CVE-2020-22000

HomeAutomation 3.3.2 suffers from an authenticated OS command execution vulnerability using custom command v0.1 plugin. This can be exploited with a CSRF vulnerability to execute arbitrary shell commands as the web user via the 'setcommandon' and 'setcommandoff' POST parameters in...

Design/Logic Flaw

HomeAutomation 3.3.2 suffers from an authenticated OS command execution vulnerability using custom command v0.1 plugin. This can be exploited with a CSRF vulnerability to execute arbitrary shell commands as the web user via the 'setcommandon' and 'setcommandoff' POST parameters in...

CVE-2020-22000

CVE-2020-22000 affects HomeAutomation 3.3.2. An authenticated OS command execution vulnerability exists in the customcommand v0.1 plugin, exploitable via CSRF to run arbitrary shell commands as the web user through unsanitized PHP exec() calls in /system/systemplugins/customcommand/customcommand....

PT-2021-10715

Name of the Vulnerable Software and Affected Versions HomeAutomation version 3.3.2 Description The issue allows for authenticated OS command execution using the custom command v0.1 plugin. This can be exploited, in conjunction with a CSRF vulnerability, to execute arbitrary shell commands as the...

PT-2021-18782

Name of the Vulnerable Software and Affected Versions Symantec Security Analytics versions 7.2 prior to 7.2.7 Symantec Security Analytics version 8.1 prior to 8.1.3-NSR3 Symantec Security Analytics version 8.2 prior to 8.2.1-NSR2 or 8.2.2 Description An input validation flaw in the web UI allows ...

CVE-2020-22000: Improper Neutralization of Special Elements used in an OS Command

HomeAutomation 3.3.2 suffers from an authenticated OS command execution vulnerability using custom command v0.1 plugin. This can be exploited with a CSRF vulnerability to execute arbitrary shell commands as the web user via the 'setcommandon' and 'setcommandoff' POST parameters in...

CVE-2021-20708

NEC Aterm devices Aterm WF1200CR firmware Ver1.3.2 and earlier, Aterm WG1200CR firmware Ver1.3.3 and earlier, and Aterm WG2600HS firmware Ver1.5.1 and earlier allow authenticated attackers to execute arbitrary OS commands by sending a specially crafted request to a specific URL...

CVE-2021-20709

Improper validation of integrity check value vulnerability in NEC Aterm WF1200CR firmware Ver1.3.2 and earlier, Aterm WG1200CR firmware Ver1.3.3 and earlier, and Aterm WG2600HS firmware Ver1.5.1 and earlier allows an attacker with an administrative privilege to execute arbitrary OS commands by...

Design/Logic Flaw

Aterm WG2600HS firmware Ver1.5.1 and earlier allows an attacker to execute arbitrary OS commands via unspecified vectors...

CVE-2021-20711

CVE-2021-20711 affects NEC Aterm WG2600HS firmware (versions 1.5.1 and earlier). The vulnerability enables an attacker to execute arbitrary OS commands via unspecified vectors, with the specific CVE recognized in multiple sources (including JVN and CVE entries). The JVN/CNNVD/CVE records and rela...

CVE-2021-20708

CVE-2021-20708 affects NEC Aterm devices (WF1200CR: v1.3.2 and earlier; WG1200CR: v1.3.3 and earlier; WG2600HS: v1.5.1 and earlier) and allows authenticated attackers to execute arbitrary OS commands by sending a crafted request to a specific URL. Connected sources also reference related CVEs in ...

CVE-2021-27691

Command Injection in Tenda G0 routers with firmware versions v15.11.0.69039CN and v15.11.0.55876CN , and Tenda G1 and G3 routers with firmware versions v15.11.0.179502CN or v15.11.0.169024CN allows remote attackers to execute arbitrary OS commands via a crafted action/setDebugCfg request. This...

CVE-2021-27691

Command Injection in Tenda G0 routers with firmware versions v15.11.0.69039CN and v15.11.0.55876CN , and Tenda G1 and G3 routers with firmware versions v15.11.0.179502CN or v15.11.0.169024CN allows remote attackers to execute arbitrary OS commands via a crafted action/setDebugCfg request. This...

CVE-2021-27692

Tenda G1 and G3 routers are vulnerable to a Command Injection vulnerability in firmware versions v15.11.0.17(9502)_CN and v15.11.0.16(9024)_CN . The flaw exists because the formSetUSBPartitionUmount function passes untrusted input to the doSystemCmd function, allowing remote attackers to execute ...

CVE-2021-27710

Command Injection in TOTOLINK X5000R router with firmware v9.1.0u.6118B20201102, and TOTOLINK A720R router with firmware v4.1.5cu.470B20200911 allows remote attackers to execute arbitrary OS commands by sending a modified HTTP request. This occurs because the function executes glibc's system...

MariaDB 10.2 /MySQL - (wsrep_provider) OS Command Execution Vulnerability

Exploit Title: MariaDB 10.2 /MySQL - 'wsrepprovider' OS Command Execution Exploit Author: Central InfoSec Version: MariaDB 10.2 before 10.2.37, 10.3 before 10.3.28, 10.4 before 10.4.18, and 10.5 before 10.5.9; Percona Server through 2021-03-03; and the wsrep patch through 2021-03-03 for MySQL...

PT-2021-17612

Name of the Vulnerable Software and Affected Versions: TOTOLINK X5000R version v9.1.0u.6118 B20201102 TOTOLINK A720R version v4.1.5cu.470 B20200911 Description: The issue allows remote attackers to execute arbitrary OS commands by sending a modified HTTP request. This occurs because a function...

MariaDB 10.2 - 'wsrep_provider' OS Command Execution

Exploit Title: MariaDB 10.2 /MySQL - 'wsrepprovider' OS Command Execution Date: 03/18/2021 Exploit Author: Central InfoSec Version: MariaDB 10.2 before 10.2.37, 10.3 before 10.3.28, 10.4 before 10.4.18, and 10.5 before 10.5.9; Percona Server through 2021-03-03; and the wsrep patch through...

CVE-2021-28482

Microsoft Exchange Server Remote Code Execution Vulnerability...

CVE-2021-21425: Improper Access Control

Grav Admin Plugin is an HTML user interface that provides a way to configure Grav and create and modify pages. In versions 1.10.7 and earlier, an unauthenticated user can execute some methods of administrator controller without needing any credentials. Particular method execution will result in...