CVE-2020-24640: Undefined Security Weakness

There is a vulnerability caused by insufficient input validation that allows for arbitrary command execution in a containerized environment within Airwave Glass before 1.3.3. Successful exploitation can lead to complete compromise of the underlying host operating system...

Binary Vulnerability in Cisco RV110W

The Cisco RV110W is a wireless router. A binary vulnerability exists in the Cisco RV110W. An attacker can exploit the vulnerability to directly execute arbitrary system commands as root...

CVE-2021-1148: Improper Input Validation

Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated, remote attacker to inject arbitrary commands that are executed with root privileges. The vulnerabilities are due to improper validation of...

Arbitrary Command Execution

ts-process-promises is vulnerable to arbitrary command execution. The usage of exec function allows an attacker to execute arbitrary commands on the host OS...

PT-2021-11107

Name of the Vulnerable Software and Affected Versions: QTS versions prior to 4.5.1.1456 build 20201015 QuTS hero versions prior to h4.5.1.1472 build 20201031 Description: A command injection issue has been reported, allowing attackers to execute arbitrary commands in a compromised application...

Qnap Systems QNAP QTS and QNAP Systems QUTS Hero Command Injection Vulnerabilities

Qnap Systems QNAP QTS is a data storage device with SAN-like storage architecture from Qnap Systems, China. The device supports tiered storage, mirror protection, and other safeguard features.QNAP Systems QUTS Hero is a NAS operating system for file management from QNAP Systems, China. The system...

CVE-2020-2508: Improper Neutralization of Special Elements used in a Command

A command injection vulnerability has been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrary commands in a compromised application. QNAP have already fixed this vulnerability in the following versions: QTS 4.5.1.1456 build 20201015 and...

Important: net-snmp

Issue Overview: A flaw was found in Net-SNMP through version 5.73, where an Improper Privilege Management issue occurs due to SNMP WRITE access to the EXTEND MIB allows running arbitrary commands as root. The highest threat from this vulnerability is to confidentiality, integrity, as well as syst...

JVN#38784555: Multiple vulnerabilities in UNIVERGE SV9500/SV8500 series

Remote system maintenance feature of UNIVERGE SV9500/SV8500 series' Web based remote maintenance console contains multiple vulnerabilities listed below. OS Command Injection CWE-78 - CVE-2020-5685 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H| Base Score...

CVE-2020-35851

HGiga MailSherlock does not validate specific parameters properly. Attackers can use the vulnerability to launch Command inject attacks remotely and execute arbitrary commands of the system...

Zoom Meeting Connector Post-Auth Remote Root

!/usr/bin/python -- coding: UTF-8 -- zoomer.py Zoom Meeting Connector Post-auth Remote Root Exploit Jeremy Brown jbrown3264/gmail Dec 2020 The Meeting Connector Web Console listens on port 5480. On the dashboard under Network - Proxy, one can enable a proxy server. All of the fields are sanitized...

MailSherlock operating system command injection vulnerability

HGiga MailSherlock is an email archiving and auditing system that provides a complete email security solution. A command injection vulnerability exists in HGiga MailSherlock. The vulnerability stems from MailSherlock failing to properly validate specific parameters. An attacker can exploit this...

FasterXML jackson-databind suffers from a command execution vulnerability (CNVD-2021-01853)

FasterXML Jackson is a U.S. FasterXML company for Java data processing tools . jackson-databind is one of the components with data binding capabilities . A command execution vulnerability exists in FasterXML jackson-databind. An attacker can exploit this vulnerability to execute arbitrary command...

PT-2020-17488

Name of the Vulnerable Software and Affected Versions HGiga MailSherlock affected versions not specified Description The issue is related to improper validation of specific parameters, allowing attackers to launch command inject attacks remotely and execute arbitrary commands on the system. This...

Qnap Systems QNAP QTS and QNAP Systems QUTS Hero Command Injection Vulnerabilities

Qnap Systems QNAP QTS is a data storage device with SAN-like storage architecture from Qnap Systems, China. The device supports tiered storage, mirror protection, and other safeguard features.QNAP Systems QUTS Hero is a NAS operating system for file management from QNAP Systems, China. The system...

CVE-2020-25847: Improper Neutralization of Special Elements used in a Command

This command injection vulnerability allows attackers to execute arbitrary commands in a compromised application. QNAP have already fixed this vulnerability in the following versions of QTS and QuTS hero...

Command execution vulnerability exists in FasterXML jackson-databind (CNVD-2021-00629)

FasterXML Jackson is a U.S. FasterXML company for Java data processing tools . jackson-databind is one of the components with data binding capabilities . A command execution vulnerability exists in FasterXML jackson-databind, which can be exploited by an attacker to execute arbitrary commands...

Webmin 1.962 - 'Package Updates' Escape Bypass RCE (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Webmin 1.962 - Package Update Escape Bypass RCE Metasploit', 'Description' = %q This module exploits an arbitrary command execution vulnerability...

Rake FileList Command Execution

The vulnerability of the Rake::FileList class implementation in the Rake tool for automating the compilation of software code is related to the lack of measures taken to eliminate special elements used in operating system commands. Exploiting this vulnerability allows an attacker to execute...

Webmin Arbitrary Command Execution Vulnerability (CNVD-2021-07125)

Webmin is a Web-based system configuration tool for Unix-like systems, and the latest version can also be installed and run on Windows. An arbitrary command execution vulnerability exists in Webmin 1.962 and earlier versions. An attacker can exploit this vulnerability to execute arbitrary command...