CVE-2020-2097: Incorrect Authorization

Jenkins Sounds Plugin 0.5 and earlier does not perform permission checks in URLs performing form validation, allowing attackers with Overall/Read access to execute arbitrary OS commands as the OS user account running Jenkins...

CVE-2019-20224

netflowgetstats in functionsnetflow.php in Pandora FMS 7.0NG allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the ipsrc parameter in an index.php?operation/netflow/nfliveview request. This issue has been fixed in Pandora FMS 7.0 NG 742...

PT-2020-10382

Name of the Vulnerable Software and Affected Versions Pandora FMS versions prior to 7.0 NG 742 Description The issue allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the ip src parameter in an "index.php?operation/netflow/nf live view" request. This i...

CVE-2016-11017

The application login page in AKIPS Network Monitor 15.37 through 16.5 allows a remote unauthenticated attacker to execute arbitrary OS commands via shell metacharacters in the username parameter a failed login attempt returns the command-injection output to a limited login failure field. This is...

CVE-2020-5179

Comtech Stampede FX-1010 7.4.3 devices allow remote authenticated administrators to execute arbitrary OS commands by navigating to the Diagnostics Ping page and entering shell metacharacters in the Target IP address field. In some cases, authentication can be achieved with the comtech password fo...

Design/Logic Flaw

In Nagios XI 5.6.9, an authenticated user is able to execute arbitrary OS commands via shell metacharacters in the id parameter to schedulereport.php, in the context of the web-server user account...

CVE-2019-6013

DBA-1510P firmware 1.70b009 and earlier allows authenticated attackers to execute arbitrary OS commands via Command Line Interface CLI...

PT-2019-4331

Name of the Vulnerable Software and Affected Versions DBA-1510P firmware version 1.70b009 and earlier Description The issue allows authenticated attackers to execute arbitrary OS commands via the Command Line Interface CLI. This is due to the lack of measures to neutralize special elements used i...

CVE-2019-18396

An issue was discovered in certain Oi third-party firmware that may be installed on Technicolor TD5130v2 devices. A Command Injection in the Ping module in the Web Interface in OIFwV20 allows remote attackers to execute arbitrary OS commands in the pingAddr parameter to mntping.cgi. NOTE: This ma...

Command injection

An issue was discovered in certain Oi third-party firmware that may be installed on Technicolor TD5130v2 devices. A Command Injection in the Ping module in the Web Interface in OIFwV20 allows remote attackers to execute arbitrary OS commands in the pingAddr parameter to mntping.cgi. NOTE: This ma...

CVE-2019-18396

An issue was discovered in certain Oi third-party firmware that may be installed on Technicolor TD5130v2 devices. A Command Injection in the Ping module in the Web Interface in OIFwV20 allows remote attackers to execute arbitrary OS commands in the pingAddr parameter to mntping.cgi. NOTE: This ma...

PT-2019-15174

Centreon 19.04 allows attackers to execute arbitrary OS commands via the Command Line field of main.php?p=60807&type=4 aka the Configuration Commands Discovery screen. CVE-2019-17501 and CVE-2019-16405 are similar to one another and may be the same...

CVE-2019-17501: Improper Neutralization of Special Elements used in an OS Command

Centreon 19.04 allows attackers to execute arbitrary OS commands via the Command Line field of main.php?p=60807&type=4 aka the Configuration Commands Discovery screen. CVE-2019-17501 and CVE-2019-16405 are similar to one another and may be the same...

Design/Logic Flaw

D-Link DIR-846 devices with firmware 100A35 allow remote attackers to execute arbitrary OS commands as root by leveraging admin access and sending a /HNAP1/ request for SetWizardConfig with shell metacharacters to /squashfs-root/www/HNAP1/control/SetWizardConfig.php...

CVE-2019-17269

Intellian Remote Access 3.18 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the Ping Test field...

PT-2019-15052

Name of the Vulnerable Software and Affected Versions Intellian Remote Access version 3.18 Description The issue allows remote attackers to execute arbitrary OS commands via shell metacharacters in the Ping Test field. Recommendations For Intellian Remote Access version 3.18, consider restricting...

Design/Logic Flaw

The Create Discoveries feature of Open-AudIT before 3.2.0 allows an authenticated attacker to execute arbitrary OS commands via a crafted value for a URL field...

NewStart CGSL MAIN 4.06 : vim Vulnerability (NS-SA-2019-0177)

The remote NewStart CGSL host, running version MAIN 4.06, has vim packages installed that are affected by a vulnerability: - getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via the :source! command in a modeline, as demonstrated by...

WordPress Plainview Activity Monitor Plugin Command Injection (CVE-2018-15877)

A command injection vulnerability exists in WordPress Plainview Activity Monitor plugin. Successful exploitation of this vulnerability would allow remote attackers to execute arbitrary OS commands in the affected system...

Remote Code Execution

nexus-yum-repository-plugin is vulnerable to remote code execution. An attacker with administrative access to nxrm is able to execute arbitrary OS commands on the system by setting the path of createrepo or mergerepo to an OS command in the XML input...