CVE-2017-17888

cgi-bin/write.cgi in Anti-Web through 3.8.7, as used on NetBiter / HMS, Ouman EH-net, Alliance System WS100 -- AWU 500, Sauter ERW100F001, Carlo Gavazzi SIU-DLG, AEDILIS SMART-1, SYXTHSENSE WebBiter, ABB SREA, and ASCON DY WebServer devices, allows remote authenticated users to execute arbitrary ...

PT-2017-15075

Name of the Vulnerable Software and Affected Versions Anti-Web through version 3.8.7 Description The issue allows remote authenticated users to execute arbitrary OS commands via crafted multipart/form-data content. This affects devices from various manufacturers, including NetBiter / HMS, Ouman...

CVE-2017-10904

Qt for Android prior to 5.9.0 allows remote attackers to execute arbitrary OS commands via unspecified vectors...

PT-2017-11596

Name of the Vulnerable Software and Affected Versions Qt for Android versions prior to 5.9.0 Description The issue allows remote attackers to execute arbitrary OS commands. Recommendations For Qt for Android versions prior to 5.9.0, update to version 5.9.0 or later to resolve the issue...

CVE-2017-16923

Command Injection vulnerability in appdatacenter on Shenzhen Tenda Ac9 USAC9V1.0BRV15.03.05.14multiTD01, Ac9 ac9kfV15.03.05.196318cn, Ac15 USAC15V1.0BRV15.03.05.18multiTD01, Ac15 USAC15V1.0BRV15.03.05.19multiTD01, Ac18 USAC18V1.0BRV15.03.05.05multiTD01, and Ac18 ac18kfV15.03.05.196318cn devices...

Mako Server 2.5 Command Injection

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Mako Server v2.5 OS Command Injection RCE', 'Description' = %q This module exploits a vulnerability found in Mako Server v2.5. It's possible to...

Cacti RCE Vulnerability - Windows

lib/rrd.php in Cacti 1.1.27 allows remote authenticated administrators to execute arbitrary OS commands via the pathrrdtool parameter in an action=save request to settings.php. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are...

CVE-2017-16641

lib/rrd.php in Cacti 1.1.27 allows remote authenticated administrators to execute arbitrary OS commands via the pathrrdtool parameter in an action=save request to settings.php...

PT-2017-14505

Name of the Vulnerable Software and Affected Versions Cacti version 1.1.27 Description The issue allows remote authenticated administrators to execute arbitrary OS commands. This is achieved via the path rrdtool parameter in an "action=save" request to "settings.php". Recommendations For Cacti...

EulerOS 2.0 SP1 : git (EulerOS-SA-2017-1265)

According to the version of the git packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Git before 2.10.5, 2.11.x before 2.11.4, 2.12.x before 2.12.5, 2.13.x before 2.13.6, and 2.14.x before 2.14.2 uses unsafe Perl scripts to support...

OrientDB Server 2.2.x <= 2.2.22 RCE Vulnerability

OrientDB does not enforce privilege requirements during SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:orientdb:orientdb";...

HPE System Management Homepage Arbitrary Command Execution Vulnerability (CNVD-2017-33362)

HPE System Management Homepage is a Web-based interface from Hewlett Packard Enterprise. An arbitrary command execution vulnerability exists in HPE System Management Homepage, which allows an attacker to submit a special request to execute arbitrary OS commands in an application context...

CVE-2017-10813

CG-WLR300NM Firmware version 1.90 and earlier allows an attacker to execute arbitrary OS commands via unspecified vectors...

CVE-2017-10813: Improper Neutralization of Special Elements used in an OS Command

CG-WLR300NM Firmware version 1.90 and earlier allows an attacker to execute arbitrary OS commands via unspecified vectors...

PT-2017-11521

Name of the Vulnerable Software and Affected Versions CG-WLR300NM Firmware versions 1.90 and earlier Description The issue allows an attacker to execute arbitrary OS commands via unspecified vectors. Recommendations For CG-WLR300NM Firmware versions 1.90 and earlier, update to a version later tha...

PT-2017-3002

Name of the Vulnerable Software and Affected Versions Git versions 2.10.5 and earlier, 2.11.x before 2.11.4, 2.12.x before 2.12.5, 2.13.x before 2.13.6, and 2.14.x before 2.14.2 Description The issue is related to the use of unsafe Perl scripts to support subcommands such as cvsserver, allowing...

CVE-2017-14135

enigma2-plugins/blob/master/webadmin/src/WebChilds/Script.py in the webadmin plugin for opendreambox 2.0.0 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the command parameter to the /script URI...

Command injection

Command Injection in the Ping Module in the Web Interface on Technicolor TD5336 OIFwv7 devices allows remote attackers to execute arbitrary OS commands as root via shell metacharacters in the pingAddr parameter to mntping.cgi...

CVE-2017-14127

Command Injection in the Ping Module in the Web Interface on Technicolor TD5336 OIFwv7 devices allows remote attackers to execute arbitrary OS commands as root via shell metacharacters in the pingAddr parameter to mntping.cgi...

CVE-2017-14127

Command Injection in the Ping Module in the Web Interface on Technicolor TD5336 OIFwv7 devices allows remote attackers to execute arbitrary OS commands as root via shell metacharacters in the pingAddr parameter to mntping.cgi...