1270 matches found
Complete lack of CSRF protection in selenium can lead to OS command injection
selenium 3.141.59 and earlier has no CSRF protection for its HTTP endpoints. This allows attackers to perform the following actions: Restart the Selenium Grid hub. Delete or replace the plugin configuration. Start, stop, or restart Selenium configurations on specific nodes. Through carefully chos...
Cisco Firepower Threat Defense Software Shell Access Vulnerability
A vulnerability in the support tunnel feature of Cisco Firepower Threat Defense FTD Software could allow an authenticated, local attacker to access the shell of an affected device even though expert mode is disabled. The vulnerability is due to improper configuration of the support tunnel feature...
Fedora 30 : php (2020-96cb012029)
PHP version 7.3.17 16 Apr 2020 Core: - Fixed bug php79364 When copy empty array, next key is unspecified. cmb - Fixed bug php78210 Invalid pointer address. cmb, Nikita CURL: - Fixed bug php79199 curlcopyhandle memory leak. cmb Date: - Fixed bug php79396 DateTime hour incorrect during DST jump...
NETGEAR D3600, D6000 and XR500 OS Command Injection Vulnerability (CNVD-2020-27256)
NETGEAR XR500 and others are products of NETGEAR Corporation.NETGEAR XR500 is a wireless router.NETGEAR D3600 is a wireless modem.NETGEAR D6000 is a wireless modem.NETGEAR XR500 is a wireless router.NETGEAR XR500 is a wireless router.NETGEAR XR500 is a wireless router.NETGEAR XR500 is a wireless...
Sql injection
A remote SQL injection web vulnerability was discovered in the Enigma NMS 65.0.0 and prior web application that allows an attacker to execute SQL commands to expose and compromise the web server, expose database tables and values, and potentially execute system-based commands as the mysql user...
PHPKB Multi-Language 9 Authenticated Remote Code Execution Exploit
Exploit for php platform in category web applications Exploit Title: PHPKB Multi-Language 9 - Authenticated Remote Code Execution Exploit Author: Antonio Cannito Vendor Homepage: https://www.knowledgebase-script.com/ Software Link: https://www.knowledgebase-script.com/pricing.php Version:...
CVE-2019-15708
A system command injection vulnerability in the FortiAP-S/W2 6.2.1, 6.2.0, 6.0.5 and below, FortiAP 6.0.5 and below and FortiAP-U below 6.0.0 under CLI admin console may allow unauthorized administrators to run arbitrary system level commands via specially crafted ifconfig commands...
CVE-2019-15708
CVE-2019-15708 concerns a system command injection vulnerability in Fortinet FortiAP devices. Based on connected sources, affected products include FortiAP-S/W2 (versions 6.2.1, 6.2.0, 6.0.5 and below), FortiAP (6.0.5 and below), and FortiAP-U (below 6.0.0). The issue occurs in the CLI admin cons...
Command injection
An issue was discovered in Poly formerly Polycom HDX 3.1.13. A feature exists that allows the creation of a server / client certificate, or the upload of the user certificate, on the administrator's page. The value received from the user is the factor value of a shell script on the equipment. By...
CVE-2019-11355
An issue was discovered in Poly formerly Polycom HDX 3.1.13. A feature exists that allows the creation of a server / client certificate, or the upload of the user certificate, on the administrator's page. The value received from the user is the factor value of a shell script on the equipment. By...
CVE-2019-11355
Affected software: Polycom HDX 3.1.13. Vulnerability: command injection via a crafted CSR field on the administrator page, where the user-provided value is treated as a shell-script factor value; inserting characters (e.g., a single quote) can cause arbitrary system commands to be executed. Root ...
WAGO PFC200 OS Command Injection Vulnerability (CNVD-2020-19519)
The WAGO PFC200 is a programmable logic controller PLC from WAGO Germany. The WAGO PFC200 suffers from an operating system command injection vulnerability that can be exploited by an attacker to inject operating system commands into the value of the TimeoutPrepared parameter contained in the...
CVE-2019-5170
An exploitable command injection vulnerability exists in the iocheckd service ‘I/O-Check’ function of the WAGO PFC 200 Firmware version 03.02.0214. A specially crafted XML cache file written to a specific location on the device can be used to inject OS commands. An attacker can send a specially...
ALPINE-CVE-2020-9366
A buffer overflow was found in the way GNU Screen before 4.8.0 treated the special escape OSC 49. Specially crafted output, or a special program, could corrupt memory and crash Screen or possibly have unspecified other impact...
UBUNTU-CVE-2020-8130
There is an OS command injection vulnerability in Ruby Rake 12.3.3 in Rake::FileList when supplying a filename that begins with the pipe character |...
IXP EasyInstall Operating System Command Injection Vulnerability
IXP EasyInstall is used to download and install python a third-party library management tool, through this tool can be very easy to manage the third-party libraries in Python. An operating system command injection vulnerability exists in IXP EasyInstall version 6.2.13723. The vulnerability is...
CVE-2020-9020
Iteris Vantage Velocity Field Unit 2.3.1, 2.4.2, and 3.0 devices allow the injection of OS commands into cgi-bin/timeconfig.py via shell metacharacters in the NTP Server field...
FortiAP system command injection through ifconfig command
A system command injection vulnerability in the FortiAP CLI admin console may allow unauthorized administrators to run arbitrary system level commands via specially crafted ifconfig commands...
git-diff-apply OS Command Injection Vulnerability
git-diff-apply is a package for getting git diff files and applying them to local branches. An operating system command injection vulnerability exists in the index.js file in versions of git-diff-apply prior to 0.22.2. The vulnerability stems from a network system or product not properly filterin...
