2654 matches found
Command injection
FusionSphere V100R006C00SPC102NFV has a command injection vulnerability. An authenticated, remote attacker could craft packets with malicious strings and send them to a target device. Successful exploit could allow the attacker to launch a command injection attack and execute system commands...
CVE-2017-8197
FusionSphere V100R006C00SPC102NFV has a command injection vulnerability. An authenticated, remote attacker could craft packets with malicious strings and send them to a target device. Successful exploit could allow the attacker to launch a command injection attack and execute system commands...
The software for message communication, IBM MQ Appliance, is vulnerable due to the lack of measures taken to neutralize specific commands of the operating system. This vulnerability allows attackers to execute arbitrary commands.
The software for message communication in IBM MQ Appliance is vulnerable because measures are not taken to eliminate the special elements used in the operating system commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...
Circle with Disney Command Injection Vulnerability
Circle with Disney is a set of network monitoring and management devices for monitoring children's online behavior from Circle Media, Inc. in the United States. A command injection vulnerability exists in the notification feature in Circle with Disney version 2.0.1. The vulnerability can be...
MVPower DVR Remote Command Execution
The remote AOST-based network video recorder distributed by MVPower is affected by a remote command execution vulnerability. An unauthenticated remote attacker can use this vulnerability to execute operating system commands as root. This vulnerability has been used by the IoT Reaper botnet. C...
CVE-2017-12796
The Reporting Compatibility Add On before 2.0.4 for OpenMRS, as distributed in OpenMRS Reference Application before 2.6.1, does not authenticate users when deserializing XML input into ReportSchema objects. The result is that remote unauthenticated users are able to execute operating system...
CVE-2017-12796
The Reporting Compatibility Add On before 2.0.4 for OpenMRS, as distributed in OpenMRS Reference Application before 2.6.1, does not authenticate users when deserializing XML input into ReportSchema objects. The result is that remote unauthenticated users are able to execute operating system...
Cross site request forgery (csrf)
The Reporting Compatibility Add On before 2.0.4 for OpenMRS, as distributed in OpenMRS Reference Application before 2.6.1, does not authenticate users when deserializing XML input into ReportSchema objects. The result is that remote unauthenticated users are able to execute operating system...
CVE-2017-12796
The Reporting Compatibility Add On before 2.0.4 for OpenMRS, as distributed in OpenMRS Reference Application before 2.6.1, does not authenticate users when deserializing XML input into ReportSchema objects. The result is that remote unauthenticated users are able to execute operating system...
OpenMRS Remote Command Execution Vulnerability
OpenMRS Reference Application is a suite of open source EHR applications.Reporting Compatibility Add On is one of the compatibility reporting components. A remote command execution vulnerability exists in OpenMRS, which is caused by the application failing to authenticate the user when...
Critical Code Execution Flaw Patched in PeopleSoft Core Engine
Organizations that have their PeopleSoft installations exposed to the internet should pay special attention to a remote code execution vulnerability patched on Tuesday as part of Oracle’s massive quarterly Critical Patch Update. The flaw, CVE-2017-10366, allows an attacker to gain remote code...
HPE System Management Homepage Arbitrary Command Execution Vulnerability
HPE System Management Homepage is a Web-based interface from Hewlett Packard Enterprise. An arbitrary command execution vulnerability exists in HPE System Management Homepage, which allows an attacker to submit a special request to execute arbitrary OS commands in an application context...
Cobian Backup 11 client operating system command injection vulnerability
Cobian Backup 11 client is a client for file backup applications developed by Swedish software developer Luis Cobian. The program supports several compression and strong decryption methods and allows you to backup files from their original directory to another directory on the same computer or on...
CVE-2017-10700
In the medialibrary component in QNAP NAS 4.3.3.0229, an un-authenticated, remote attacker can execute arbitrary system commands as the root user of the NAS application...
The vulnerability of the mnt_ping.cgi service in the microprogramming software of the Technicolor TD5336 router allows a hacker to execute arbitrary operating system commands with superuser privileges.
The vulnerability of the mntping.cgi service in the microprogramming software of the Technicolor TD5336 router exists due to the failure to take measures to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a malicious actor to execute arbitra...
Default configuration
Apache Brooklyn uses the SnakeYAML library for parsing YAML inputs. SnakeYAML allows the use of YAML tags to indicate that SnakeYAML should unmarshal data to a Java type. In the default configuration in Brooklyn before 0.10.0, SnakeYAML will allow unmarshalling to any Java type available on the...
Corega CG-WLR300NM OS Command Execution Vulnerability
The Corega CG-WLR300NM is a wireless router from Corega Japan. A security vulnerability exists in the Corega CG-WLR300NM using firmware version 1.90 and earlier. An attacker can exploit the vulnerability to execute arbitrary operating system commands...
Ubuntu 14.04 LTS / 16.04 LTS : TeX Live vulnerability (USN-3401-1)
The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3401-1 advisory. It was discovered that TeX Live incorrectly handled certain system commands. If a user were tricked into processing a specially crafted TeX file, a...
USN-3401-1: TeX Live vulnerability
It was discovered that TeX Live incorrectly handled certain system commands. If a user were tricked into processing a specially crafted TeX file, a remote attacker could execute arbitrary code...