13954 matches found
CVE-2015-8334
SQL injection vulnerability in the Operation and Maintenance Unit OMU in Huawei VCN500 before V100R002C00SPC201 allows remote authenticated users to execute arbitrary SQL commands via a crafted HTTP request...
CVE-2015-8334
SQL injection vulnerability in the Operation and Maintenance Unit OMU in Huawei VCN500 before V100R002C00SPC201 allows remote authenticated users to execute arbitrary SQL commands via a crafted HTTP request...
CVE-2017-12422
NetApp StorageGRID Webscale 10.2.x before 10.2.2.3, 10.3.x before 10.3.0.4, and 10.4.x before 10.4.0.2 allow remote authenticated users to delete arbitrary objects via unspecified vectors...
ALPINE-CVE-2016-0634
The expansion of '\h' in the prompt string in bash 4.3 allows remote authenticated users to execute arbitrary code via shell metacharacters placed in 'hostname' of a machine...
CVE-2014-5302
Directory traversal vulnerability in ServiceDesk Plus and Plus MSP v5 through v9.0 v9030; AssetExplorer v4 to v6.1; SupportCenter v5 to v7.9; IT360 v8 to v10.4 allows remote authenticated users to execute arbitrary code...
CVE-2016-0634
The expansion of '\h' in the prompt string in bash 4.3 allows remote authenticated users to execute arbitrary code via shell metacharacters placed in 'hostname' of a machine...
CVE-2017-7693
Directory traversal vulnerability in viewerscript.jsp in Riverbed OPNET App Response Xpert ARX version 9.6.1 allows remote authenticated users to inject arbitrary commands to read OS files...
Directory traversal
Directory traversal vulnerability in viewerscript.jsp in Riverbed OPNET App Response Xpert ARX version 9.6.1 allows remote authenticated users to inject arbitrary commands to read OS files...
CVE-2017-7693
The provided sources confirm a Directory Traversal vulnerability in Riverbed OPNET App Response Xpert (ARX) version 9.6.1, exposed via viewer_script.jsp. The issue allows remote authenticated users to inject arbitrary commands to read operating-system files, indicating a file-read/root-cause weak...
CVE-2017-7693
Directory traversal vulnerability in viewerscript.jsp in Riverbed OPNET App Response Xpert ARX version 9.6.1 allows remote authenticated users to inject arbitrary commands to read OS files...
Sql injection
Multiple SQL injection vulnerabilities in the orion.extfeedbackform module before 2.1.3 for Bitrix allow remote authenticated users to execute arbitrary SQL commands via the 1 order or 2 "by" parameter to admin/orion.extfeedbackformefbfforms.php...
CVE-2015-8355
Multiple SQL injection vulnerabilities in the orion.extfeedbackform module before 2.1.3 for Bitrix allow remote authenticated users to execute arbitrary SQL commands via the 1 order or 2 "by" parameter to admin/orion.extfeedbackformefbfforms.php...
Code injection
ZTE ADSL ZXV10 W300 modems W300V2.1.0fER7PEO57 and W300V2.1.0hER7PEO57 allow remote authenticated users to obtain user passwords by displaying user information in a Telnet connection...
CVE-2015-7259
ZTE ADSL ZXV10 W300 modems W300V2.1.0fER7PEO57 and W300V2.1.0hER7PEO57 allow user accounts to have multiple valid username and password pairs, which allows remote authenticated users to login to a target account via any of its username and password pairs...
CVE-2015-7258
ZTE ADSL ZXV10 W300 modems W300V2.1.0fER7PEO57 and W300V2.1.0hER7PEO57 allow remote authenticated users to obtain user passwords by displaying user information in a Telnet connection...
PYSEC-2017-41
The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisord namespace lookups...
Cross site request forgery (csrf)
The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisord namespace lookups...
CVE-2017-11610
The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisord namespace lookups...
CVE-2017-11610
The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisord namespace lookups. Recent assessments: Assessed Attacker Value...
