CVE-2017-12796

The Reporting Compatibility Add On before 2.0.4 for OpenMRS, as distributed in OpenMRS Reference Application before 2.6.1, does not authenticate users when deserializing XML input into ReportSchema objects. The result is that remote unauthenticated users are able to execute operating system...

Cross site request forgery (csrf)

The Reporting Compatibility Add On before 2.0.4 for OpenMRS, as distributed in OpenMRS Reference Application before 2.6.1, does not authenticate users when deserializing XML input into ReportSchema objects. The result is that remote unauthenticated users are able to execute operating system...

CVE-2017-12796

The Reporting Compatibility Add On before 2.0.4 for OpenMRS, as distributed in OpenMRS Reference Application before 2.6.1, does not authenticate users when deserializing XML input into ReportSchema objects. The result is that remote unauthenticated users are able to execute operating system...

OpenMRS Remote Command Execution Vulnerability

OpenMRS Reference Application is a suite of open source EHR applications.Reporting Compatibility Add On is one of the compatibility reporting components. A remote command execution vulnerability exists in OpenMRS, which is caused by the application failing to authenticate the user when...

HPE System Management Homepage Arbitrary Command Execution Vulnerability

HPE System Management Homepage is a Web-based interface from Hewlett Packard Enterprise. An arbitrary command execution vulnerability exists in HPE System Management Homepage, which allows an attacker to submit a special request to execute arbitrary OS commands in an application context...

The vulnerability of the mnt_ping.cgi service in the microprogramming software of the Technicolor TD5336 router allows a hacker to execute arbitrary operating system commands with superuser privileges.

The vulnerability of the mntping.cgi service in the microprogramming software of the Technicolor TD5336 router exists due to the failure to take measures to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a malicious actor to execute arbitra...

Corega CG-WLR300NM OS Command Execution Vulnerability

The Corega CG-WLR300NM is a wireless router from Corega Japan. A security vulnerability exists in the Corega CG-WLR300NM using firmware version 1.90 and earlier. An attacker can exploit the vulnerability to execute arbitrary operating system commands...

CVE-2017-2275

WG-C10 v3.0.79 and earlier allows an attacker to execute arbitrary OS commands via unspecified vectors...

CVE-2017-2183

HOME SPOT CUBE2 firmware V101 and earlier allows authenticated attackers to execute arbitrary OS commands via Clock Settings...

KDDI HOME SPOT CUBE WebUI Operating System Command Injection Vulnerability

KDDI HOME SPOT CUBE is a home wireless router product from KDDI Japan.WebUI is one of the graphical user interfaces. An operating system command injection vulnerability exists in the WebUI of the KDDI HOME SPOT CUBE2 using firmware version 101 and earlier. A remote attacker can exploit this...

CVE-2017-2112

TS-WPTCAM firmware version 1.18 and earlier, TS-WPTCAM2 firmware version 1.00, TS-WLCE firmware version 1.18 and earlier, TS-WLC2 firmware version 1.18 and earlier, TS-WRLC firmware version 1.17 and earlier, TS-PTCAM firmware version 1.18 and earlier, TS-PTCAM/POE firmware version 1.18 and earlie...

Tablacus Explorer vulnerable to script injection

Overview Tablacus Explorer is a tabbled file manager. Tablacus Explorer contains a script injection vulnerability due to improper handling of directory names. Touma Hatano reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning...

AlienVault OSSIM/USM Remote Code Execution Exploit

This Metasploit module exploits object injection, authentication bypass and ip spoofing vulnerabilities all together. Unauthenticated users can execute arbitrary commands under the context of the root user. By abusing authentication bypass issue on gauge.php lead adversaries to exploit object...

MVPower DVR TV-7104HE 1.8.4 115215B9 Shell Unauthenticated Command Execution Exploit

This Metasploit module exploits an unauthenticated remote command execution vulnerability in MVPower digital video recorders. The 'shell' file on the web interface executes arbitrary operating system commands in the query string. This Metasploit module was tested successfully on a MVPower model...

AlienVault OSSIM/USM < 5.3.1 - Remote Code Execution (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule "AlienVault OSSIM/USM Remote Code Execution", 'Description' = %q This module exploits object injection, authentication bypass an...

Cisco ATA 187 Analog Telephone Adapter Unauthorized Access Security Bypass Vulnerability (cisco-sa-20130206-ata187)

Cisco ATA-187 is prone to a security bypass vulnerability because it allows attackers to gain unauthorized access to the device. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

CVE-2016-0325

IBM Rational Collaborative Lifecycle Management 3.0.1.6 before iFix8, 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Quality Manager 3.0.1.6 before iFix8, 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Team Concert...

Sophos Web Appliance v4. 2. 1. 3 remote code execution vulnerability

Multiple parameters to the web interface are unsafely handled and can be used to run operating system commands, such as: POST /index.php?c=logs HTTP/1.1 Host: redacted User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10.10; rv:46.0 Gecko/20100101 Firefox/46.0 Accept: text/javascript, text/html,...

Moxa OnCell Series Products OS Command Execution Vulnerability

MOXA OnCell is an industrial grade IP gateway product. An OS command execution vulnerability exists in Moxa OnCell Series products, which can be exploited by an attacker to execute arbitrary OS commands...

Cisco Cloud Services Platform 2.x < 2.1.0 Multiple Vulnerabilities

According to its self-reported version number, the remote Cisco Cloud Services Platform CSP device is 2.x prior to 2.1.0. It is, therefore, affected by the following vulnerabilities : - A command injection vulnerability exists in the web-based GUI due to improper sanitization of user-supplied...