18174 matches found
Motorola CX2 操作系统命令注入漏洞
The Motorola CX2 is a wireless router from Motorola USA. An operating system command injection vulnerability exists in the HNAP1 SetWLanApcliSettings of the Motorola CX2 router CX, which allows an attacker to arbitrary system commands...
ManageEngine ServiceDesk Plus Command Injection (CVE-2021-20081)
A command injection vulnerability exists in ManageEngine ServiceDesk Plus. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...
CVE-2020-7866
When using XPLATFORM 9.2.2.270 or earlier versions ActiveX component, arbitrary commands can be executed due to improper input validation...
CVE-2020-7866
When using XPLATFORM 9.2.2.270 or earlier versions ActiveX component, arbitrary commands can be executed due to improper input validation...
Input validation
When using XPLATFORM 9.2.2.270 or earlier versions ActiveX component, arbitrary commands can be executed due to improper input validation...
Giveaway <= 1.2.2 - Authenticated SQL Injection
The plugin is vulnerable to an SQL Injection issue which allows an administrative user to execute arbitrary SQL commands via the $postid on the options.php page. PoC 1. Navigate in Wordpress panel to Settings - Giveaway 2. Intercept the request in Burp Suite 3. Click on "Select" button at the...
FiberHome Routers Command Injection (CVE-2021-42912)
A command injection vulnerability exists in FiberHome routers. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...
Remote Code Execution
fail2ban is vulnerable to remote code execution. The mailing action mail-whois command mail from mailutils package used in mail actions like mail-whois can execute command allows an attacker to execute arbitrary commands due to unescaped sequences \n in foreign input...
Aruba Instant (IAP) - Remote Code Execution Exploit
Aruba Instant IAP - Remote Code Execution Exploit import socket import sys import struct import time import threading import urllib3 import re import telnetlib import xml.etree.ElementTree as ET import requests urllib3.disablewarnings CONTINUERACE = True SNPRINTFCREATEFILEMAXLENGTH = 245 def...
Seagate BlackArmor NAS sg2000-2000.1331 - Command Injection
Exploit Title: Seagate BlackArmor NAS sg2000-2000.1331 - Command Injection Date: 15.07.2021 Discovered by: Jeroen - IT Nerdbox Exploit Author: Metin Yunus Kandemir Version: sg2000-2000.1331 Vendor Homepage: https://www.seagate.com/ Software Link:...
openSUSE 15 Security Update : salt (openSUSE-SU-2021:2106-1)
The remote SUSE Linux SUSE15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:2106-1 advisory. - Directory Traversal vulnerability in salt-api in SaltStack Salt before 2017.7.8 and 2018.3.x before 2018.3.3 allows remote attackers to...
CVE-2021-20533
IBM Security Verify Access Docker 10.0.0 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-Force ID: 198813...
Design/Logic Flaw
IBM Security Verify Access Docker 10.0.0 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-Force ID: 198813...
CVE-2021-20533
IBM Security Verify Access Docker 10.0.0 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-Force ID: 198813...
Cisco Web Security Appliance Privilege Escalation (cisco-sa-scr-web-priv-esc-k3HCGJZ)
According to its self-reported version, Cisco Web Security Appliance is affected by a privilege escalation vulnerability. A vulnerability in the configuration management of Cisco AsyncOS for Cisco Web Security Appliance WSA could allow an authenticated, remote attacker to perform command injectio...
Fortinet FortiSandbox 操作系统命令注入漏洞
Fortinet FortiSandbox is an APT Advanced Persistent Threat protection appliance from Fortinet. The appliance offers dual sandboxing technology, dynamic threat intelligence system, real-time control panel and reporting. Fortinet FortiSandbox suffers from a command injection vulnerability that...
Liferay Portal 7.3.5 SQLi
Multiple SQL injection vulnerabilities in Liferay Portal 7.3.5 allow remote authenticated users to execute arbitrary SQL commands via the classPKField parameter to 1 CommerceChannelRelFinder.countByCC, or 2 CommerceChannelRelFinder.findByCC. Note that Nessus has not tested for this issue but has...
Security Updates for Microsoft Dynamics 365 Business Central (July 2021)
The Microsoft Dynamics 365 Business Central install is missing a security update. It is, therefore, affected by a Remote Code Execution vulnerability. An authenticated attacker can exploit this, to execute arbitrary commands. Note that Nessus has not attempted to exploit this issue but has instea...