CVE-2020-8797

Juplink RX4-1500 v1.0.3 allows remote attackers to gain root access to the Linux subsystem via an unsanitized exec call aka Command Line Injection, if the undocumented telnetd service is enabled and the attacker can authenticate as admin from the local network...

CVE-2020-10120

cPanel before 84.0.20 allows resellers to achieve remote code execution as root via a cpsrvd rsync shell SEC-545...

CVE-2019-9859

Vesta Control Panel VestaCP 0.9.7 through 0.9.8-23 is vulnerable to an authenticated command execution that can result in remote root access on the server. The platform works with PHP as the frontend language and uses shell scripts to execute system actions. PHP executes shell script through the...

Design/Logic Flaw

Vesta Control Panel VestaCP 0.9.7 through 0.9.8-23 is vulnerable to an authenticated command execution that can result in remote root access on the server. The platform works with PHP as the frontend language and uses shell scripts to execute system actions. PHP executes shell script through the...

CVE-2019-9859

Vesta Control Panel VestaCP 0.9.7 through 0.9.8-23 is vulnerable to an authenticated command execution that can result in remote root access on the server. The platform works with PHP as the frontend language and uses shell scripts to execute system actions. PHP executes shell script through the...

CVE-2019-9859

CVE-2019-9859 affects Vesta Control Panel (VestaCP) versions 0.9.7 through 0.9.8-23. An authenticated attacker can trigger command execution via PHP that may escalate to remote root access. The vulnerability stems from how VestaCP uses the PHP function exec to run shell scripts and how escapeshel...

CVE-2019-12511

In NETGEAR Nighthawk X10-R9000 prior to 1.0.4.26, an attacker may execute arbitrary system commands as root by sending a specially-crafted MAC address to the "NETGEAR Genie" SOAP endpoint at AdvancedQoS:GetCurrentBandwidthByMAC. Although this requires QoS being enabled, advanced QoS being enabled...

PT-2019-18506 · Optergy · Optergy Proton/Enterprise

Name of the Vulnerable Software and Affected Versions: Optergy Proton/Enterprise devices affected versions not specified Description: The issue allows for remote root code execution via a backdoor console. Recommendations: At the moment, there is no information about a newer version that contains...

New Exploit for MikroTik Router WinBox Vulnerability Gives Full Root Access

A known vulnerability in MikroTik routers is potentially far more dangerous than previously thought. A cybersecurity researcher from Tenable Research has released a new proof-of-concept PoC RCE attack for an old directory traversal vulnerability that was found and patched within a day of its...

CVE-2018-12336

Undocumented Factory Backdoor in ECOS Secure Boot Stick aka SBS 5.6.5 allows the vendor to extract confidential information via remote root SSH access...

Red Hat Linux DHCP Client Found Vulnerable to Command Injection Attacks

A Google security researcher has discovered a critical remote command injection vulnerability in the DHCP client implementation of Red Hat Linux and its derivatives like Fedora operating system. The vulnerability, tracked as CVE-2018-1111 , could allow attackers to execute arbitrary commands with...

PT-2018-4014 · Teltonika · Teltonika Rut9Xx

Name of the Vulnerable Software and Affected Versions: Teltonika RUT9XX routers with firmware before 00.04.233 Description: The issue is related to multiple unauthenticated OS command injection vulnerabilities in autologin.cgi and hotspotlogin.cgi due to insufficient user input sanitization. This...

CVE-2017-14459

An exploitable OS Command Injection vulnerability exists in the Telnet, SSH, and console login functionality of Moxa AWK-3131A Industrial IEEE 802.11a/b/g/n wireless AP/bridge/client in firmware versions 1.4 to 1.7 current. An attacker can inject commands via the username parameter of several...

The vulnerability of the flexFileUpload component in the HPE Intelligent Management Center PLAT software platform allows a perpetrator to execute arbitrary code.

The vulnerability of the flexFileUpload component in the HPE Intelligent Management Center PLAT software platform is related to insufficient validation of the path name to the catalog directory. Exploiting this vulnerability could allow a malicious actor, operating remotely, to execute arbitrary...

The vulnerability of the ScaleIO debugging storage network service of EMC allows a hacker to execute arbitrary commands.

The vulnerability of the EMC ScaleIO Storage Network Debugging service SDBG is caused by buffer overflow. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands with root privileges remotely...

Trustwave Secure Web Gateway Elevation of Privilege Vulnerability

Trustwave Secure Web Gateway SWG is a web security gateway product from Trustwave, Inc. A security vulnerability exists in Trustwave SWG version 11.8.0.27 and earlier. A remote attacker can exploit the vulnerability by sending the 'publicKey' parameter to the /sendKey URI to add an arbitrary publ...

Design/Logic Flaw

Trustwave Secure Web Gateway SWG through 11.8.0.27 allows remote attackers to append an arbitrary public key to the device's SSH Authorized Keys data, and consequently obtain remote root access, via the publicKey parameter to the /sendKey URI...

CVE-2017-18001

Trustwave Secure Web Gateway SWG through 11.8.0.27 allows remote attackers to append an arbitrary public key to the device's SSH Authorized Keys data, and consequently obtain remote root access, via the publicKey parameter to the /sendKey URI...

The vulnerability of the ALEOS software for the Sierra Wireless AirLink GX 440 wireless gateway, related to deficiencies in access control, allows a hacker to execute commands using the web interface with root privileges.

The vulnerability of the ALEOS software used in the Sierra Wireless AirLink GX 440 wireless gateway relates to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to execute commands using a web-based management interface with root...

The vulnerability of the OceanStor UDS storage system, related to improper code generation management, allows a attacker to execute arbitrary commands with root privileges.

The vulnerability of the OceanStor UDS storage system is related to incorrect code generation management. Exploiting this vulnerability allows a malicious actor, operating remotely, to execute arbitrary code with root privileges, using a specially created UDS patch with custom scripts...