CVE-2020-35131

Cockpit before 0.6.1 allows an attacker to inject custom PHP code and achieve Remote Command Execution via registerCriteriaFunction in lib/MongoLite/Database.php, as demonstrated by values in JSON data to the /auth/check or /auth/requestreset URI...

Command injection

Cockpit before 0.6.1 allows an attacker to inject custom PHP code and achieve Remote Command Execution via registerCriteriaFunction in lib/MongoLite/Database.php, as demonstrated by values in JSON data to the /auth/check or /auth/requestreset URI...

CVE-2020-35131

Cockpit before 0.6.1 allows an attacker to inject custom PHP code and achieve Remote Command Execution via registerCriteriaFunction in lib/MongoLite/Database.php, as demonstrated by values in JSON data to the /auth/check or /auth/requestreset URI...

CVE-2020-35131

Affected software: Cockpit CMS pre-0.6.1. The vulnerability is a code execution flaw caused by insecure handling of registerCriteriaFunction in lib/MongoLite/Database.php, enabling an attacker to inject PHP through crafted JSON values to /auth/check or /auth/requestreset. Impact is remote, unauth...

Cockpit code injection vulnerability

Cockpit is an interactive server management interface. A code injection vulnerability exists in versions prior to Cockpit 0.6.1 that allows an attacker to inject custom PHP code and enable remote command execution...

Cockpit CMS Remote Code Execution

Cockpit CMS 0.6.1 - Remote Code Execution Product: Cockpit CMS https://getcockpit.com Version: Cockpit CMS = 0.6.1...

CVE-2020-35131: Improper Control of Generation of Code

Cockpit before 0.6.1 allows an attacker to inject custom PHP code and achieve Remote Command Execution via registerCriteriaFunction in lib/MongoLite/Database.php, as demonstrated by values in JSON data to the /auth/check or /auth/requestreset URI...

PT-2021-11714 · Cockpit · Cockpit

Name of the Vulnerable Software and Affected Versions: Cockpit versions prior to 0.6.1 Description: The issue allows an attacker to inject custom PHP code and achieve Remote Command Execution via the registerCriteriaFunction in lib/MongoLite/Database.php. This can be demonstrated by sending value...

Fortinet FortiDeceptor Operating System Command Injection Vulnerability

Fortinet FortiDeceptor is a cyber threat detection platform from the American company Fiat Fortinet. The platform focuses on exposing cyber threats through deception techniques, among other things. A security vulnerability exists in FortiDeceptor 3.0.0, 3.0.1, 3.1.0 that could allow a remote user...

CMS Made Simple 2.2.15 Remote Command Execution

Exploit Title: CMS Made Simple 2.2.15 - RCE Authenticated Author: Andrey Stoykov Vendor Homepage: https://www.cmsmadesimple.org/ Software Link: https://www.cmsmadesimple.org/downloads/cmsms Version: 2.2.15 Tested on: Debian 10 LAMPP Exploit and Detailed Info:...

VulnCheck KEV: CVE-2015-7450

Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers to execute arbitrary commands...

Online Learning Management System 1.0 Remote Command Execution

Exploit Title: Online Learning Management System 1.0 - RCE Authenticated Date: 01.01.2021 Exploit Author: Bedri Sertkaya Vendor Homepage: https://www.sourcecodester.com/php/7339/learning-management-system.html Software Link:...

Command injection

Green Packet WiMax DV-360 2.10.14-g1.0.6.1 devices allow Command Injection, with unauthenticated remote command execution, via a crafted payload to the HTTPS port, because lighttpd listens on all network interfaces including the external Internet by default. NOTE: this may overlap CVE-2017-9980...

CVE-2018-14067

CVE-2018-14067 affects Green Packet WiMax DV-360 devices running 2.10.14-g1.0.6.1. The issue is a command injection vulnerability causing unauthenticated remote command execution when a crafted payload is sent to the HTTPS port. The underlying cause cited is that lighttpd listens on all network i...

CVE-2020-19664

DrayTek Vigor2960 1.5.1 allows remote command execution via shell metacharacters in a toLogin2FA action to mainfunction.cgi...

CVE-2020-19664

DrayTek Vigor2960 1.5.1 allows remote command execution via shell metacharacters in a toLogin2FA action to mainfunction.cgi...

Design/Logic Flaw

DrayTek Vigor2960 1.5.1 allows remote command execution via shell metacharacters in a toLogin2FA action to mainfunction.cgi...

CVE-2020-19664

Conflict-free summary (CVE-2020-19664): Affects DrayTek Vigor2960 firmware, notably 1.5.1, where remote command execution is possible via shell metacharacters in a toLogin2FA action directed at mainfunction.cgi. Root cause: failure to neutralize shell metacharacters in the toLogin2FA path. Conseq...

CVE-2020-19664

DrayTek Vigor2960 1.5.1 allows remote command execution via shell metacharacters in a toLogin2FA action to mainfunction.cgi...

CVE-2020-35851: Improper Neutralization of Special Elements used in an OS Command

HGiga MailSherlock does not validate specific parameters properly. Attackers can use the vulnerability to launch Command inject attacks remotely and execute arbitrary commands of the system...