PT-2019-15174

Centreon 19.04 allows attackers to execute arbitrary OS commands via the Command Line field of main.php?p=60807&type=4 aka the Configuration Commands Discovery screen. CVE-2019-17501 and CVE-2019-16405 are similar to one another and may be the same...

CVE-2019-17501: Improper Neutralization of Special Elements used in an OS Command

Centreon 19.04 allows attackers to execute arbitrary OS commands via the Command Line field of main.php?p=60807&type=4 aka the Configuration Commands Discovery screen. CVE-2019-17501 and CVE-2019-16405 are similar to one another and may be the same...

Design/Logic Flaw

D-Link DIR-846 devices with firmware 100A35 allow remote attackers to execute arbitrary OS commands as root by leveraging admin access and sending a /HNAP1/ request for SetWizardConfig with shell metacharacters to /squashfs-root/www/HNAP1/control/SetWizardConfig.php...

CVE-2019-17269

Intellian Remote Access 3.18 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the Ping Test field...

PT-2019-15052

Name of the Vulnerable Software and Affected Versions Intellian Remote Access version 3.18 Description The issue allows remote attackers to execute arbitrary OS commands via shell metacharacters in the Ping Test field. Recommendations For Intellian Remote Access version 3.18, consider restricting...

Design/Logic Flaw

The Create Discoveries feature of Open-AudIT before 3.2.0 allows an authenticated attacker to execute arbitrary OS commands via a crafted value for a URL field...

NewStart CGSL MAIN 4.06 : vim Vulnerability (NS-SA-2019-0177)

The remote NewStart CGSL host, running version MAIN 4.06, has vim packages installed that are affected by a vulnerability: - getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via the :source! command in a modeline, as demonstrated by...

WordPress Plainview Activity Monitor Plugin Command Injection (CVE-2018-15877)

A command injection vulnerability exists in WordPress Plainview Activity Monitor plugin. Successful exploitation of this vulnerability would allow remote attackers to execute arbitrary OS commands in the affected system...

Remote Code Execution

nexus-yum-repository-plugin is vulnerable to remote code execution. An attacker with administrative access to nxrm is able to execute arbitrary OS commands on the system by setting the path of createrepo or mergerepo to an OS command in the XML input...

Supervene RazDC Reset Password CGI Command Injection (CVE-2018-15549)

A command injection vulnerability exists in Supervene RazDC. Successful exploitation of this vulnerability would allow remote attackers to execute arbitrary OS commands in the effected system...

PT-2019-5830

Name of the Vulnerable Software and Affected Versions D-Link DIR-846 version 100A35 Description The issue is related to insufficient argument checking in the SetMasterWLanSettings function of the D-Link DIR-846 firmware, allowing remote attackers to execute arbitrary OS commands as root. This can...

Citrix SD-WAN Center Command Injection (CVE-2019-10883)

A Command Injection vulnerability exists in Citrix SD-WAN Center. This vulnerability is due to insufficient validation of user-supplied data in one of the controllers. Successful exploitation of this vulnerability would allow remote attacker to execute arbitrary OS commands on the remote host...

CVE-2019-13598

LuaUPnP in Vera Edge Home Controller 1.7.4452 allows remote unauthenticated users to execute arbitrary OS commands via the code parameter to /port3480/datarequest because the "No unsafe lua allowed" code block is skipped...

CVE-2019-13598

CVE-2019-13598 affects Vera Edge Home Controller (version 1.7.4452) via LuaUPnP. A remote, unauthenticated attacker can trigger arbitrary OS commands by passing the code parameter to /port_3480/data_request, because the expected safety check for unsafe Lua code is skipped. This is a remote code e...

CVE-2019-13598

LuaUPnP in Vera Edge Home Controller 1.7.4452 allows remote unauthenticated users to execute arbitrary OS commands via the code parameter to /port3480/datarequest because the "No unsafe lua allowed" code block is skipped...

PT-2019-13443

Name of the Vulnerable Software and Affected Versions Vera Edge Home Controller version 1.7.4452 Description The issue allows remote unauthenticated users to execute arbitrary OS commands. This is achieved via the code parameter to the "/port 3480/data request" API endpoint, where the "No unsafe...

CVE-2018-16117

A shell escape vulnerability in /webconsole/Controller in Admin Portal of Sophos XG firewall 17.0.8 MR-8 allow remote authenticated attackers to execute arbitrary OS commands via shell metacharacters in the "dbName" POST parameter...

CVE-2018-15890

An issue was discovered in EthereumJ 1.8.2. There is Unsafe Deserialization in ois.readObject in mine/Ethash.java and decoder.readObject in crypto/ECKey.java. When a node syncs and mines a new block, arbitrary OS commands can be run on the server...

Design/Logic Flaw

A shell escape vulnerability in /webconsole/Controller in Admin Portal of Sophos XG firewall 17.0.8 MR-8 allow remote authenticated attackers to execute arbitrary OS commands via shell metacharacters in the "dbName" POST parameter...

PT-2019-9196

Name of the Vulnerable Software and Affected Versions EthereumJ version 1.8.2 Description An issue was discovered in EthereumJ where there is unsafe deserialization in ois.readObject in mine/Ethash.java and decoder.readObject in crypto/ECKey.java. This allows arbitrary OS commands to be run on th...