Design/Logic Flaw

graphrealtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has the graph real-time privilege...

CVE-2020-8813

graphrealtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has the graph real-time privilege...

CVE-2020-6841

D-Link DCH-M225 1.05b01 and earlier devices allow remote attackers to execute arbitrary OS commands via shell metacharacters in the spotifyConnect.php userName parameter...

CVE-2020-6841

D-Link DCH-M225 1.05b01 and earlier devices allow remote attackers to execute arbitrary OS commands via shell metacharacters in the spotifyConnect.php userName parameter...

Design/Logic Flaw

D-Link DCH-M225 1.05b01 and earlier devices allow remote attackers to execute arbitrary OS commands via shell metacharacters in the spotifyConnect.php userName parameter...

CVE-2020-6842

D-Link DCH-M225 (version 1.05b01 and earlier) is affected. The issue is a command injection where remote authenticated admins can execute arbitrary OS commands via shell metacharacters in the media renderer name, due to insufficient input sanitization. Documented impact aligns with high severity ...

CVE-2020-6841

D-Link DCH-M225 1.05b01 and earlier devices allow remote attackers to execute arbitrary OS commands via shell metacharacters in the spotifyConnect.php userName parameter...

Synacor Zimbra Collaboration Operating System Command Injection Vulnerability

Synacor Zimbra Collaboration Suite ZCS is an open source collaboration suite from Synacor, USA. The product includes WebMail, Calendar, Address Book and more. An operating system command injection vulnerability exists in Synacor Zimbra Collaboration versions prior to 8.0.9. The vulnerability stem...

Hyperledger: RCE vulnerability in Hyperledger Fabric SDK for Java

Hyperledger Fabric SDK for Java version 2.0.0 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability. In the following source code files and corresponding line number, an arbitrary file gets parsed by...

CVE-2020-5242

openHAB before 2.5.2 allow a remote attacker to use REST calls to install the EXEC binding or EXEC transformation service and execute arbitrary commands on the system with the privileges of the user running openHAB. Starting with version 2.5.2 all commands need to be whitelisted in a local file...

CVE-2014-4657

The safeeval function in Ansible before 1.5.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrary code via crafted instructions...

CVE-2013-2018

Multiple SQL injection vulnerabilities in BOINC allow remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2020-3154

Cisco Cloud Web Security (CWS) web UI contains a SQL injection vulnerability. The web-based management interface improperly validates SQL values, allowing an authenticated, remote attacker to send malicious requests to an affected device and modify or return values from the underlying database. A...

Exploit for Improper Handling of Exceptional Conditions in Openbsd Opensmtpd

CVE-2020-7247 Proof Of Concept Exploit for CVE...

CVE-2020-8010 Nimbus protocol allows unauth read/write/execute

CA Unified Infrastructure Management Nimsoft/UIM 20.1, 20.3.x, and 9.20 and below contains an improper ACL handling vulnerability in the robot controller component. A remote attacker can execute commands, read from, or write to the target system...

ELTEX NTP-RG-1402G OS Command Injection Vulnerability (CNVD-2020-10156)

ELTEX NTP-RG-1402G is a router product from the Russian company ELTEX. An operating system command injection vulnerability exists in the ELTEX NTP-RG-1402G 1v10 version 3.25.3.32. The vulnerability stems from a network system or product not properly filtering special characters, commands, etc. fr...

CVE-2014-7236

Eval injection vulnerability in lib/TWiki/Plugins.pm in TWiki before 6.0.1 allows remote attackers to execute arbitrary Perl code via the debugenableplugins parameter to do/view/Main/WebHome...

UBUNTU-CVE-2014-8089

SQL injection vulnerability in Zend Framework before 1.12.9, 2.2.x before 2.2.8, and 2.3.x before 2.3.3, when using the sqlsrv PHP extension, allows remote attackers to execute arbitrary SQL commands via a null byte...

CVE-2014-4981

LPAR2RRD in 3.5 and earlier allows remote attackers to execute arbitrary commands due to insufficient input sanitization of the web GUI parameters...

CVE-2020-7597

CVE-2020-7597 (codecov-node) affects the npm package codecov-node before 3.6.5. The issue allows remote attackers to execute arbitrary commands because the value passed as part of the gcov-root argument is executed by the exec function in lib/codecov.js. Root cause is an incomplete fix of CVE-202...