CVE-2021-20708: Improper Neutralization of Special Elements used in an OS Command

NEC Aterm devices Aterm WF1200CR firmware Ver1.3.2 and earlier, Aterm WG1200CR firmware Ver1.3.3 and earlier, and Aterm WG2600HS firmware Ver1.5.1 and earlier allow authenticated attackers to execute arbitrary OS commands by sending a specially crafted request to a specific URL...

CVE-2021-20709: Improper Validation of Integrity Check Value

Improper validation of integrity check value vulnerability in NEC Aterm WF1200CR firmware Ver1.3.2 and earlier, Aterm WG1200CR firmware Ver1.3.3 and earlier, and Aterm WG2600HS firmware Ver1.5.1 and earlier allows an attacker with an administrative privilege to execute arbitrary OS commands by...

CVE-2021-27692

Command Injection in Tenda G1 and G3 routers with firmware versions v15.11.0.179502CN or v15.11.0.169024CN allows remote attackers to execute arbitrary OS commands via a crafted "action/umountUSBPartition" request. This occurs because the "formSetUSBPartitionUmount" function executes the...

Command injection

Command Injection in Tenda G1 and G3 routers with firmware versions v15.11.0.179502CN or v15.11.0.169024CN allows remote attackers to execute arbitrary OS commands via a crafted "action/umountUSBPartition" request. This occurs because the "formSetUSBPartitionUmount" function executes the...

Command injection

Command Injection in Tenda G0 routers with firmware versions v15.11.0.69039CN and v15.11.0.55876CN , and Tenda G1 and G3 routers with firmware versions v15.11.0.179502CN or v15.11.0.169024CN allows remote attackers to execute arbitrary OS commands via a crafted action/setDebugCfg request. This...

CVE-2021-27692

Command Injection in Tenda G1 and G3 routers with firmware versions v15.11.0.179502CN or v15.11.0.169024CN allows remote attackers to execute arbitrary OS commands via a crafted "action/umountUSBPartition" request. This occurs because the "formSetUSBPartitionUmount" function executes the...

PT-2021-17603

Name of the Vulnerable Software and Affected Versions: Tenda G0 routers versions v15.11.0.55876 CN through v15.11.0.69039 CN Tenda G1 and G3 routers versions v15.11.0.169024 CN through v15.11.0.179502 CN Description: The issue allows remote attackers to execute arbitrary OS commands via a crafted...

PT-2021-17604

Name of the Vulnerable Software and Affected Versions: Tenda G1 and G3 routers versions v15.11.0.179502 CN through v15.11.0.179502 CN Tenda G1 and G3 routers version v15.11.0.169024 CN Description: The issue allows remote attackers to execute arbitrary OS commands via a crafted...

CVE-2021-27710

Command Injection in TOTOLINK X5000R router with firmware v9.1.0u.6118B20201102, and TOTOLINK A720R router with firmware v4.1.5cu.470B20200911 allows remote attackers to execute arbitrary OS commands by sending a modified HTTP request. This occurs because the function executes glibc's system...

Command injection

Command Injection in TOTOLINK X5000R router with firmware v9.1.0u.6118B20201102, and TOTOLINK A720R router with firmware v4.1.5cu.470B20200911 allows remote attackers to execute arbitrary OS commands by sending a modified HTTP request. This occurs because the function executes glibc's system...

Command injection

Command Injection in TOTOLINK X5000R router with firmware v9.1.0u.6118B20201102, and TOTOLINK A720R router with firmware v4.1.5cu.470B20200911 allows remote attackers to execute arbitrary OS commands by sending a modified HTTP request. This occurs because the function executes glibc's system...

CVE-2021-27708

Command Injection in TOTOLINK X5000R router with firmware v9.1.0u.6118B20201102, and TOTOLINK A720R router with firmware v4.1.5cu.470B20200911 allows remote attackers to execute arbitrary OS commands by sending a modified HTTP request. This occurs because the function executes glibc's system...

PT-2021-17611

Name of the Vulnerable Software and Affected Versions: TOTOLINK X5000R version v9.1.0u.6118 B20201102 TOTOLINK A720R version v4.1.5cu.470 B20200911 Description: The issue allows remote attackers to execute arbitrary OS commands by sending a modified HTTP request. This occurs because a function...

CVE-2021-20682

baserCMS versions prior to 4.4.5 allows a remote attacker with an administrative privilege to execute arbitrary OS commands via unspecified vectors...

Design/Logic Flaw

baserCMS versions prior to 4.4.5 allows a remote attacker with an administrative privilege to execute arbitrary OS commands via unspecified vectors...

PT-2021-14141

Name of the Vulnerable Software and Affected Versions: baserCMS versions prior to 4.4.5 Description: The issue allows a remote attacker with administrative privileges to execute arbitrary OS commands. This can be achieved via unspecified vectors or the upload of malicious plugins. Recommendations...

PT-2021-9158

Name of the Vulnerable Software and Affected Versions Invigo Automatic Device Management ADM versions through 5.0 Description The issue allows remote authenticated attackers to execute arbitrary OS commands on the server as the user running the application. This is possible through the...

CVE-2020-10583: Improper Neutralization of Special Elements used in an OS Command

The /admin/admapi.php script of Invigo Automatic Device Management ADM through 5.0 allows remote authenticated attackers to execute arbitrary OS commands on the server as the user running the application...

CVE-2021-21386

APKLeaks is an open-source project for scanning APK file for URIs, endpoints & secrets. APKLeaks prior to v2.0.3 allows remote attackers to execute arbitrary OS commands via package name inside application manifest. An attacker could include arguments that allow unintended commands or code to be...

CVE-2021-21386 Improper Neutralization of Argument Delimiters in a Decompiling Package Process

APKLeaks is an open-source project for scanning APK file for URIs, endpoints & secrets. APKLeaks prior to v2.0.3 allows remote attackers to execute arbitrary OS commands via package name inside application manifest. An attacker could include arguments that allow unintended commands or code to be...