18579 matches found
CVE-2018-14067: Improper Neutralization of Special Elements used in a Command
Green Packet WiMax DV-360 2.10.14-g1.0.6.1 devices allow Command Injection, with unauthenticated remote command execution, via a crafted payload to the HTTPS port, because lighttpd listens on all network interfaces including the external Internet by default. NOTE: this may overlap CVE-2017-9980...
CVE-2020-19664: Improper Neutralization of Special Elements used in an OS Command
DrayTek Vigor2960 1.5.1 allows remote command execution via shell metacharacters in a toLogin2FA action to mainfunction.cgi...
PT-2020-8532
Name of the Vulnerable Software and Affected Versions: Green Packet WiMax DV-360 version 2.10.14-g1.0.6.1 Description: The issue allows for Command Injection, enabling unauthenticated remote command execution. This can be achieved by sending a crafted payload to the HTTPS port. The problem arises...
Draytek Vigor2960 Parameter Injection Vulnerability
The Draytek Vigor2960 is a load balancing router and VPN gateway appliance from Draytek Taiwan, China. A parameter injection vulnerability exists in the DrayTek Vigor2960 1.5.1, which allows remote command execution via toLogin2FA action to mainfunction.cgi...
CVE-2020-10148
The SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commands. This vulnerability could allow a remote attacker to bypass authentication and execute API commands which may result in a compromise of the SolarWinds instance. SolarWinds...
CVE-2020-35713
Belkin LINKSYS RE6500 devices before 1.0.012.001 allow remote attackers to execute arbitrary commands or set a new password via shell metacharacters to the goform/setSysAdm page...
CVE-2020-35713: Improper Neutralization of Special Elements used in an OS Command
Belkin LINKSYS RE6500 devices before 1.0.012.001 allow remote attackers to execute arbitrary commands or set a new password via shell metacharacters to the goform/setSysAdm page...
SolarWinds Orion API authentication bypass allows remote command execution
Overview The SolarWinds Orion API is vulnerable to authentication bypass that could allow a remote attacker to execute API commands. Description The SolarWinds Orion Platform is a suite of infrastructure and system monitoring and management products. The SolarWinds Orion API is embedded into the...
CVE-2020-28188
Remote Command Execution RCE vulnerability in TerraMaster TOS = 4.2.06 allow remote unauthenticated attackers to inject OS commands via /include/makecvs.php in Event parameter...
CVE-2020-28188: Improper Neutralization of Special Elements used in an OS Command
Remote Command Execution RCE vulnerability in TerraMaster TOS = 4.2.06 allow remote unauthenticated attackers to inject OS commands via /include/makecvs.php in Event parameter...
CVE-2020-28188
Remote Command Execution RCE vulnerability in TerraMaster TOS = 4.2.06 allow remote unauthenticated attackers to inject OS commands via /include/makecvs.php in Event parameter. Recent assessments: gwillcox-r7 at January 21, 2021 3:28am UTC reported: Noted as exploited in the wild by CheckPoint...
CVE-2020-28188
TerraMaster TOS is affected up to version 4.2.06 with unauthenticated remote code execution via /include/makecvs.php in the Event parameter. The underlying issue is a command-injection flaw that lets an attacker run arbitrary OS commands on the system, typically with the web app user privileges. ...
CVE-2020-28188
Remote Command Execution RCE vulnerability in TerraMaster TOS = 4.2.06 allow remote unauthenticated attackers to inject OS commands via /include/makecvs.php in Event parameter...
Webmin 1.962 Remote Command Execution
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Webmin 1.962 - Package Update Escape Bypass RCE Metasploit', 'Description' = %q This module exploits an arbitrary command execution vulnerability...
TP-LINK TL-WR849N Router Command Injection
The vulnerability of TP-LINK’s TL-WR849N router software relates to the lack of measures taken to neutralize special elements used in operating system teams. Exploiting this vulnerability allows a malicious actor to remotely execute arbitrary commands using special metashell shells...
zzzphp Eval Injection Vulnerability
zzphp is an open source free website building system. An Eval injection vulnerability exists in the parserCommom method of the ParserTemplate class in zzzztemplate.php in zzzphp 1.7.2. A remote attacker can exploit this vulnerability to execute arbitrary commands...
CVE-2020-20298: Improper Control of Generation of Code
Eval injection vulnerability in the parserCommom method in the ParserTemplate class in zzztemplate.php in zzzphp 1.7.2 allows remote attackers to execute arbitrary commands...
Samsung WLAN AP Unauthorized RCE Vulnerability
Samsung Electronics is a subsidiary of the Samsung Group. It is the largest manufacturer of consumer electronics and electronic components in Korea and the largest information technology company in the world. The Samsung WLAN AP Unauthorized RCE vulnerability can be exploited by remote attackers ...
camel: DNS Rebinding in JMX Connector could result in remote command execution
Apache Camel's JMX is vulnerable to Rebind Flaw. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.x, 3.0.0 up to 3.1.0 is affected. Users should upgrade to 3.2.0...