9344 matches found
Design/Logic Flaw
In qdPM 9.1, an attacker can upload a malicious .php file to the server by exploiting the Add Profile Photo capability with a crafted content-type value. After that, the attacker can execute an arbitrary command on the server using this malicious file...
CVE-2020-11811
In qdPM 9.1, an attacker can upload a malicious .php file to the server by exploiting the Add Profile Photo capability with a crafted content-type value. After that, the attacker can execute an arbitrary command on the server using this malicious file...
CVE-2020-11811
The CVE-2020-11811 entry concerns qdPM 9.1 where an attacker can upload a crafted PHP file through the Add Profile Photo capability using a malicious Content-Type, enabling remote code execution on the server via the uploaded file. The vulnerability originates from the server accepting and execut...
Sangoma Asterisk Command Injection (CVE-2019-18610)
A command injection vulnerability exists in Sangoma Asterisk. Successful exploitation of this vulnerability could result in arbitrary command execution on the affected system...
CVE-2020-10514
iCatch DVR firmware before 20200103 do not validate function parameter properly, resulting attackers executing arbitrary command...
CVE-2020-10514 iCatch DVR - Command Injection
iCatch DVR firmware before 20200103 do not validate function parameter properly, resulting attackers executing arbitrary command...
Code Injection in elwerene/libreoffice-convert
Description The libreoffice-convert module is vulnerable against RCE since a command is crafted using user inputs not validated and then executed, leading to arbitrary command injection POC 1. Create the following PoC file: js // poc.js const libre = require'libreoffice-convert'; libre.convert'',...
Code Injection in heroku/heroku-exec-util
Description The heroku-exec-util module is vulnerable against RCE since a command is crafted using user inputs not validated and then executed, leading to arbitrary command injection POC 1. Create the following PoC file: js // poc.js var heu = require'heroku-exec-util'; heu.sshargs:,'test; touch...
Arbitrary Command Execution
ibm java is vulnerable to arbitrary command execution. A remote attacker is able to execute arbitrary commands via a malicious web page...
Arbitrary Command Execution
device-mapper-multipath is vulnerable to arbitrary command execution. It was discovered that the multipathd daemon set incorrect permissions on the socket used to communicate with command line clients. An unprivileged, local user could use this flaw to send commands to multipathd, resulting in...
Arbitrary Command Execution
enscript is vulnerable to arbitrary command execution. The vulnerability exists as two buffer overflow flaws were found in GNU enscript. An attacker could craft an ASCII file in such a way that it could execute arbitrary commands if the file was opened with enscript with the "special escapes"...
Arbitrary Command Execution
php is vulnerable to arbitrary command execution. The vulnerability exists as it was discovered that the PHP escapeshellcmd function did not properly escape multi-byte characters which are not valid in the locale used by the script. This could allow an attacker to bypass quoting restrictions...
Clamscan Injection Vulnerability
clamscan is a command line tool that is mainly used to scan files or directories for viruses. An injection vulnerability exists in the 'isclamavbinary' function in the Index.js file in clamscan 1.2.0 and earlier versions. An attacker can exploit this vulnerability by sending a specially crafted...
CVE-2019-14889
A flaw was found with the libssh API function sshscpnew. A user able to connect to a server using SCP could execute arbitrary command using a user-provided path, leading to a compromise of the remote target...
adb-driver injection vulnerability
adb-driver is a universal Android USB driver. An injection vulnerability exists in adb-driver. The vulnerability can be exploited to execute arbitrary commands with the help of the 'command' parameter...
heroku-addonpool command injection vulnerability
heroku-addonpool is a package for managing applications in Heroku. A command injection vulnerability exists in heroku-addonpool version 0.1.15 and earlier. An attacker can exploit this vulnerability to execute arbitrary commands...
The vulnerability of the command-line interface of the Cisco FXOS operating system, allowing a hacker to execute arbitrary commands
The vulnerability of the Cisco FXOS operating system’s command-line interface relates to the lack of measures taken to neutralize special elements used in operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands with root privileges...
CVE-2020-5352
Dell EMC Data Protection Advisor 6.4, 6.5 and 18.1 contain an OS command injection vulnerability. A remote authenticated malicious user may exploit this vulnerability to execute arbitrary commands on the affected system...
XAMPP Arbitrary Command Execution Vulnerability
XAMPP is a free open source cross-platform Web server solution stack package developed by Apache Friends. An arbitrary command execution vulnerability exists in XAMPP. An attacker can exploit this vulnerability by changing the .exe configuration in xampp-contol.ini for all users including...