Fortinet FCM-MB40 Remote Command Execution

A remote command execution vulnerability exists in Fortinet FCM-MB40. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

SUSE SLES15 Security Update : helm-mirror (SUSE-SU-2019:0048-2)

This update for helm-mirror to version 0.2.1 fixes the following issues : Security issues fixed : CVE-2018-16873: Fixed a remote command execution bsc1118897 CVE-2018-16874: Fixed a directory traversal in 'go get' via curly braces in import path bsc1118898 CVE-2018-16875: Fixed a CPU denial of...

SUSE-SU-2019:0048-2 Security update for helm-mirror

This update for helm-mirror to version 0.2.1 fixes the following issues: Security issues fixed: - CVE-2018-16873: Fixed a remote command execution bsc1118897 - CVE-2018-16874: Fixed a directory traversal in 'go get' via curly braces in import path bsc1118898 - CVE-2018-16875: Fixed a CPU denial o...

The vulnerability of the command-line interface of the Cisco Integrated Management Controller, a remote administration tool, allows a malicious actor to execute arbitrary commands with root privileges.

The vulnerability of the command-line interface of the Cisco Integrated Management Controller remote management software exists because measures to neutralize the special elements used in the operating system’s command are not taken. Exploiting this vulnerability allows an attacker to execute...

The vulnerability of the Dell EMC Avamar Server backup system and the DELL EMC Integrated Data Protection system arises from the failure to take measures to eliminate special elements used in the operating system command set, allowing attackers to execute arbitrary commands with root privileges.

The vulnerability of the Dell EMC Avamar Server backup system and the DELL EMC Integrated Data Protection system exists due to the lack of measures taken to neutralize special elements used in the operating system. Exploiting this vulnerability allows a malicious actor to execute arbitrary comman...

The vulnerability of the EXCU_SHELL component in D-Link’s microprogramming router software allows a hacker to execute arbitrary commands on a vulnerable device under the control of the root user.

The vulnerability of the EXCUSHELL component in D-Link’s microprogramming router software exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor, operating remotely, to execute arbitrary commands on the vulnerable device under the identity of t...

Nortek Security & Control Linear eMerge 50P/5000P Command Injection Vulnerability

Nortek Security & Control Linear eMerge 50P/5000P is a browser-based access control system from Nortek Security & Control, USA. A command injection vulnerability exists in the Nortek Security & Control Linear eMerge 50P/5000P, which can be exploited by an attacker to execute illegal operating...

TRENDnet TEW-827DRU Command Injection Vulnerability (CNVD-2019-25519)

The TRENDnet TEW-827DRU is a wireless router from TRENDnet. A command injection vulnerability exists in the apply.cgi file in the TRENDnet TEW-827DRU using firmware prior to version 2.05B11. The vulnerability stems from a network system or product not properly filtering specific elements of...

CVE-2019-13131

Super Micro SuperDoctor 5, when restrictions are not implemented in agent.cfg, allows remote attackers to execute arbitrary commands via NRPE...

FaceSentry Access Control System 6.4.8 - Remote Command Injection

FaceSentry Access Control System 6.4.8 Remote Command Injection Vendor: iWT Ltd. Product web page: http://www.iwt.com.hk Affected version: Firmware 6.4.8 build 264 Algorithm A16 Firmware 5.7.2 build 568 Algorithm A14 Firmware 5.7.0 build 539 Algorithm A14 Summary: FaceSentry 5AN is a revolutionar...

PT-2019-12514 · Synology · Synology Calendar

Name of the Vulnerable Software and Affected Versions: Synology Calendar versions prior to 2.3.1-0617 Description: The issue allows remote attackers to execute arbitrary commands via a crafted 'X-Real-IP' header. This is related to an OS command injection vulnerability in the drivers syno import...

Remote Command Execution Vulnerability in Zhiyuan A8+ Collaboration Management Software

Zhiyuan Internet is a provider of collaboration management software and cloud services in China, specializing in the field of collaboration management software. A remote command execution vulnerability exists in Zhiyuan A8+ collaboration management software. An attacker can Getshell the target...

SeedDMS versions < 5.1.11 - Remote Command Execution Exploit

Exploit for php platform in category web applications Exploit Title: Remote Command Execution through Unvalidated File Upload in SeedDMS versions "; $cmd = $REQUEST'cmd'; system$cmd; echo ""; die; ? Step 3: Now after uploading the file check the document id corresponding to the document. Step 4:...

Fortinet FCM-MB40 - Cross-Site Request Forgery / Remote Command Execution Exploit

Exploit for hardware platform in category web applications Exploit Title: FCM-MB40 Remote Command Execution as Root via CSRF Date: 2019-06-19 Exploit Author: @XORcat Vendor Homepage: https://fortinet.com/ Software Link: Customer Account Required Version: v1.2.0.0 Tested on: Linux CVE : TBA !--...

SuperDoctor5 - (NRPE) Remote Code Execution Exploit

SuperMicro implemented a Remote Command Execution plugin in their implementation of NRPE in SuperDocter 5, which is their monitoring utility for SuperMicro chassis'. This is an intended feature but leaves the system open by default to unauthenticated remote command execution by abusing the...

SAPIDO RB-1732 - Remote Command Execution Exploit

Exploit Title: SAPIDO RB-1732 command line execution Exploit Author: k1nm3n.aotoi Vendor Homepage: http://www.sapido.com.tw/ Software Link: http://www.sapido.com.tw/CH/data/Download/firmware/rb1732/tc/RB-1732TCv2.0.43.bin Version: RB-1732 V2.0.43 Tested on: linux import requests import sys def...

CVE-2019-12949

In pfSense 2.4.4-p2 and 2.4.4-p3, if it is possible to trick an authenticated administrator into clicking on a button on a phishing page, an attacker can leverage XSS to upload arbitrary executable code, via diagcommand.php and rrdfetchjson.php timePeriod parameter, to a server. Then, the remote...

SAPIDO RB-1732 - Remote Command Execution

SAPIDO RB-1732 - Remote Command Execution Exploit Title: SAPIDO RB-1732 command line execution Date: 2019-6-24 Exploit Author: k1nm3n.aotoi Vendor Homepage: http://www.sapido.com.tw/ Software Link: http://www.sapido.com.tw/CH/data/Download/firmware/rb1732/tc/RB-1732TCv2.0.43.bin Version: RB-1732...

Mozilla Thunderbird < 60.7.2

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 60.7.2. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2019-20 advisory. - Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent...

Mozilla Thunderbird < 60.7.2

The version of Thunderbird installed on the remote Windows host is prior to 60.7.2. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2019-20 advisory. - Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can...