2908 matches found
CVE-2018-17565
Shell Metacharacter Injection in the SSH configuration interface on Grandstream GXP16xx VoIP 1.0.4.128 phones allows attackers to execute arbitrary system commands and gain a root shell...
CVE-2018-13284
Command injection vulnerability in ftpd in Synology Diskstation Manager DSM before 6.2-23739-1 allows remote authenticated users to execute arbitrary OS commands via the 1 MKD or 2 RMD command...
PT-2019-9506
Name of the Vulnerable Software and Affected Versions Grandstream GXP16xx VoIP version 1.0.4.128 Description The issue allows attackers to execute arbitrary system commands and gain a root shell due to Shell Metacharacter Injection in the SSH configuration interface. Recommendations For Grandstre...
CVE-2019-9193: Improper Neutralization of Special Elements used in an OS Command
In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pgexecuteserverprogram' group to execute arbitrary code in the context of the database's operating system user. This functionality is enabled by default and can be abused to run arbitrary...
CVE-2018-17565: Improper Neutralization of Special Elements used in an OS Command
Shell Metacharacter Injection in the SSH configuration interface on Grandstream GXP16xx VoIP 1.0.4.128 phones allows attackers to execute arbitrary system commands and gain a root shell...
CVE-2019-9193
PostgreSQL versions 9.3 through 11.2 are vulnerable to Remote Code Execution (RCE) via the COPY TO/FROM PROGRAM function. This functionality is enabled by default and allows superusers or users within the pg_execute_server_program group to execute arbitrary operating system commands on Windows, L...
CVE-2019-17621
The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated remote attacker to execute system commands as root, by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting to the local network. Recent...
Command injection
An exploitable command injection vulnerability exists in the DHCP daemon configuration of the CUJO Smart Firewall. When adding a new static DHCP address, its corresponding hostname is inserted into the dhcpd.conf file without prior sanitization, allowing for arbitrary execution of system commands...
CVE-2018-6444
A Vulnerability in Brocade Network Advisor versions before 14.1.0 could allow a remote unauthenticated attacker to execute arbitray code. The vulnerability could also be exploited to execute arbitrary OS Commands...
Remote Code Execution (RCE)
sandbox is vulnerable to remote code execution. An attacker is able to escape the sandbox using function and constructor calls, enabling process calls to execute arbitrary commands on the system...
Mailcleaner - (Authenticated) Remote Code Execution (Metasploit)
Mailcleaner - Authenticated Remote Code Execution Metasploit This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "Mailcleaner Remote Code Execution", 'Description' = %q This module exploits the...
Command Execution Vulnerability in NetShow Sino-British Enterprise Website System v5.6
WebShow Sino-British Enterprise Website System is a simple and easy-to-use website management system developed by WebTech. A command execution vulnerability exists in Nethub Sino-British Enterprise Website System v5.6, which can be exploited by attackers to execute system commands...
PT-2018-12873
Name of the Vulnerable Software and Affected Versions The Sky Elite 6.0L+ Android device with a build fingerprint of SKY/x6069 trx l601 sky/x6069 trx l601 sky:6.0/MRA58K/1482897127:user/release-keys com.fw.upgrade.sysoper version 2.3.8 Description The pre-installed platform app contains an export...
BSA-2018-744
Security Advisory ID : BSA-2018-744 Component : Webconsole Revision : 1.0: Initial A Vulnerability in Brocade Network Advisor Version before 14.1.0 could allow a remote unauthenticated attacker to execute arbitray code.The vulnerability could also be exploited to execute arbitrary OS Commands...
PT-2018-2755
Name of the Vulnerable Software and Affected Versions Dr.Web Enterprise Security Suite affected versions not specified Description The issue is related to a component of Dr.Web Enterprise Security Suite, specifically the Dr.Web Agent, which has a flaw in its digital signature verification mechani...
CVE-2018-10143
The Palo Alto Networks Expedition Migration tool 1.0.107 and earlier may allow an unauthenticated attacker with remote access to run system level commands on the device hosting this service/application...
Command injection
OS command injection in user.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands as root via the "secretkey" URL parameter...
CVE-2018-12317
OS command injection in group.cgi in ASUSTOR ADM version 3.1.1 allows attackers to execute system commands as root by modifying the "name" POST parameter...