CVE-2016-0325

CVE-2016-0325 affects IBM Jazz-based CLM stack (Rational CLM/RQM/RRTC/RDNG/RELM/RSA DM and related) with multiple versions vulnerable prior to specific iFixes. The issue allows an authenticated remote attacker to execute arbitrary OS commands via a crafted HTTP request, impacting several CLM comp...

CVE-2016-0326

IBM Rational Quality Manager RQM and Rational Collaborative Lifecycle Management 3.0.1.6 before iFix8, 4.x before 4.0.7 iFix11, 5.x before 5.0.2 iFix17, and 6.x before 6.0.1 ifix3 allow remote authenticated users to execute arbitrary OS commands via a crafted "HTML request."...

CVE-2016-0326

Summary: IBM Rational Quality Manager (RQM) and Rational Collaborative Lifecycle Management (CLM) are affected by a command injection vulnerability (CVE-2016-0326). An authenticated attacker can inject commands via a specially crafted HTML request, causing OS commands to execute with the user’s p...

CVE-2016-6373

Cisco Cloud Services Platform (CSP) 2100 web GUI vulnerability (CVE-2016-6373) affects CSP2100 2100 series running 2.0 and 2.x prior to 2.1.0. An authenticated remote attacker can inject commands via crafted platform requests to execute arbitrary OS commands with root privileges. The issue stems ...

CVE-2016-2875

IBM Security QRadar SIEM 7.1.x and 7.2.x before 7.2.7 allows remote authenticated users to execute arbitrary OS commands as root via unspecified vectors...

Crestron AirMedia AM-100 contains multiple vulnerabilities

Overview The Crestron AirMedia AM-100 with firmware prior to version 1.4.0.13 is vulnerable to path traversal and command injection. Description CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' - CVE-2016-5639 A path traversal vulnerability exists in login.cgi...

SugarCRM <= 6.5.18 Multiple Vulnerabilities

SugarCRM is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:sugarcrm:sugarcrm"; if description...

CVE-2016-1227

CVE-2016-1227 describes an OS command injection (CWE-78) in several Hikari Denwa routers. A logged-in attacker could execute arbitrary OS commands on affected devices: NTT EAST PR-400MI/RT-400MI/RV-440MI (firmware 07.00.1006 and earlier) and NTT WEST PR-400MI/RT-400MI/RV-440MI (firmware 07.00.100...

Input validation

Cisco Prime Network Analysis Module NAM before 6.11 patch.6.1-2-final and 6.2.x before 6.22 and Prime Virtual Network Analysis Module vNAM before 6.11 patch.6.1-2-final and 6.2.x before 6.22 allow remote authenticated users to execute arbitrary OS commands via a crafted HTTP request, aka Bug ID...

CVE-2016-1388

Cisco Prime Network Analysis Module NAM before 6.11 patch.6.1-2-final and 6.2.x before 6.21 and Prime Virtual Network Analysis Module vNAM before 6.11 patch.6.1-2-final and 6.2.x before 6.21 allow remote attackers to execute arbitrary OS commands via a crafted HTTP request, aka Bug ID CSCuy21882...

CVE-2015-4642

The escapeshellarg function in ext/standard/exec.c in PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 on Windows allows remote attackers to execute arbitrary OS commands via a crafted string to an application that accepts command-line arguments for a call to the PHP system functio...

Input validation

Cisco Unified Computing System UCS Central Software 1.31b and earlier allows remote attackers to execute arbitrary OS commands via a crafted HTTP request, aka Bug ID CSCuv33856...

CVE-2016-3654

The CVE concerns PAN-OS device management CLI parsing of an SSH command parameter, allowing authenticated administrators to run arbitrary OS commands with root privileges. Affected PAN-OS versions: 5.0.x before 5.0.18; 5.1.x before 5.1.11; 6.0.x before 6.0.13; 6.1.x before 6.1.10; 7.0.x before 7....

CVE-2016-2278

Schneider Electric Struxureware Building Operations Automation Server AS 1.7 and earlier and AS-P 1.7 and earlier allows remote authenticated administrators to execute arbitrary OS commands by defeating an msh aka Minimal Shell protection mechanism...

CVE-2016-2278

Schneider Electric Struxureware Building Operations Automation Server AS 1.7 and earlier and AS-P 1.7 and earlier allows remote authenticated administrators to execute arbitrary OS commands by defeating an msh aka Minimal Shell protection mechanism...

phpMyBackupPro 2.5 Shell Upload

Credits: hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/PHPMYBACKUPPRO-v2.5-FILEUPLOADVULN.txt Vendor: ============================= www.phpmybackuppro.net project site: sourceforge.net/projects/phpmybackup/ Product: ===========================...

CVE-2016-1141

KDDI HOME SPOT CUBE devices before 2 allow remote authenticated users to execute arbitrary OS commands via unspecified vectors...

CVE-2016-1142

CVE-2016-1142 affects Seeds acmailer. Connected documents confirm an OS command injection (CWE-78) vulnerability in Seeds acmailer prior to 3.8.21 and 3.9.x prior to 3.9.15 Beta, exploitable by an authenticated remote attacker to execute arbitrary commands on the server via unspecified vectors. A...

CVE-2015-5018

CVE-2015-5018 affects IBM Security Access Manager for Web (ISAM) on Web-based appliances: versions 7.0 before FP19, 8.0 before 8.0.1.3 IF3, and 9.0 before 9.0.0.0 IF1 are vulnerable to a command-injection via Local Management Interface (LMI) that enables remote authenticated users to execute arbi...

Symantec Endpoint Protection Multiple Vulnerabilities (Nov 2015)

Symantec Endpoint Protection is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...