackers to...
CVE-2017-5187
A Cross-Site Request Forgery CWE-352 vulnerability in Directory Server aka Enterprise Server Administration web UI in Micro Focus Enterprise Developer and Enterprise Server 2.3 and earlier, 2.3 Update 1 before Hotfix 8, and 2.3 Update 2 before Hotfix 9 allows remote unauthenticated attackers to...
CVE-2017-5187
A Cross-Site Request Forgery CWE-352 vulnerability in Directory Server aka Enterprise Server Administration web UI in Micro Focus Enterprise Developer and Enterprise Server 2.3 and earlier, 2.3 Update 1 before Hotfix 8, and 2.3 Update 2 before Hotfix 9 allows remote unauthenticated attackers to...
PT-2017-11519
Name of the Vulnerable Software and Affected Versions Buffalo WCR-1166DS versions 1.30 and earlier Description The issue allows an attacker to execute arbitrary OS commands. Recommendations For Buffalo WCR-1166DS versions 1.30 and earlier, update to a version later than 1.30 to resolve the issue...
CVE-2017-10811: Improper Neutralization of Special Elements used in an OS Command
Buffalo WCR-1166DS devices with firmware 1.30 and earlier allow an attacker to execute arbitrary OS commands via unspecified vectors...
Design/Logic Flaw
GitHub Electron before 1.6.8 allows remote command execution because of a nodeIntegration bypass vulnerability. This also affects all applications that bundle Electron code equivalent to 1.6.8 or earlier. Bypassing the Same Origin Policy SOP is a precondition; however, recent Electron versions do...
CVE-2017-12581
GitHub Electron before 1.6.8 allows remote command execution because of a nodeIntegration bypass vulnerability. This also affects all applications that bundle Electron code equivalent to 1.6.8 or earlier. Bypassing the Same Origin Policy SOP is a precondition; however, recent Electron versions do...
CVE-2017-12581
CVE-2017-12581 affects GitHub Electron before 1.6.8, where a nodeIntegration bypass can bypass the Same Origin Policy and allow remote command execution. A privileged chrome-devtools:// URL could eval Node.js primitives (e.g., child_process.execFile), enabling OS commands on the user’s host. The ...