PT-2019-8682

Name of the Vulnerable Software and Affected Versions Aterm HC100RC version 1.0.1 and earlier Description The issue allows an attacker with administrator rights to execute arbitrary OS commands. This can be achieved via the FactoryPassword parameter or bootmode parameter of a certain URL...

PT-2019-9261

Name of the Vulnerable Software and Affected Versions Aterm WF1200CR versions 1.1.1 and earlier Aterm WG1200CR versions 1.0.1 and earlier Description The issue allows an attacker on the same network segment to execute arbitrary OS commands via the SOAP interface of UPnP. Recommendations For Aterm...

PT-2019-9266

Name of the Vulnerable Software and Affected Versions Toshiba Home gateway HEM-GW16A versions 1.2.9 and earlier Toshiba Home gateway HEM-GW26A versions 1.2.9 and earlier Description The issue allows an attacker on the same network segment to login to the administrator's settings screen and change...

PT-2019-8674

Name of the Vulnerable Software and Affected Versions Aterm WG1200HP firmware version 1.0.31 and earlier Description The issue allows an attacker with administrator rights to execute arbitrary OS commands. This can be achieved via the sysCmd in the formWsc parameter. Recommendations For Aterm...

PT-2019-8675

Name of the Vulnerable Software and Affected Versions Aterm WG1200HP firmware version 1.0.31 and earlier Description The issue allows an attacker with administrator rights to execute arbitrary OS commands via the targetAPSsid parameter. Recommendations For Aterm WG1200HP firmware version 1.0.31 a...

PT-2019-9265

Name of the Vulnerable Software and Affected Versions Toshiba Home gateway HEM-GW16A versions 1.2.9 and earlier Toshiba Home gateway HEM-GW26A versions 1.2.9 and earlier Description The issue allows an attacker on the same network segment to execute arbitrary OS commands. Recommendations For...

PT-2019-8679

Name of the Vulnerable Software and Affected Versions Aterm W300P versions 1.0.13 and earlier Description The issue allows an attacker with administrator rights to execute arbitrary OS commands. This can be achieved via the targetAPSsid parameter. Recommendations For Aterm W300P versions 1.0.13 a...

PT-2019-8698

Name of the Vulnerable Software and Affected Versions BN-SDWBP3 firmware versions 1.0.9 and earlier Description The issue allows an attacker with administrator rights on the same network segment to execute arbitrary OS commands. The exact vectors used for this exploitation are not specified...

CVE-2018-0630: Improper Neutralization of Special Elements used in an OS Command

Aterm W300P Ver1.0.13 and earlier allows attacker with administrator rights to execute arbitrary OS commands via sysCmd parameter...

CVE-2018-16201: Use of Hard-coded Credentials

Toshiba Home gateway HEM-GW16A 1.2.9 and earlier, Toshiba Home gateway HEM-GW26A 1.2.9 and earlier uses hard-coded credentials, which may allow an attacker on the same network segment to login to the administrators settings screen and change the configuration or execute arbitrary OS commands...

CVE-2018-0635: Improper Neutralization of Special Elements used in an OS Command

Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via filename parameter...

PT-2019-8673

Name of the Vulnerable Software and Affected Versions Aterm WG1200HP firmware version 1.0.31 and earlier Description The issue allows an attacker with administrator rights to execute arbitrary OS commands. This is achieved via the formSysCmd parameter. Recommendations For Aterm WG1200HP firmware...

PT-2018-14513

Name of the Vulnerable Software and Affected Versions VyOS version 1.1.8 Description A sandbox escape issue was discovered, allowing an authenticated operator user to break out of the restricted management shell by issuing certain shell special characters with commands. This enables the user to...

Sql injection

An issue was discovered in /bin/boa on D-Link DIR-619L Rev.B 2.06B1 and DIR-605L Rev.B 2.12B1 devices. goform/formSysCmd allows remote authenticated users to execute arbitrary OS commands via the sysCmd POST parameter...

CVE-2018-20057

An issue was discovered in /bin/boa on D-Link DIR-619L Rev.B 2.06B1 and DIR-605L Rev.B 2.12B1 devices. goform/formSysCmd allows remote authenticated users to execute arbitrary OS commands via the sysCmd POST parameter...

CVE-2018-20057

An issue was discovered in /bin/boa on D-Link DIR-619L Rev.B 2.06B1 and DIR-605L Rev.B 2.12B1 devices. goform/formSysCmd allows remote authenticated users to execute arbitrary OS commands via the sysCmd POST parameter. Recent assessments: Assessed Attacker Value: 0 Assessed Attacker Value:...

Remote Code Execution (RCE)

yoast/wordpress-seo is vulnerable to remote code execution. An SEO Manager is able to execute arbitrary OS commands via a ZIP import through a race condition vulnerability in unzipfile in admin/import/class-import-settings.php...

CVE-2018-19646: Improper Neutralization of Special Elements used in an OS Command

The Python CGI scripts in PWS in Imperva SecureSphere 13.0.10, 13.1.10, and 13.2.10 allow remote attackers to execute arbitrary OS commands because command-line arguments are mishandled...

Input validation

University of Washington IMAP Toolkit 2007f on UNIX, as used in imapopen in PHP and other products, launches an rsh command by means of the imaprimap function in c-client/imap4r1.c and the tcpaopen function in osdep/unix/tcpunix.c without preventing argument injection, which might allow remote...

CVE-2018-19518

University of Washington IMAP Toolkit 2007f on UNIX, as used in imapopen in PHP and other products, launches an rsh command by means of the imaprimap function in c-client/imap4r1.c and the tcpaopen function in osdep/unix/tcpunix.c without preventing argument injection, which might allow remote...