Command execution vulnerability exists in FasterXML jackson-databind (CNVD-2021-00629)

FasterXML Jackson is a U.S. FasterXML company for Java data processing tools . jackson-databind is one of the components with data binding capabilities . A command execution vulnerability exists in FasterXML jackson-databind, which can be exploited by an attacker to execute arbitrary commands...

Webmin 1.962 - 'Package Updates' Escape Bypass RCE (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Webmin 1.962 - Package Update Escape Bypass RCE Metasploit', 'Description' = %q This module exploits an arbitrary command execution vulnerability...

Webmin Arbitrary Command Execution Vulnerability (CNVD-2021-07125)

Webmin is a Web-based system configuration tool for Unix-like systems, and the latest version can also be installed and run on Windows. An arbitrary command execution vulnerability exists in Webmin 1.962 and earlier versions. An attacker can exploit this vulnerability to execute arbitrary command...

The vulnerability of the Rake::FileList class implementation in the Rake tool for automating the compilation of software code allows a attacker to execute arbitrary commands.

The vulnerability of the Rake::FileList class implementation in the Rake tool for automating the compilation of software code is related to the lack of measures taken to eliminate special elements used in operating system commands. Exploiting this vulnerability allows an attacker to execute...

CVE-2020-35606

Arbitrary command execution can occur in Webmin through 1.962. Any user authorized for the Package Updates module can execute arbitrary commands with root privileges via vectors involving %0A and %0C. NOTE: this issue exists because of an incomplete fix for CVE-2019-12840...

CVE-2020-35606

Arbitrary command execution can occur in Webmin through 1.962. Any user authorized for the Package Updates module can execute arbitrary commands with root privileges via vectors involving %0A and %0C. NOTE: this issue exists because of an incomplete fix for CVE-2019-12840...

Command injection

Arbitrary command execution can occur in Webmin through 1.962. Any user authorized for the Package Updates module can execute arbitrary commands with root privileges via vectors involving %0A and %0C. NOTE: this issue exists because of an incomplete fix for CVE-2019-12840...

CVE-2020-35606

CVE-2020-35606 affects Webmin 1.962 and earlier. An authenticated user in the Package Updates module can trigger arbitrary commands with root privileges via vectors involving %0A and %0C, due to an incomplete fix for CVE-2019-12840. Public references describe this as a remote command execution vu...

CVE-2020-35606

Arbitrary command execution can occur in Webmin through 1.962. Any user authorized for the Package Updates module can execute arbitrary commands with root privileges via vectors involving %0A and %0C. NOTE: this issue exists because of an incomplete fix for CVE-2019-12840...

CVE-2020-25494

CVE-2020-25494 affects Xinuos OpenServer v5/v6. The vulnerability is in the CGI component cgi-bin/printbook (parameters outputform and toclevels), enabling shell metacharacter input and arbitrary command execution. Exploitation details in public sources confirm OS command injection with remote, u...

CVE-2020-25494

Xinuos formerly SCO Openserver v5 and v6 allows attackers to execute arbitrary commands via shell metacharacters in outputform or toclevels parameter to cgi-bin/printbook...

Xinuos Openserver Parameter Injection Vulnerability

Xinuos Openserver is a FreeBSD-based operating system from the US company Xinuos. A security vulnerability exists in Xinuos formerly SCO Openserver versions v5 and v6 that allows an attacker to execute arbitrary commands to the cgi-bin printbook via the shell metacharacter outputform or toclevels...

Vulnerabilities fixed in Brocade Fabric OS

Broadcom has released updates to fix vulnerabilities in Brocade Fabric OS. An authenticated malicious person without the proper LDAP group memberships could log into a switch as a regular user. The switch is only vulnerable to this to this when it is active in "Virtual Fabric" mode. Also, a local...

D-Link DSR-250 Command Injection Vulnerability

The D-Link DSR-250 is an 8-port Gigabit VPN router with dynamic Web content filtering. A command injection vulnerability exists in the Unified Services Router web interface of the D-Link DSR-250 3.17. The vulnerability stems from a lack of authentication of input provided in a multipart HTTP POST...

Raysync 3.3.3.8 - RCE

Exploit Title: Raysync 3.3.3.8 - RCE Date: 04/10/2020 Exploit Author: XiaoLong Zhu Vendor Homepage: www.raysync.io Version: below 3.3.3.8 Tested on: Linux step1: run RaysyncServer.sh to build a web application on the local environment, set admin password to 123456 , which will be write to manage....

CVE-2020-25757

A lack of input validation and access controls in Lua CGIs on D-Link DSR VPN routers may result in arbitrary input being passed to system command APIs, resulting in arbitrary command execution with root privileges. This affects DSR-150, DSR-250, DSR-500, and DSR-1000AC with firmware 3.14 and 3.17...

Input validation

A lack of input validation and access controls in Lua CGIs on D-Link DSR VPN routers may result in arbitrary input being passed to system command APIs, resulting in arbitrary command execution with root privileges. This affects DSR-150, DSR-250, DSR-500, and DSR-1000AC with firmware 3.14 and 3.17...

CVE-2020-25757

CVE-2020-25757 affects D-Link DSR-series VPN routers (DSR-150, DSR-250, DSR-500, DSR-1000AC) running firmware 3.14 and 3.17. The root cause is inadequate input validation and access controls in Lua CGI handlers, allowing user-supplied data to reach system command APIs (os.popen) and enabling arbi...

CVE-2020-25757

A lack of input validation and access controls in Lua CGIs on D-Link DSR VPN routers may result in arbitrary input being passed to system command APIs, resulting in arbitrary command execution with root privileges. This affects DSR-150, DSR-250, DSR-500, and DSR-1000AC with firmware 3.14 and 3.17...

CVE-2020-8283

An authorised user on a Windows host running Citrix Universal Print Server can perform arbitrary command execution as SYSTEM in CVAD versions before 2009, 1912 LTSR CU1 hotfixes CTX285870 and CTX286120, 7.15 LTSR CU6 hotfix CTX285344 and 7.6 LTSR CU9...