CVE-2019-25029

In Versa Director, the command injection is an attack in which the goal is execution of arbitrary commands on the host operating system via a vulnerable application. Command injection attacks are possible when an application passes unsafe user supplied data forms, cookies, HTTP headers etc. to a...

CVE-2019-25029

In Versa Director, the command injection is an attack in which the goal is execution of arbitrary commands on the host operating system via a vulnerable application. Command injection attacks are possible when an application passes unsafe user supplied data forms, cookies, HTTP headers etc. to a...

Versa Director command injection vulnerability

Versa Networks Versa Director is a virtualization and service creation platform from Versa Networks, USA. It simplifies the creation, automation and delivery of services using Versa FlexVNF. A command injection vulnerability exists in Versa Director, which stems from a failure to make valid...

PT-2021-7825

Name of the Vulnerable Software and Affected Versions homeLYnk Wiser For KNX versions prior to V2.60 spaceLYnk versions prior to V2.60 Description The issue is related to improper privilege management, which could allow an attacker to gain unauthorized access to the system shell when unauthorized...

PT-2021-7571

Name of the Vulnerable Software and Affected Versions FortiAI version 1.4.0 and earlier Description The issue is related to improper input validation, which may allow an authenticated user to gain system shell access via a malicious payload in the diagnose command. This can potentially lead to...

FortiNDR - OS command injection due to improper input sanitization

An improper input validation in FortiNDR v1.4.0 may allow an authenticated user to gain system shell access via a malicious payload in the "diagnose" command...

Command Injection

async-git is vulnerable to command injection. An attacker is able to inject malicious OS command to the system shell via the getter function in the index.js file...

Command Injection

async-git is vulnerable to command injection. An attacker is able to inject malicious OS command to the system shell via the getter function in the index.js file...

File Upload Vulnerability in freeCMS v1.5

FreeCMS is an open source free CMS system. FreeCMS v1.5 has a file upload vulnerability that can be exploited by an attacker to upload arbitrary files to obtain a system shell...

File upload vulnerability in freeCMS v1.5 (CNVD-2020-24737)

FreeCMS is an open source free CMS system. FreeCMS v1.5 has a file upload vulnerability that can be exploited by an attacker to upload arbitrary files to obtain a system shell...

Remote code execution

An issue was discovered in ASUSTOR exFAT Driver through 1.0.0.r20. When conducting license validation, exfat.cgi and exfatctl fail to properly validate server responses and pass unsanitized text to the system shell, resulting in code execution as root...

Plantronics Hub 3.13.2 Local Privilege Escalation

Exploit Title: Plantronics Hub 3.13.2 - Local Privilege Escalation Date: 2020-01-2 Exploit Author: Markus Krell - @MarkusKrell Vendor Homepage: https://support.polycom.com/content/dam/polycom-support/global/documentation/plantronics-hub-local-privilege-escalation-vulnerability.pdf Software Link:...

Plantronics Hub 3.13.2 - Local Privilege Escalation

Plantronics Hub 3.13.2 - Local Privilege Escalation Exploit Title: Plantronics Hub 3.13.2 - Local Privilege Escalation Date: 2020-01-2 Exploit Author: Markus Krell - @MarkusKrell Vendor Homepage:...

Plantronics Hub 3.13.2 - Local Privilege Escalation

Exploit Title: Plantronics Hub 3.13.2 - Local Privilege Escalation Date: 2020-01-2 Exploit Author: Markus Krell - @MarkusKrell Vendor Homepage: https://support.polycom.com/content/dam/polycom-support/global/documentation/plantronics-hub-local-privilege-escalation-vulnerability.pdf Software Link:...

Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability

ManageEngine ADSelfService Plus is a web-based self-service application that enables end-users to perform tasks such as password reset, account unlock, profile information update, etc. without relying on a help desk. An authentication bypass vulnerability exists in the password reset feature of...

CVE-2019-12476

An authentication bypass vulnerability in the password reset functionality in Zoho ManageEngine ADSelfService Plus before 5.0.6 allows an attacker with physical access to gain a shell with SYSTEM privileges via the restricted thick client browser. The attack uses a long sequence of crafted keyboa...

CVE-2019-1836: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability in the system shell for Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructure ACI mode could allow an authenticated, local attacker to use symbolic links to overwrite system files. These system files may be sensitive and should not be overwritable by non-ro...

PT-2019-2065

Name of the Vulnerable Software and Affected Versions Cisco Nexus 9000 Series Fabric Switches in Application Centric Infrastructure ACI mode versions prior to 14.11i Description A vulnerability exists in the system shell due to incorrect symbolic link verification of directory paths, allowing an...

Security Bulletin: IBM QRadar SIEM is vulnerable to OS Command Injection (CVE-2018-1571) (Updated 9/12/2018)

Summary User-supplied data may be passed to a system shell. Attackers could execute arbitrary commands on the system. Vulnerability Details CVEID: CVE-2018-1571 Description: IBM QRadar could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a...

Security Bulletin:IBM QRadar SIEM is vulnerable to command injection. (CVE-2017-1696)

Summary The product passes unsafe user supplied data forms, cookies, HTTP headers etc. to a system shell. This allows attackers to execute arbitrary commands on the system. Vulnerability Details CVEID: CVE-2017-1696 DESCRIPTION: IBM QRadar could allow a remote authenticated attacker to execute...