Input validation

Ubuntu14.04 ORCA Online Receipt Computer Advantage 4.8.0 panda-server 1:1.4.9+p41-u4jma1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via unspecified vectors...

PT-2018-8982

Name of the Vulnerable Software and Affected Versions ORCA versions 4.8.0 and earlier panda-server version 1:1.4.9+p41-u4jma1 and earlier Description The issue allows an attacker with administrator rights to execute arbitrary OS commands. The exact vectors used for this are not specified...

PT-2018-9001

Name of the Vulnerable Software and Affected Versions I-O DATA network camera products TS-WRLP versions 1.09.04 and earlier I-O DATA network camera products TS-WRLA versions 1.09.04 and earlier I-O DATA network camera products TS-WRLP/E versions 1.09.04 and earlier Description The issue concerns...

CVE-2018-0643: Improper Neutralization of Special Elements used in an OS Command

Ubuntu14.04 ORCA Online Receipt Computer Advantage 4.8.0 panda-server 1:1.4.9+p41-u4jma1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via unspecified vectors...

CVE-2018-15887

MainAnalysisContent.asp in ASUS DSL-N12EC1 1.1.2.3345 is prone to Authenticated Remote Command Execution, which allows a remote attacker to execute arbitrary OS commands via service parameters, such as shell metacharacters in the destIP parameter of a cmdMethod=ping request...

Node.js third-party modules: Command Injection is ps Package

I would like to report a command injection in ps package. It allows attacker to inject arbitrary OS commands instead of PID numbers. Module module name: ps version: 0.0.2 npm page: https://www.npmjs.com/package/ps Module Description A Node.js module for looking up running processes. Module Stats ...

Command injection

An OS command injection vulnerability in the web administration component of Micro Focus Secure Messaging Gateway SMG allows a remote attacker authenticated as a privileged user to execute arbitrary OS commands on the SMG server. This can be exploited in conjunction with CVE-2018-12464 to achieve...

CVE-2018-4859

A vulnerability has been identified in SCALANCE M875 All versions. An authenticated remote attacker with access to the web interface 443/tcp, could execute arbitrary operating system commands. Successful exploitation requires that the attacker has network access to the web interface. The attacker...

CVE-2018-4859

CVE-2018-4859 affects SIEMENS SCALANCE M875 devices. A vulnerability allows an authenticated remote attacker with access to the web interface (443/tcp) to execute arbitrary operating system commands. Successful exploitation requires network access to the web interface and administrative credentia...

CVE-2018-0569

baserCMS baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions allows remote authenticated attackers to execute arbitrary OS commands via unspecified vectors...

PT-2018-8927

Name of the Vulnerable Software and Affected Versions baserCMS versions 4.1.0.1 and earlier baserCMS versions 3.0.15 and earlier Description The issue allows remote authenticated attackers to execute arbitrary OS commands. Recommendations For versions 4.1.0.1 and earlier, update to a version late...

Nikto 2.1.6 CSV Injection

Exploit Title: Nikto 2.1.6 - CSV Injection Google Dork: N/A Date: 2018-06-01 Exploit Author: Adam Greenhill Vendor Homepage: https://cirt.net/Nikto2 Software Link: https://github.com/sullo/nikto Affected Version: 2.1.6, 2.1.5 Category: Applications Tested on: Kali Linux 4.14 x64 CVE :...

CVE-2017-3936

OS Command Injection vulnerability in McAfee ePolicy Orchestrator ePO 5.9.0, 5.3.2, 5.3.1, 5.1.3, 5.1.2, 5.1.1, and 5.1.0 allows attackers to run arbitrary OS commands with limited privileges via not sanitizing the user input data before exporting it into a CSV format output...

Design/Logic Flaw

QNAP NAS application Proxy Server through version 1.2.0 allows remote attackers to run arbitrary OS commands against the system with root privileges...

HPE iMC 7.3 - Remote Code Execution (Metasploit)

Exploit Title: HPE iMC EL Injection Unauthenticated RCE Date: 6 February, 2018 Exploit Author: TrendyTofu Vendor Homepage: https://www.hpe.com/us/en/home.html Software Link: http://h10145.www1.hpe.com/Downloads/SoftwareReleases.aspx?ProductNumber=JG747AAE&lang=en&cc=us&prodSeriesId=4176535 Versio...

CVE-2018-0545

LXR version 1.0.0 to 2.3.0 allows remote attackers to execute arbitrary OS commands via unspecified vectors...

CVE-2018-0545

CVE-2018-0545 concerns LXR, version 1.0.0 through 2.3.0. The connected sources confirm a remote OS command injection vulnerability (CWE-78) that could allow an attacker to execute arbitrary commands on a server running the affected LXR releases. The vulnerability arises in LXR’s handling of input...

PT-2018-8903

Name of the Vulnerable Software and Affected Versions LXR versions 1.0.0 through 2.3.0 Description The issue allows remote attackers to execute arbitrary OS commands. Recommendations For versions 1.0.0 through 2.3.0, at the moment, there is no information about a newer version that contains a fix...

CVE-2018-0556: Improper Neutralization of Special Elements used in an OS Command

Buffalo WZR-1750DHP2 Ver.2.30 and earlier allows an attacker to execute arbitrary OS commands via unspecified vectors...

CVE-2018-0523: Improper Neutralization of Special Elements used in an OS Command

Buffalo WXR-1900DHP2 firmware Ver.2.48 and earlier allows an attacker to execute arbitrary OS commands via unspecified vectors...