CVE-2020-18766

CVE-2020-18766 affects AntSword v2.0.7 and is described as a cross-site scripting (XSS) vulnerability that can remotely execute system commands. The connected records confirm the affected software version and the high-impact consequence (remote command execution) but do not provide a concrete roo...

CVE-2020-18766: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability AntSword v2.0.7 can remotely execute system commands...

CVE-2020-24632: Undefined Security Weakness

A remote execution of arbitrary commandss vulnerability was discovered in Aruba Airwave Software versions: Prior to 1.3.2...

CVE-2020-24631: Undefined Security Weakness

A remote execution of arbitrary commands vulnerability was discovered in Aruba Airwave Software versions: Prior to 1.3.2...

Command execution vulnerability in the backend of more than 100 systems shipped

Shipping 100 is a virtual goods automatic shipping system / article pay to read system, without human guards, customers can buy online to automatically complete the transaction. A command execution vulnerability exists in the backend of several Shipment 100 systems. Attackers can use the...

DrayTek Vigor < 1.5.1 Unauthenticated RCE (Direct Check)

Nessus was able to exploit an un-authenticated remote command execution vulnerability on the web adminstration UI on the remote router and was able to retrieve the contents of /etc/passwd. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid141781; scriptversion"1.6";...

Tenda AC15 AC1900 Router URI Injection

The vulnerability of the Tenda AC15 AC1900 router’s microprogramming software is related to the insufficient neutralization of special elements transmitted in URIs. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands on the target system by sending specially craft...

Bubble Accelerator (Windows Client) Command Execution Vulnerability

Bubble Accelerator is an acceleration tool for games. Bubble Accelerator Windows client A command execution vulnerability exists. An attacker can exploit the vulnerability to remotely execute commands and gain server privileges...

HiSilicon Video Encoder Malicious Firmware Code Execution

!/usr/bin/env bash Exploit Title: HiSilicon video encoders - RCE via unauthenticated upload of malicious firmware Date: 2020-09-20 Exploit Author: Alexei Kojenov Vendor Homepage: multiple vendors Software Link: N/A Version: vendor-specific Tested on: Linux CVE: CVE-2020-24217 Vendors: URayTech,...

Cisco Data Center Network Manager Command Execution

The vulnerability of the DCNM device’s dispatcher exists due to the lack of measures taken to neutralize special elements used in the operating system’s command set. Exploiting this vulnerability allows a malicious actor to execute arbitrary operating system commands remotely...

CVE-2020-4689

IBM Security Guardium 11.2 is vulnerable to CVS Injection. A remote privileged attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-ForceID: 186696...

MobileIron Core 10.3.0.x < 10.3.0.4-19 / 10.4.0.x < 10.4.0.4-22 / 10.5.1.1 < 10.5.1.1-22 / 10.5.2.1 < 10.5.2.1-14 / 10.6.0.1 < 10.6.0.1-19 / 10.7.0.0 < 10.7.0.0-28

According to its self-reported version number, the installation of MobileIron Core on the remote host is affected by multiple vulnerabilities: - A remote command execution vulnerability exists in MobileIron Core and Connector versions 10.6 and earlier, and Sentry versions 9.8 and earlier. An...

CVE-2020-4689

IBM Security Guardium 11.2 is vulnerable to CVS Injection. A remote privileged attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-ForceID: 186696...

CVE-2020-4280: Deserialization of Untrusted Data

IBM QRadar SIEM 7.3 and 7.4 could allow a remote attacker to execute arbitrary commands on the system, caused by insecure deserialization of user-supplied content by the Java deserialization function. By sending a malicious serialized Java object, an attacker could exploit this vulnerability to...

CVE-2020-26582

D-Link DAP-1360U before 3.0.1 devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in the IP JSON value for ping aka resconfigaction=3&resconfigid=18...

CVE-2020-16226

Multiple Mitsubishi Electric products are vulnerable to impersonations of a legitimate device by a malicious actor, which may allow an attacker to remotely execute arbitrary commands...

USN-4569-1 yaws vulnerabilities

It was discovered that Yaws did not properly sanitize XML input. A remote attacker could use this vulnerability to execute an XML External Entity XXE injection attack. CVE-2020-24379 It was discovered that Yaws mishandled certain input when running CGI scripts. A remote attacker could use this...

CVE-2020-16226: Predictable Exact Value from Previous Values

Multiple Mitsubishi Electric products are vulnerable to impersonations of a legitimate device by a malicious actor, which may allow an attacker to remotely execute arbitrary commands...

CVE-2020-14293

CVE-2020-14293 affects Secudos DOMOS 5.8 (OS Command Injection). The issue arises from insufficient input validation of user-provided data, allowing remote attackers to inject shell commands via the zone field in the web interface, potentially gaining root privileges. Public disclosures and advis...

HPESBST04034 rev.1 - HPE 3PAR Service Processor, Using Exim Mail Transfer Agent (MTA), Remote Command Execution.

Potential Security Impact: Remote: Arbitrary Command Execution SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE 3PAR Service Processor 5.0.6 and below CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- | --- | | CVE-2019-10149 |...