CVE-2021-27944

Several high privileged APIs on the Vizio P65-F1 6.0.31.4-2 and E50x-E1 10.0.31.4-2 Smart TVs do not enforce access controls, allowing an unauthenticated threat actor to access privileged functionality, leading to OS command execution. The specific attack methodology is a file upload...

CVE-2021-27944

CVE-2021-27944 affects Vizio P65-F1 (firmware 6.0.31.4-2) and E50x-E1 (firmware 10.0.31.4-2). Unauthenticated access to multiple high‑privilege APIs allows privileged functionality use via a file upload, resulting in OS command execution. Root cause: lack of access controls on these APIs. Public ...

PT-2021-17684

Name of the Vulnerable Software and Affected Versions: Vizio P65-F1 version 6.0.31.4-2 Vizio E50x-E1 version 10.0.31.4-2 Description: The issue concerns several high privileged APIs on Vizio Smart TVs that do not enforce access controls, allowing an unauthenticated threat actor to access privileg...

CVE-2021-27944: Improper Neutralization of Special Elements used in an OS Command

Several high privileged APIs on the Vizio P65-F1 6.0.31.4-2 and E50x-E1 10.0.31.4-2 Smart TVs do not enforce access controls, allowing an unauthenticated threat actor to access privileged functionality, leading to OS command execution. The specific attack methodology is a file upload...

Design/Logic Flaw

/graphStatus/displayServiceStatus.php in Centreon 19.10.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the RRDdatabasepath parameter...

CVE-2020-22345

/graphStatus/displayServiceStatus.php in Centreon 19.10.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the RRDdatabasepath parameter...

PT-2021-10758

Name of the Vulnerable Software and Affected Versions Centreon version 19.10.8 Description The issue allows remote attackers to execute arbitrary OS commands via shell metacharacters in the RRDdatabase path parameter in the /graphStatus/displayServiceStatus.php endpoint. Recommendations For...

CVE-2021-23422

The CVE-2021-23422 issue affects the bikeshed pre-3.0.0 preprocessor. Affected component/file: Bikeshed processing of an untrusted source file containing Inline Tag Command metadata can trigger OS command execution, with the resulting command output embedded in the HTML output. This indicates a r...

CVE-2021-23422

This affects the package bikeshed before 3.0.0. This can occur when an untrusted source file containing Inline Tag Command metadata is processed. When an arbitrary OS command is executed, the command output would be included in the HTML output...

CVE-2021-3707

CVE-2021-3707 (and CVE-2021-3708) affects D-Link DSL-2750U routers with firmware vME1.16 or earlier. The issues allow an unauthenticated attacker on the local network to perform dangerous actions: CVE-2021-3707 enables unauthorized configuration modification, while CVE-2021-3708 enables OS comman...

PT-2021-21499

Name of the Vulnerable Software and Affected Versions D-Link router DSL-2750U versions vME1.16 and prior Description The issue allows an unauthenticated attacker on the local network to execute any OS commands on the vulnerable device through OS command injection. Recommendations For D-Link route...

CVE-2021-3707: External Control of System or Configuration Setting

D-Link router DSL-2750U with firmware vME1.16 or prior versions is vulnerable to unauthorized configuration modification. An unauthenticated attacker on the local network may exploit this, with CVE-2021-3708, to execute any OS commands on the vulnerable device...

CVE-2021-21805

CVE-2021-21805 affects Advantech R-SeeNet v2.4.12. The ping.php script is vulnerable to remote OS command injection via specially crafted HTTP requests, enabling arbitrary commands execution without credentials. The Nuclei template and Red Hat/other feeds corroborate remote execution risk; report...

CVE-2021-21805: Improper Neutralization of Special Elements used in an OS Command

An OS Command Injection vulnerability exists in the ping.php script functionality of Advantech R-SeeNet v 2.4.12 20.10.2020. A specially crafted HTTP request can lead to arbitrary OS command execution. An attacker can send a crafted HTTP request to trigger this vulnerability...

PT-2021-21882

Name of the Vulnerable Software and Affected Versions: aaPanel versions 6.8.12 and earlier Description: The issue involves Cross-Site WebSocket Hijacking CSWH where an attacker can execute OS commands within WebSocket messages at a ws:// URL for /webssh. This can happen if the victim has configur...

CVE-2020-25206: Improper Neutralization of Special Elements used in an OS Command

The web console for Mimosa B5, B5c, and C5x firmware through 2.8.0.2 allows authenticated command injection in the Throughput, WANStats, PhyStats, and QosStats API classes. An attacker with access to a web console account may execute operating system commands on affected devices by sending crafte...

Command injection

Dell EMC PowerStore versions prior to 1.0.3.0.5.006 contain an OS Command Injection vulnerability in PowerStore X environment . A locally authenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS command on the PowerStore underlying OS. Exploiti...

PT-2021-14195

Name of the Vulnerable Software and Affected Versions: WRC-300FEBK versions all WRC-F300NF versions all WRC-733FEBK versions all WRH-300RD versions all WRH-300BK versions all WRH-300SV versions all WRH-300WH versions all WRH-H300WH versions all WRH-H300BK versions all WRH-300BK-S versions all...

CVE-2021-20739: Improper Neutralization of Special Elements used in an OS Command

WRC-300FEBK, WRC-F300NF, WRC-733FEBK, WRH-300RD, WRH-300BK, WRH-300SV, WRH-300WH, WRH-H300WH, WRH-H300BK, WRH-300BK-S, and WRH-300WH-S all versions allows an unauthenticated network-adjacent attacker to execute an arbitrary OS command via unspecified vectors...

Design/Logic Flaw

Inkdrop versions prior to v5.3.1 allows an attacker to execute arbitrary OS commands on the system where it runs by loading a file or code snippet containing an invalid iframe into Inkdrop...