10271 matches found
Command injection
SecurEnvoy SecurMail 9.3.503 allows attackers to upload executable files and achieve OS command execution via a crafted SecurEnvoyReply cookie...
CVE-2020-13376
SecurEnvoy SecurMail 9.3.503 allows attackers to upload executable files and achieve OS command execution via a crafted SecurEnvoyReply cookie...
CVE-2020-13376
CVE-2020-13376 affects SecurEnvoy SecurMail 9.3.503. A vulnerability in the SecurEnvoyReply cookie allows an attacker to upload executable files and achieve OS command execution. The issue is described as a file-upload/command-injection vector enabling remote code execution; CVSS metrics in sourc...
OS Command Injection
cfme is vulnerable to OS command injection. An attacker is able to perform an out-of-band OS Command Injection through the conversion host...
OS Command Injection
webkit2gtk is vulnerable to OS command injection. An attacker is able to inject and execute arbitrary OS command via the Web Inspector...
CVE-2020-7361
The EasyCorp ZenTao Pro application suffers from an OS command injection vulnerability in its '/pro/repo-create.html' component. After authenticating to the ZenTao dashboard, attackers may construct and send arbitrary OS commands via the POST parameter 'path', and those commands will run in an...
Command injection
The EasyCorp ZenTao Pro application suffers from an OS command injection vulnerability in its '/pro/repo-create.html' component. After authenticating to the ZenTao dashboard, attackers may construct and send arbitrary OS commands via the POST parameter 'path', and those commands will run in an...
CVE-2020-7361 ZenTao Pro Command Injection
The EasyCorp ZenTao Pro application suffers from an OS command injection vulnerability in its '/pro/repo-create.html' component. After authenticating to the ZenTao dashboard, attackers may construct and send arbitrary OS commands via the POST parameter 'path', and those commands will run in an...
CVE-2020-7357
CVE-2020-7357 relates to Cayin CMS where an authenticated OS semi-blind command injection is possible via the NTP_Server_IP/NTP IP parameter in system.cgi. The issue requires authentication (default credentials) and can allow execution of arbitrary shell commands as root. Affected are multiple Ca...
CVE-2020-7361
CVE-2020-7361 affects EasyCorp ZenTao Pro (8.8.2 and earlier). A command-injection vulnerability exists in the vulnerable "/pro/repo-create.html" endpoint, where an authenticated user can send arbitrary OS commands through the POST parameter “path.” Executed commands run in the Windows SYSTEM con...
Exploit for OS Command Injection in Yaws
OS command injection in Yaws web server CVE-2020-24916 P...
RHEL 8 : CloudForms 5.0.7 update (Critical) (RHSA-2020:3358)
The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:3358 advisory. Red Hat CloudForms Management Engine delivers the insight, control, and automation needed to address the challenges of managing virtual...
Exploit for OS Command Injection in Pi-Hole
CVE-2020-8816 Pi-hole Remote Code Execution authenticated...
OS Command Injection
git-tags-remote is vulnerable to OS command injection. The vulnerability exists as it does not sanitize the value of repo in index.js, whose value is subsequently passed to an exec call...
Command injection
Grandstream HT800 series firmware version 1.0.17.5 and below is vulnerable to an OS command injection vulnerability. Unauthenticated remote attackers can execute arbitrary commands as root by crafting a special configuration file and sending a crafted SIP message...
CVE-2020-5760
The CVE-2020-5760 entry applies to Grandstream HT800 series firmware
CVE-2020-5760
Grandstream HT800 series firmware version 1.0.17.5 and below is vulnerable to an OS command injection vulnerability. Unauthenticated remote attackers can execute arbitrary commands as root by crafting a special configuration file and sending a crafted SIP message...
CVE-2020-15900
A memory corruption issue was found in Artifex Ghostscript 9.50 and 9.52. Use of a non-standard PostScript operator can allow overriding of file access controls. The ‘rsearch’ calculation for the ‘post’ size resulted in a size that was too large, and could underflow to max uint32t. This was fixed...
Command Injection in Kylin
Kylin has some restful apis which will concatenate os command with the user input string, a user is likely to be able to execute any os command without any protection or validation...