CVE-2021-3029

EVOLUCARE ECSIMAGING aka ECS Imaging through 6.21.5 has an OS Command Injection vulnerability via shell metacharacters and an IFS manipulation. The parameter "file" on the webpage /showfile.php can be exploited to gain root access. NOTE: This vulnerability only affects products that are no longer...

Command injection

UNSUPPORTED WHEN ASSIGNED EVOLUCARE ECSIMAGING aka ECS Imaging through 6.21.5 has an OS Command Injection vulnerability via shell metacharacters and an IFS manipulation. The parameter "file" on the webpage /showfile.php can be exploited to gain root access. NOTE: This vulnerability only affects...

CVE-2021-3029

EVOLUCARE ECSIMAGING (aka ECS Imaging)

CVE-2020-17363

USVN aka User-friendly SVN before 1.0.9 allows remote code execution via shell metacharacters in the numberstart or numberend parameter to LastHundredRequest aka lasthundredrequestAction in the Timeline module. NOTE: this may overlap CVE-2020-25069...

CVE-2020-19664

DrayTek Vigor2960 1.5.1 allows remote command execution via shell metacharacters in a toLogin2FA action to mainfunction.cgi...

Remote code execution

USVN aka User-friendly SVN before 1.0.9 allows remote code execution via shell metacharacters in the numberstart or numberend parameter to LastHundredRequest aka lasthundredrequestAction in the Timeline module. NOTE: this may overlap CVE-2020-25069...

Design/Logic Flaw

DrayTek Vigor2960 1.5.1 allows remote command execution via shell metacharacters in a toLogin2FA action to mainfunction.cgi...

CVE-2020-19664

DrayTek Vigor2960 1.5.1 allows remote command execution via shell metacharacters in a toLogin2FA action to mainfunction.cgi...

CVE-2020-19664

Conflict-free summary (CVE-2020-19664): Affects DrayTek Vigor2960 firmware, notably 1.5.1, where remote command execution is possible via shell metacharacters in a toLogin2FA action directed at mainfunction.cgi. Root cause: failure to neutralize shell metacharacters in the toLogin2FA path. Conseq...

CVE-2020-17363

USVN aka User-friendly SVN before 1.0.9 allows remote code execution via shell metacharacters in the numberstart or numberend parameter to LastHundredRequest aka lasthundredrequestAction in the Timeline module. NOTE: this may overlap CVE-2020-25069...

CVE-2020-17363

USVN (PHP web interface for Subversion) is affected by CVE-2020-17363. All versions before 1.0.9 are vulnerable to remote code execution via shell metacharacters in number_start/number_end of LastHundredRequest (Timeline module). Red Hat and CNVD entries corroborate impact up to 1.0.9/1.0.10; exp...

USVN Operating System Command Injection Vulnerability

USVN is a Php-based software for configuring Subversion by the USVN team. A security vulnerability exists in versions prior to USVN 1.0.9 that allows remote code execution via shell metacharacters in the start-of-number or end-of-number parameter to lastthunderdredrequest aka...

CVE-2020-35729

KLog Server 2.4.1 allows OS command injection via shell metacharacters in the actions/authenticate.php user parameter...

CVE-2020-35729

KLog Server 2.4.1 allows OS command injection via shell metacharacters in the actions/authenticate.php user parameter...

KLog Server OS Command Injection Vulnerability

KLog is ZhaoKaiQiang KLog individual developers of a logging tool for Android development . The tool's main functions are to print line numbers, function calls, Json parsing, XML parsing, click to jump, Log information saved and other functions. KLog Server 2.4.1 suffers from an OS command...

CVE-2020-35713

Belkin LINKSYS RE6500 devices before 1.0.012.001 allow remote attackers to execute arbitrary commands or set a new password via shell metacharacters to the goform/setSysAdm page...

CVE-2020-35713

Belkin LINKSYS RE6500 devices before 1.0.012.001 allow remote attackers to execute arbitrary commands or set a new password via shell metacharacters to the goform/setSysAdm page...

CVE-2020-35715

Belkin LINKSYS RE6500 devices before 1.0.012.001 allow remote authenticated users to execute arbitrary commands via shell metacharacters in a filename to the uploadsettings.cgi page...

CVE-2020-35715

Belkin LINKSYS RE6500 devices before 1.0.012.001 allow remote authenticated users to execute arbitrary commands via shell metacharacters in a filename to the uploadsettings.cgi page...

Code injection

Belkin LINKSYS RE6500 devices before 1.0.012.001 allow remote authenticated users to execute arbitrary commands via shell metacharacters in a filename to the uploadsettings.cgi page...