981 matches found
Design/Logic Flaw
TimeTools SC7105 1.0.007, SC9205 1.0.007, SC9705 1.0.007, SR7110 1.0.007, SR9210 1.0.007, SR9750 1.0.007, SR9850 1.0.007, T100 1.0.003, T300 1.0.003, and T550 1.0.003 devices allow remote attackers to execute arbitrary OS commands via shell metacharacters in the t3.cgi srmodel or srtime parameter...
CVE-2020-8949
Various Gocloud and ISP3000 devices, including S2A_WL 4.2.7.16471 , S2A 4.2.7.17278 , S2A 4.3.0.15815 , S2A 4.3.0.17193 , S3A K2P MTK 4.2.7.16528 , S3A 4.3.0.16572 , and ISP3000 4.3.0.17190 , are vulnerable to an OS command injection vulnerability. The flaw exists due to the improper neutralizati...
CVE-2020-8947
functionsnetflow.php in Artica Pandora FMS 7.0 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the index.php?operation/netflow/nfliveview ipdst, dstport, or srcport parameter, a different vulnerability than CVE-2019-20224...
PT-2020-20384
Name of the Vulnerable Software and Affected Versions Netis WF2471 version 1.2.30142 Description The issue allows an authenticated attacker to execute arbitrary OS commands. This is achieved by using shell metacharacters in the log 3g type parameter of the "/cgi-bin-igd/sys log clean.cgi" API...
CVE-2020-8654
An issue was discovered in EyesOfNetwork 5.3. An authenticated web user with sufficient privileges could abuse the AutoDiscovery module to run arbitrary OS commands via the /module/moduleframe/index.php autodiscovery.php target field...
Command injection
An issue was discovered in EyesOfNetwork 5.3. An authenticated web user with sufficient privileges could abuse the AutoDiscovery module to run arbitrary OS commands via the /module/moduleframe/index.php autodiscovery.php target field...
CVE-2020-8654
An issue was discovered in EyesOfNetwork 5.3. An authenticated web user with sufficient privileges could abuse the AutoDiscovery module to run arbitrary OS commands via the /module/moduleframe/index.php autodiscovery.php target field...
CVE-2020-8654
An issue was discovered in EyesOfNetwork 5.3. An authenticated web user with sufficient privileges could abuse the AutoDiscovery module to run arbitrary OS commands via the /module/moduleframe/index.php autodiscovery.php target field...
PT-2020-20252
Name of the Vulnerable Software and Affected Versions EyesOfNetwork version 5.3 Description An issue allows an authenticated web user with sufficient privileges to abuse the AutoDiscovery module and run arbitrary OS commands via the "module/module frame/index.php autodiscovery.php" target field...
CVE-2020-8438
Ruckus ZoneFlex R500 104.0.0.0.1347 devices allow an authenticated attacker to execute arbitrary OS commands via the hidden /forms/nslookupHandler form, as demonstrated by the nslookuptarget=|cat$IFS substring...
PT-2020-20138
Name of the Vulnerable Software and Affected Versions Ruckus ZoneFlex R500 version 104.0.0.0.1347 Description The issue allows an authenticated attacker to execute arbitrary OS commands via the hidden /forms/nslookupHandler form. This can be demonstrated by using the nslookuptarget parameter with...
CVE-2019-19824: Improper Neutralization of Special Elements used in an OS Command
On certain TOTOLINK Realtek SDK based routers, an authenticated attacker may execute arbitrary OS commands via the sysCmd parameter to the boafrm/formSysCmd URI, even if the GUI syscmd.htm is not available. This allows for full control over the device's internals. This affects A3002RU through...
CVE-2020-7594
MultiTech Conduit MTCDT-LVW2-24XX 1.4.17-ocea-13592 devices allow remote authenticated administrators to execute arbitrary OS commands by navigating to the Debug Options page and entering shell metacharacters in the interface JSON field of the ping function...
Input validation
MultiTech Conduit MTCDT-LVW2-24XX 1.4.17-ocea-13592 devices allow remote authenticated administrators to execute arbitrary OS commands by navigating to the Debug Options page and entering shell metacharacters in the interface JSON field of the ping function...
PT-2020-19643
Name of the Vulnerable Software and Affected Versions MultiTech Conduit MTCDT-LVW2-24XX version 1.4.17-ocea-13592 Description The issue allows remote authenticated administrators to execute arbitrary OS commands. This can be achieved by navigating to the Debug Options page and entering shell...
CVE-2020-7594: Improper Neutralization of Special Elements used in an OS Command
MultiTech Conduit MTCDT-LVW2-24XX 1.4.17-ocea-13592 devices allow remote authenticated administrators to execute arbitrary OS commands by navigating to the Debug Options page and entering shell metacharacters in the interface JSON field of the ping function...
CVE-2020-7240
Meinberg Lantime M300 and M1000 devices allow attackers with privileges to configure a device to execute arbitrary OS commands by editing the /config/netconf.cmd script aka Extended Network Configuration. Note: According to the description, the vulnerability requires a fully authenticated...
CVE-2020-7240
Meinberg Lantime M300 and M1000 devices allow attackers with privileges to configure a device to execute arbitrary OS commands by editing the /config/netconf.cmd script aka Extended Network Configuration. Note: According to the description, the vulnerability requires a fully authenticated...