Aerospike Database UDF Lua Code Execution

Aerospike Database versions before 5.1.0.3 permitted user-defined functions UDF to call the os.execute Lua function. This module creates a UDF utilising this function to execute arbitrary operating system commands with the privileges of the user running the Aerospike service. This module does not...

CVE-2020-26838

SAP Business Warehouse, versions - 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 782, and SAP BW4HANA, versions - 100, 200 allows an attacker authenticated with high developer privileges to submit a crafted request to generate and execute code without requiring any user interaction. It i...

CVE-2020-26838

SAP Business Warehouse, versions - 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 782, and SAP BW4HANA, versions - 100, 200 allows an attacker authenticated with high developer privileges to submit a crafted request to generate and execute code without requiring any user interaction. It i...

TotoLink A3002RU 命令注入漏洞

Totolink TOTOLINK A3002RU is a wireless router product from Totolink Taiwan, China. A command injection vulnerability exists in the TOTOLINK A3002RU-V2.0.0 B20190814.1034, which could allow a remote, authenticated user to modify the system's "run command". An attacker can use this vulnerability t...

PT-2020-16101

Name of the Vulnerable Software and Affected Versions TOTOLINK A3002RU version 2.0.0 B20190814.1034 Description The issue allows authenticated remote users to modify the system's 'Run Command'. An attacker can use this functionality to execute arbitrary OS commands on the router. Recommendations...

The vulnerability in the subscription subsystem of Cisco AsyncOS allows a hacker to increase their privileges.

The vulnerability of the subscription subsystem for Cisco AsyncOS relates to the lack of measures to neutralize special elements used in the operating system command. Exploiting this vulnerability can allow attackers to enhance their privileges...

Command injection

Zeroshell 3.9.3 contains a command injection vulnerability in the /cgi-bin/kerbynet StartSessionSubmit parameter that could allow an unauthenticated attacker to execute a system command by using shell metacharacters and the %0a character...

Command Execution Vulnerability in Ocean CMS (CNVD-2020-69485)

Ocean CMS seacms, Ocean Video Management System is a video-on-demand system designed for webmasters with different needs. A command execution vulnerability exists in the background of Ocean CMS. Attackers can use this vulnerability to write malicious code to execute system commands and obtain...

CVE-2020-11830

QualityProtect has a vulnerability to execute arbitrary system commands, affected product is com.oppo.qualityprotect V2.0...

Design/Logic Flaw

QualityProtect has a vulnerability to execute arbitrary system commands, affected product is com.oppo.qualityprotect V2.0...

TP-Link TL-WPA4220 Arbitrary OS Command Execution Vulnerability

The TP-Link TL-WPA4220 is a 300Mbps AV600 Wi-Fi powerline extender. An arbitrary OS command execution vulnerability exists in httpd in the TP-Link TL-WPA4220. A remote authenticated user can exploit this vulnerability to execute arbitrary OS commands by sending a specially crafted POST request to...

Trend Micro InterScan Web Security Virtual Appliance Command Injection Vulnerability

Trend Micro InterScan Web Security Virtual Appliance IWSVA is a Web security gateway from Trend Micro that provides dynamic, integrated security protection for enterprise networks against Web-based threats. A command injection vulnerability exists in AddVLANItem in Trend Micro InterScan Web...

The vulnerability in the web interface of the Cisco Integrated Management Controller, a remote management device for servers, allows a perpetrator to execute arbitrary commands on the operating system.

The vulnerability of the Cisco Integrated Management Controller’s remote management web interface exists due to the lack of measures taken to neutralize the special elements used in the operating system command set. Exploiting this vulnerability allows a malicious actor to execute arbitrary...

CVE-2020-27555

Use of default credentials for the telnet server in BASETech GE-131 BT-1837836 firmware 20180921 allows remote attackers to execute arbitrary system commands as the root user...

Default credentials

Use of default credentials for the telnet server in BASETech GE-131 BT-1837836 firmware 20180921 allows remote attackers to execute arbitrary system commands as the root user...

SAP NetWeaver AS JAVA Command Execution Vulnerability (CNVD-2020-62998)

SAP Netweaver is the German SAP SAP company's set of service-oriented integrated application platform. The platform provides a development and runtime environment for SAP applications. A security vulnerability exists in SAP NetWeaver AS JAVA version 7.20, 7.30, 7.31, 7.40, and 7.50 that allows an...

Arbitrary Code Execution

spamassassin is vulnerable to arbitrary code execution. An attacker can send malicious configuration files to run system commands without any output or errors...

F5 BIG-IP Cross-Site Scripting Vulnerability (CNVD-2020-63628)

F5 BIG-IP is an application delivery platform from F5 USA that integrates network traffic management, application security management, load balancing and other functions. A cross-site scripting vulnerability exists in F5 TMUI, which originates from an undisclosed TMUI page, and can be exploited b...

vim: users can execute arbitrary OS commands via scripting interfaces in the rvim restricted mode

A flaw was found in vim in the restricted mode, where all commands that make use of external shells are disabled. However, it was found that users could still execute some arbitrary OS commands in the restricted mode. This flaw was fixed by filtering the functions that can call OS commands...

spamassassin: crafted configuration files can run system commands without any output or errors

In Apache SpamAssassin before 3.4.3, nefarious CF files can be configured to run system commands without any output or errors. With this, exploits can be injected in a number of scenarios. In addition to upgrading to SA 3.4.3, we recommend that users should only use update channels or 3rd party ....