CVE-2020-7357

CVE-2020-7357 relates to Cayin CMS where an authenticated OS semi-blind command injection is possible via the NTP_Server_IP/NTP IP parameter in system.cgi. The issue requires authentication (default credentials) and can allow execution of arbitrary shell commands as root. Affected are multiple Ca...

CVE-2020-7361

CVE-2020-7361 affects EasyCorp ZenTao Pro (8.8.2 and earlier). A command-injection vulnerability exists in the vulnerable "/pro/repo-create.html" endpoint, where an authenticated user can send arbitrary OS commands through the POST parameter “path.” Executed commands run in the Windows SYSTEM con...

Exploit for OS Command Injection in Yaws

OS command injection in Yaws web server CVE-2020-24916 P...

RHEL 8 : CloudForms 5.0.7 update (Critical) (RHSA-2020:3358)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3358 advisory. Red Hat CloudForms Management Engine delivers the insight, control, and automation needed to address the challenges of managing virtual...

Exploit for OS Command Injection in Pi-Hole

CVE-2020-8816 Pi-hole Remote Code Execution authenticated...

OS Command Injection

git-tags-remote is vulnerable to OS command injection. The vulnerability exists as it does not sanitize the value of repo in index.js, whose value is subsequently passed to an exec call...

Command injection

Grandstream HT800 series firmware version 1.0.17.5 and below is vulnerable to an OS command injection vulnerability. Unauthenticated remote attackers can execute arbitrary commands as root by crafting a special configuration file and sending a crafted SIP message...

CVE-2020-5760

The CVE-2020-5760 entry applies to Grandstream HT800 series firmware

CVE-2020-5760

Grandstream HT800 series firmware version 1.0.17.5 and below is vulnerable to an OS command injection vulnerability. Unauthenticated remote attackers can execute arbitrary commands as root by crafting a special configuration file and sending a crafted SIP message...

CVE-2020-15900

A memory corruption issue was found in Artifex Ghostscript 9.50 and 9.52. Use of a non-standard PostScript operator can allow overriding of file access controls. The ‘rsearch’ calculation for the ‘post’ size resulted in a size that was too large, and could underflow to max uint32t. This was fixed...

Command Injection in Kylin

Kylin has some restful apis which will concatenate os command with the user input string, a user is likely to be able to execute any os command without any protection or validation...

OS Command Injection

xps is vulnerable to OS command injection. An attacker is able to inject and execute arbitrary OS commands via the pid parameter due to the lack of sanitisation and validation...

CVE-2020-15922

There is an OS Command Injection in Mida eFramework 2.9.0 that allows an attacker to achieve Remote Code Execution RCE with administrative root privileges. Authentication is required...

CVE-2020-15920

There is an OS Command Injection in Mida eFramework through 2.9.0 that allows an attacker to achieve Remote Code Execution RCE with administrative root privileges. No authentication is required...

CVE-2020-15920

There is an OS Command Injection in Mida eFramework through 2.9.0 that allows an attacker to achieve Remote Code Execution RCE with administrative root privileges. No authentication is required...

CVE-2020-15920

CVE-2020-15920 affects Mida Solutions eFramework

CVE-2020-15922

CVE-2020-15922 describes an OS Command Injection in Mida Solutions’ eFramework version 2.9.0 that enables Remote Code Execution with administrative/root privileges, requiring authentication. The connected Red Hat, CNVD, CNVD-like and Exploit-DB entries corroborate a root-level impact via command ...

PT-2020-14714 · Mida · Mida Eframework

Name of the Vulnerable Software and Affected Versions: Mida eFramework versions prior to 2.9.1 Description: The issue allows an attacker to achieve Remote Code Execution RCE with administrative root privileges due to an OS Command Injection. No authentication is required. Recommendations: For...

: Parallels RAS OS Command Execution

1. Advisory Information Title : Parallels RAS OS Command Execution Advisory ID : CORE-2020-0011 Advisory URL:https://www.coresecurity.com/core-labs/advisories/parallels-ras-os-command-execution Date published : 2020-07-23 Date of last update : 2020-07-21 Vendors contacted : Parallels Release mode...

Grandstream UCM6200 Series OS Command Injection Vulnerability

The Grandstream UCM6200 is an enterprise-class switch for IP telephony communications from Grandstream. An OS command injection vulnerability exists in the Grandstream UCM6200 series versions 1.0.20.23 and earlier. The vulnerability can be exploited to execute commands as root by issuing speciall...