CVE-2021-27984: Unrestricted Upload of File with Dangerous Type

In Pluck-4.7.15 admin background a remote command execution vulnerability exists when uploading files...

CVE-2021-39065

IBM Spectrum Copy Data Management 2.2.13 and earlier could allow a remote attacker to execute arbitrary commands on the system, caused by improper validation of user-supplied input by the Spectrum Copy Data Management Admin Console login and uploadcertificate function . A remote attacker could...

Digi TransPort DR64 command injection vulnerability

The Digi International Digi TransPort is a full-featured cellular router from Digi International USA. A security vulnerability exists in the Digi TransPort DR64 that allows arbitrary remote commands to be executed using the SUPER privilege. This allows an attacker to exploit the vulnerability kno...

PT-2021-21094

Name of the Vulnerable Software and Affected Versions: Digi TransPort DR64 affected versions not specified Digi TransPort SR44 VC74 affected versions not specified Digi TransPort WR affected versions not specified Description: An issue was discovered in the ZING protocol, allowing arbitrary remot...

PT-2021-17702

Name of the Vulnerable Software and Affected Versions: Pluck version 4.7.15 Description: A remote command execution issue exists in the admin background when uploading files. Recommendations: For Pluck version 4.7.15, update to a version that fixes the remote command execution vulnerability. At t...

Pluck code issue vulnerabilities

Pluck is a content management system CMS developed using the PHP language. a code issue vulnerability exists in Pluck, which originates from the product's admin backend page that does not validate file content. An attacker could execute malicious commands through this vulnerability...

CVE-2021-35978: Improper Neutralization of Special Elements used in a Command

An issue was discovered in Digi TransPort DR64, SR44 VC74, and WR. The ZING protocol allows arbitrary remote command execution with SUPER privileges. This allows an attacker with knowledge of the protocol to execute arbitrary code on the controller including overwriting firmware, adding/removing...

Xstream Java Library Command Execution

The vulnerability of the Xstream Java library for converting objects into XML or JSON formats is related to improper handling of code generation. Exploiting this vulnerability allows an attacker to execute commands on the host by manipulating the processed input data...

Huawei HarmonyOS Wearables Out-of-Bounds Write Vulnerability (CNVD-2022-05172)

Huawei HarmonyOS Wearables is an electronic watch from Huawei, a Chinese company Huawei.An out-of-bounds write vulnerability exists in the Huawei HarmonyOS Wearables Bluetooth module. An attacker could exploit the vulnerability to cause remote command execution...

Huawei HarmonyOS Wearables Out-of-Bounds Writing Vulnerability

Huawei HarmonyOS Wearables is an electronic watch from Huawei, a Chinese company Huawei.An out-of-bounds write vulnerability exists in the Huawei HarmonyOS Wearables Bluetooth module. An attacker could exploit the vulnerability to cause remote command execution...

Cisco Small Business RV016 Router Command Injection

The vulnerability of the web-based management interface for Cisco Small Business RV016, Cisco Small Business RV042, Cisco Small Business RV042G, Cisco Small Business RV082, Cisco Small Business RV320, and Cisco Small Business RV325 routers exists due to insufficient validation of input data...

SAP CRM Path Traversal Command Execution

The vulnerability of the SAP Customer Relationship Management CRM system regarding customer relationship management is related to incorrect restrictions on the path to the restricted catalog. Exploitation of this vulnerability could allow a malicious actor to execute arbitrary commands remotely...

Yealink Device Management Arbitrary Command Execution

The vulnerability of the Yealink Device Management platform lies in the lack of measures for cleaning incoming data. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands on behalf of the root user remotely...

Huawei HarmonyOS Buffer Error Vulnerability

Huawei HarmonyOS Wearables is an electronic watch from Huawei, a Chinese company Huawei.An out-of-bounds write vulnerability exists in the Huawei HarmonyOS Wearables Bluetooth module. An attacker could exploit the vulnerability to cause remote command execution...

Huawei HarmonyOS Buffer Error Vulnerability

Huawei HarmonyOS Wearables is an electronic watch from Huawei, a Chinese company Huawei.An out-of-bounds write vulnerability exists in the Huawei HarmonyOS Wearables Bluetooth module. An attacker could exploit the vulnerability to cause remote command execution...

XStream: remote command execution attack by manipulating the processed input stream

A flaw was found in XStream. By manipulating the processed input stream, a remote attacker may be able to obtain sufficient rights to execute commands. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...

Advanced Comment System 1.0 - Remote Command Execution Exploit

Exploit Title: Advanced Comment System 1.0 - Remote Command Execution RCE Exploit Author: Nicole Daniella Murillo Mejias Version: Advanced Comment System 1.0 Tested on: Linux !/usr/bin/env python3 DESCRIPTION: Commands are Base64 encoded and sent via POST requests to the vulnerable application, t...

Advanced Comment System 1.0 Remote Command Execution

Exploit Title: Advanced Comment System 1.0 - Remote Command Execution RCE Date: November 30, 2021 Exploit Author: Nicole Daniella Murillo Mejias Version: Advanced Comment System 1.0 Tested on: Linux !/usr/bin/env python3 DESCRIPTION: Commands are Base64 encoded and sent via POST requests to the...

Advanced Comment System 1.0 - Remote Command Execution (RCE)

Exploit Title: Advanced Comment System 1.0 - Remote Command Execution RCE Date: November 30, 2021 Exploit Author: Nicole Daniella Murillo Mejias Version: Advanced Comment System 1.0 Tested on: Linux !/usr/bin/env python3 DESCRIPTION: Commands are Base64 encoded and sent via POST requests to the...

F5 Networks BIG-IP : BIG-IP TMUI vulnerability (K55543151)

The version of F5 Networks BIG-IP installed on the remote host is prior to 13.1.3.5 / 14.1.3.1 / 15.1.0.5 / 16.0.0. It is, therefore, affected by a vulnerability as referenced in the K55543151 advisory. - On version 15.1.x before 15.1.0.5, 14.1.x before 14.1.3.1, 13.1.x before 13.1.3.5, and all...