Mako Server v2.5, 2.6 OS Command Injection RCE

This module exploits a vulnerability found in Mako Server v2.5, 2.6. It's possible to inject arbitrary OS commands in the Mako Server tutorial page through a PUT request to save.lsp. Attacker input will be saved on the victims machine and can be executed by sending a GET request to manage.lsp...

CVE-2017-10832: Improper Neutralization of Special Elements used in an OS Command

"Dokodemo eye Smart HD" SCR02HD Firmware 1.0.3.1000 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors...

CVE-2017-10832

"Dokodemo eye Smart HD" SCR02HD Firmware 1.0.3.1000 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors...

PT-2017-11540

Name of the Vulnerable Software and Affected Versions Dokodemo eye Smart HD SCR02HD Firmware versions 1.0.3.1000 and earlier Description The issue allows remote attackers to execute arbitrary OS commands. Recommendations For Firmware versions 1.0.3.1000 and earlier, update to a version later than...

PT-2017-11519

Name of the Vulnerable Software and Affected Versions Buffalo WCR-1166DS versions 1.30 and earlier Description The issue allows an attacker to execute arbitrary OS commands. Recommendations For Buffalo WCR-1166DS versions 1.30 and earlier, update to a version later than 1.30 to resolve the issue...

CVE-2017-10811: Improper Neutralization of Special Elements used in an OS Command

Buffalo WCR-1166DS devices with firmware 1.30 and earlier allow an attacker to execute arbitrary OS commands via unspecified vectors...

PT-2017-9395

Name of the Vulnerable Software and Affected Versions GigaCC OFFICE versions 2.3 and earlier Description The issue allows remote attackers to execute arbitrary OS commands via specially crafted mail templates. Recommendations For GigaCC OFFICE versions 2.3 and earlier, update to a version later...

CVE-2017-2281: Improper Neutralization of Special Elements used in an OS Command

WN-AX1167GR firmware version 3.00 and earlier allows an attacker to execute arbitrary OS commands via unspecified vectors...

Design/Logic Flaw

snwrite.cgi in AirLink101 SkyIPCam1620W Wireless N MPEG4 3GPP network camera with firmware FWAIC1620W1.1.0-1220120709r1192.pck allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the mac parameter...

Design/Logic Flaw

cgitest.cgi in AirLive BU-2015 with firmware 1.03.18, BU-3026 with firmware 1.43, and MD-3025 with firmware 1.81 allows remote attackers to execute arbitrary OS commands via shell metacharacters after an "&" ampersand in the writemac writepid, writemsn, writetan, or writehdv parameter...

PT-2017-6564

Name of the Vulnerable Software and Affected Versions AirLink101 SkyIPCam1620W Wireless N MPEG4 3GPP network camera version FW AIC1620W 1.1.0-12 20120709 r1192.pck Description The issue allows remote authenticated users to execute arbitrary OS commands. This is achieved by injecting shell...

Design/Logic Flaw

Toshiba Home gateway HEM-GW16A firmware HEM-GW16A-FW-V1.2.0 and earlier. Toshiba Home gateway HEM-GW26A firmware HEM-GW26A-FW-V1.2.0 and earlier allows an attacker to execute arbitrary OS commands via unspecified vectors...

CVE-2017-2183

HOME SPOT CUBE2 firmware V101 and earlier allows authenticated attackers to execute arbitrary OS commands via Clock Settings...

CVE-2017-2185

HOME SPOT CUBE2 firmware V101 and earlier allows authenticated attackers to execute arbitrary OS commands via WebUI...

PT-2017-15242

Name of the Vulnerable Software and Affected Versions HOME SPOT CUBE2 firmware versions V101 and earlier Description The issue allows authenticated attackers to execute arbitrary OS commands via Clock Settings. Recommendations For HOME SPOT CUBE2 firmware versions V101 and earlier, update to a...

Design/Logic Flaw

I-O DATA DEVICE TS-WRLP firmware version 1.01.02 and earlier and TS-WRLA firmware version 1.01.02 and earlier allows an attacker with administrator rights to execute arbitrary OS commands via unspecified vectors...

CVE-2016-7819

I-O DATA DEVICE TS-WRLP firmware version 1.01.02 and earlier and TS-WRLA firmware version 1.01.02 and earlier allows an attacker with administrator rights to execute arbitrary OS commands via unspecified vectors...

Design/Logic Flaw

I-O DATA DEVICE WFS-SR01 firmware version 1.10 and earlier allow remote attackers to execute arbitrary OS commands via unspecified vectors...

CVE-2016-7806

CVE-2016-7806 affects I-O DATA DEVICE WFS-SR01 firmware

CVE-2016-7819

I-O DATA DEVICE TS-WRLP firmware version 1.01.02 and earlier and TS-WRLA firmware version 1.01.02 and earlier allows an attacker with administrator rights to execute arbitrary OS commands via unspecified vectors...