Advanced Comment System 1.0 - Remote Command Execution Exploit

Exploit Title: Advanced Comment System 1.0 - Remote Command Execution RCE Exploit Author: Nicole Daniella Murillo Mejias Version: Advanced Comment System 1.0 Tested on: Linux !/usr/bin/env python3 DESCRIPTION: Commands are Base64 encoded and sent via POST requests to the vulnerable application, t...

The vulnerability of the getprofile.sh script, a monitoring tool for Nagios XI, allows a perpetrator to execute arbitrary commands.

The vulnerability of the getprofile.sh script, a monitoring tool for Nagios XI, is related to the failure to take measures to neutralize special elements used in the operating system’s command line. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

The vulnerability of the Git-based software platform for collaborative code development on GitLab, related to insufficient validation of input data, allows a hacker to execute arbitrary commands.

The vulnerability of the Git-based software platform for collaborative code development on GitLab is related to insufficient validation of input data during syntax analysis of image files. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

The vulnerability of the web interface of Cisco Catalyst PON CGP-ONT series microprogramming software routers is related to insufficient validation of input data, allowing attackers to execute arbitrary commands.

The vulnerability of the web interface of Cisco Catalyst PON CGP-ONT series router microprogramming software is related to insufficient validation of input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

CVE-2020-7879

This issue was discovered when the ipTIME C200 IP Camera was synchronized with the ipTIME NAS. It is necessary to extract value for ipTIME IP camera because the ipTIME NAS send ans setCookie'COOKIE' . The value is transferred to the --header option in wget binary, and there is no validation check...

Design/Logic Flaw

This issue was discovered when the ipTIME C200 IP Camera was synchronized with the ipTIME NAS. It is necessary to extract value for ipTIME IP camera because the ipTIME NAS send ans setCookie'COOKIE' . The value is transferred to the --header option in wget binary, and there is no validation check...

Tobesoft Nexacro 输入验证错误漏洞

Tobesoft Nexacro is a unified framework-based OSMU single-source multi-purpose application development solution from Tobesoft, South Korea. Nexacro 17 suffers from a security vulnerability that stems from an arbitrary file creation due to incorrect input validation found in the copy method of the...

Gerapy Authentication Remote Command Execution Vulnerability

Gerapy is a crawler framework based on the Scrapy Scrapyd Scrapyd Client Scrapyd API Django. Gerapy authenticates remote command execution vulnerabilities, which can be exploited by attackers to gain control of the server...

CVE-2021-44093

A Remote Command Execution vulnerability on the background in zrlog 2.2.2, at the upload avatar function, could bypass the original limit, upload the JSP file to get a WebShell...

CVE-2021-44093

A Remote Command Execution vulnerability on the background in zrlog 2.2.2, at the upload avatar function, could bypass the original limit, upload the JSP file to get a WebShell...

CVE-2021-44094

ZrLog 2.2.2 has a remote command execution vulnerability at plugin download function, it could execute any JAR file...

CVE-2021-44093

A Remote Command Execution vulnerability on the background in zrlog 2.2.2, at the upload avatar function, could bypass the original limit, upload the JSP file to get a WebShell...

Design/Logic Flaw

A Remote Command Execution vulnerability on the background in zrlog 2.2.2, at the upload avatar function, could bypass the original limit, upload the JSP file to get a WebShell...

Design/Logic Flaw

ZrLog 2.2.2 has a remote command execution vulnerability at plugin download function, it could execute any JAR file...

CVE-2021-44094

ZrLog 2.2.2 has a remote command execution vulnerability at plugin download function, it could execute any JAR file...

CVE-2021-44094

ZrLog 2.2.2 is affected by CVE-2021-44094, a remote command execution vulnerability in the plugin download function that could lead to arbitrary JAR execution. The description across multiple sources confirms the issue exists in ZrLog 2.2.2, a Java-based blogging system, but the connected documen...

CVE-2021-44093

A Remote Command Execution vulnerability on the background in zrlog 2.2.2, at the upload avatar function, could bypass the original limit, upload the JSP file to get a WebShell...

CVE-2021-44093

CVE-2021-44093 affects zrlog 2.2.2. A Remote Command Execution vulnerability exists in the avatar upload function, allowing bypass of the original limit and uploading a JSP file to obtain a WebShell. Multiple sources (NVD/NVDC, CNVD, Red Hat, CNVD, CNNVD, CVE listing) corroborate the issue and it...

CVE-2021-38873

IBM Planning Analytics 2.0 is potentially vulnerable to CSV Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 208396...

CVE-2021-20850

PowerCMS XMLRPC API of PowerCMS 5.19 and earlier, PowerCMS 4.49 and earlier, PowerCMS 3.295 and earlier, and PowerCMS 2 Series End-of-Life, EOL allows a remote attacker to execute an arbitrary OS command via unspecified vectors...