CVE-2017-10811

The CVE-2017-10811 entry affects Buffalo WCR-1166DS devices. Firmware versions 1.30 and earlier are vulnerable to an OS command injection (CWE-78) when an attacker with access to the device’s administrative console can trigger arbitrary OS commands. Root cause is an OS command injection flaw. Imp...

CVE-2017-2281

The CVE-2017-2281 entry affects the I-O DATA WN-AX1167GR wireless router. Firmware version 3.00 and earlier contains an OS command injection vulnerability that could allow an attacker with network access to execute arbitrary OS commands on the device via unspecified vectors. Affected product/vari...

CVE-2017-2281

WN-AX1167GR firmware version 3.00 and earlier allows an attacker to execute arbitrary OS commands via unspecified vectors...

CVE-2017-2275

WG-C10 v3.0.79 and earlier allows an attacker to execute arbitrary OS commands via unspecified vectors...

CVE-2017-2275

WG-C10 v3.0.79 and earlier allows an attacker to execute arbitrary OS commands via unspecified vectors...

CVE-2017-2237

The CVE-2017-2237 issue affects Toshiba Home gateway models HEM-GW16A and HEM-GW26A with firmware

CVE-2017-2185

HOME SPOT CUBE2 firmware V101 and earlier allows authenticated attackers to execute arbitrary OS commands via WebUI...

CVE-2017-2185

CVE-2017-2185 affects HOME SPOT CUBE2 firmware v101 and earlier. The vulnerability is an OS command injection in the WebUI that allows an authenticated attacker to execute arbitrary OS commands. Root cause: improper handling of commands in the WebUI, enabling arbitrary command execution when mana...

CVE-2016-7819

CVE-2016-7819 affects I-O DATA TS-WRLP/TS-WRLA devices running firmware 1.01.02 or earlier. An attacker with administrator rights can execute arbitrary OS commands via unspecified vectors, with impact on confidentiality, integrity, and availability. The issue is mitigated by applying the vendor-p...

Command injection

Atlassian SourceTree v2.5c and prior are affected by a command injection in the handling of the sourcetree:// scheme. It will lead to arbitrary OS command execution with a URL substring of sourcetree://cloneRepo/ext:: or sourcetree://checkoutRef/ext:: followed by the command. The Atlassian ID...

CVE-2017-8768

Atlassian SourceTree v2.5c and prior are affected by a command injection in the handling of the sourcetree:// scheme. It will lead to arbitrary OS command execution with a URL substring of sourcetree://cloneRepo/ext:: or sourcetree://checkoutRef/ext:: followed by the command. The Atlassian ID...

Design/Logic Flaw

WNC01WH firmware 1.0.0.9 and earlier allows authenticated attackers to execute arbitrary OS commands via unspecified vectors...

CVE-2017-2128

The CVE-2017-2128 entry relates to the IPA’s Security guide for website operators, where loading specially crafted saved data can cause arbitrary OS command execution (CWE-78). Root cause is an issue in loading saved data that enables command execution; the affected component is the Security guid...

CVE-2017-2141

The CVE-2017-2141 entry concerns the WN-G300R3 router from I-O DATA DEVICE. Affects firmware version 1.03 and earlier. The vulnerability is an OS command injection (CWE-78) that can be exploited by an authenticated attacker with administrator rights to execute arbitrary OS commands on the product...

CVE-2017-6334

dnslookup.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the hostname field of an HTTP POST request, a different vulnerability than CVE-2017-6077...

CVE-2017-6334

dnslookup.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the hostname field of an HTTP POST request, a different vulnerability than CVE-2017-6077. Recent assessments: Assessed Attacker...

CVE-2017-6077

ping.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the pingIPAddr field of an HTTP POST request...

CVE-2017-6077

ping.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the pingIPAddr field of an HTTP POST request. Recent assessments: Assessed Attacker Value: 0 Assessed Attacker Value: 0Assessed Attack...

Design/Logic Flaw

An issue was discovered in Moxa OnCell OnCellG3470A-LTE, AWK-1131A/3131A/4131A Series, AWK-3191 Series, AWK-5232/6232 Series, AWK-1121/1127 Series, WAC-1001 V2 Series, WAC-2004 Series, AWK-3121-M12-RTG Series, AWK-3131-M12-RCC Series, AWK-5232-M12-RCC Series, TAP-6226 Series, AWK-3121/4121 Series...

CVE-2016-8363

An issue was discovered in Moxa OnCell OnCellG3470A-LTE, AWK-1131A/3131A/4131A Series, AWK-3191 Series, AWK-5232/6232 Series, AWK-1121/1127 Series, WAC-1001 V2 Series, WAC-2004 Series, AWK-3121-M12-RTG Series, AWK-3131-M12-RCC Series, AWK-5232-M12-RCC Series, TAP-6226 Series, AWK-3121/4121 Series...