F5 iControl REST Remote Command Execution Vulnerability

F5 BIG-IP is F5's application delivery platform that integrates network traffic scheduling, load balancing, intelligent DNS, remote access policy management, etc. F5 BIG-IQ Centralized Management is F5's management and scheduling platform that centrally manages and controls the F5 BIG-IP physical...

UBUNTU-CVE-2020-13936

An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify velocity templates running Apache...

Default credentials

An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify velocity templates running Apache...

CVE-2020-13936

An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify velocity templates running Apache...

NewStart CGSL MAIN 6.02 : spamassassin Multiple Vulnerabilities (NS-SA-2021-0070)

The remote NewStart CGSL host, running version MAIN 6.02, has spamassassin packages installed that are affected by multiple vulnerabilities: - In Apache SpamAssassin before 3.4.3, a message can be crafted in a way to use excessive resources. Upgrading to SA 3.4.3 as soon as possible is the...

Remote Code Execution

velocity-engine-core is vulnerable to remote code execution. The Uberspector fails to prevent access to java.lang.ClassLoader methods and allows an attacker that is able to modify Template contents to execute arbitrary Java code or run arbitrary system commands with the same privileges as the...

The vulnerability of the microprogrammed network interface cards of SONICWALL series SMA 100 lies in the lack of measures taken to neutralize the special elements used in the operating system’s commands. This allows attackers to execute arbitrary commands.

The vulnerability of the microprogrammed network interface cards SONICWALL of the SMA 100 series exists due to the lack of measures taken to neutralize the special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

CVE-2020-12873

An issue was discovered in Alfresco Enterprise Content Management ECM before 6.2.1. A user with privileges to edit a FreeMarker template e.g., a webscript may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running Alfresco...

Design/Logic Flaw

An issue was discovered in Alfresco Enterprise Content Management ECM before 6.2.1. A user with privileges to edit a FreeMarker template e.g., a webscript may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running Alfresco...

CVE-2021-3210

components/Modals/HelpTexts/GenericAll/GenericAll.jsx in Bloodhound = 4.0.1 allows remote attackers to execute arbitrary system commands when the victim imports a malicious data file containing JavaScript in the objectId parameter...

Design/Logic Flaw

components/Modals/HelpTexts/GenericAll/GenericAll.jsx in Bloodhound = 4.0.1 allows remote attackers to execute arbitrary system commands when the victim imports a malicious data file containing JavaScript in the objectId parameter...

CVE-2021-3210

components/Modals/HelpTexts/GenericAll/GenericAll.jsx in Bloodhound = 4.0.1 allows remote attackers to execute arbitrary system commands when the victim imports a malicious data file containing JavaScript in the objectId parameter...

Alfresco Software Alfresco Enterprise and Alfresco Injection Vulnerabilities

Alfresco Software Alfresco Enterprise is the enterprise version of an enterprise content management system from Alfresco Software. The system includes document management, office collaboration, etc. Alfresco is an open source enterprise content management system. The platform page using Freemarke...

PT-2021-9474 · Alfresco · Alfresco Enterprise Content Management

Name of the Vulnerable Software and Affected Versions: Alfresco Enterprise Content Management ECM versions prior to 6.2.1 Description: An issue was discovered that allows a user with privileges to edit a FreeMarker template to execute arbitrary Java code or run arbitrary system commands with the...

Systeminformation Operating System Command Injection Vulnerability

An operating system command injection vulnerability exists in Systeminformation, which arises when a network system or product fails to properly filter special characters, commands, etc., during the construction of executable operating system commands from externally input data. An attacker could...

MGASA-2021-0074 Updated phppgadmin package fixes a security vulnerability

phppgadmin through 7.12.1 allows sensitive actions to be performed without validating that the request originated from the application. One such area, database.php does not verify the source of an HTTP request. This can be leveraged by a remote attacker to trick a logged-in administrator to visit...

Updated phppgadmin package fixes a security vulnerability

phppgadmin through 7.12.1 allows sensitive actions to be performed without validating that the request originated from the application. One such area, database.php does not verify the source of an HTTP request. This can be leveraged by a remote attacker to trick a logged-in administrator to visit...

Command Execution Vulnerability in SEACMS (CNVD-2021-15534)

SEACMS is a video-on-demand system designed for webmasters with different needs. SEACMS suffers from a command execution vulnerability, which can be exploited by attackers to inject malicious code, execute system commands, and gain system privileges...

DEBIAN-CVE-2021-21289

Mechanize is an open-source ruby library that makes automated web interaction easy. In Mechanize from version 2.0.0 and before version 2.7.7 there is a command injection vulnerability. Affected versions of mechanize allow for OS commands to be injected using several classes' methods which...

CVE-2021-25310

CVE-2021-25310 affects Belkin Linksys WRT160NL devices (firmware 1.0.04.002_US_20130619). The issue is a command-injection vulnerability in the admin web interface: remote authenticated attackers can inject shell commands via shell metacharacters in the ui_language POST parameter sent to apply.cg...