CVE-2020-10208

Command Injection in EntoneWebEngine in Amino Communications AK45x series, AK5xx series, AK65x series, Aria6xx series, Aria7/AK7Xx series and Kami7B allows authenticated remote attackers to execute arbitrary commands with root user privileges...

Command injection

Command Injection in the CPE WAN Management Protocol CWMP registration in Amino Communications AK45x series, AK5xx series, AK65x series, Aria6xx series, Aria7/AK7Xx series and Kami7B allows man-in-the-middle attackers to execute arbitrary commands with root level privileges...

CVE-2020-10208

CVE-2020-10208 affects Amino Communications EntoneWebEngine used in AK45x, AK5xx, AK65x, Aria6xx, Aria7/AK7Xx series, and Kami7B. The vulnerability is a command-injection flaw that allows an authenticated remote attacker to execute arbitrary commands with root privileges. The initial sources spec...

CVE-2020-10208

Command Injection in EntoneWebEngine in Amino Communications AK45x series, AK5xx series, AK65x series, Aria6xx series, Aria7/AK7Xx series and Kami7B allows authenticated remote attackers to execute arbitrary commands with root user privileges...

CVE-2020-25847

This command injection vulnerability allows attackers to execute arbitrary commands in a compromised application. QNAP have already fixed this vulnerability in the following versions of QTS and QuTS hero...

CVE-2020-25847

CVE-2020-25847 is a remote command injection vulnerability affecting QNAP QTS and QuTS hero. The flaw allows attackers to execute arbitrary commands in a compromised application. NVD/OSS records assign CVSSv3.1 base score 8.8 (Network, Low attack complexity, Privileges required: Low, User interac...

CVE-2020-25847 Command Injection Vulnerability in QTS and QuTS hero

This command injection vulnerability allows attackers to execute arbitrary commands in a compromised application. QNAP have already fixed this vulnerability in the following versions of QTS and QuTS hero...

The vulnerability of the unified information system for government management, Parus-Budget, due to insufficient verification of data authenticity, allows a perpetrator to execute arbitrary codes.

The vulnerability of the unified information system for government management, Parus-Budget, is related to insufficient verification of data authenticity. Exploiting this vulnerability could allow a malicious actor, operating remotely, to execute arbitrary commands by replacing the update file...

OsCommerce Phoenix CE Command Injection (CVE-2020-27976)

A command injection vulnerability exists in OsCommerce Phoenix CE. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

Apache Kylin Remote Code Execution (CVE-2020-1956)

A command execution vulnerability exists in Apache kylin 2.3.2. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

Zyxel ZLD和Zyxel SD-OS 命令注入漏洞

Zyxel SD-OS is an operating system for network configuration applications. Zyxel SD-OS chgexppwd suffers from an input validation vulnerability that can be exploited by a remote attacker to submit a special request that can be injected with arbitrary commands and executed...

CVE-2020-35713

Belkin LINKSYS RE6500 devices before 1.0.012.001 allow remote attackers to execute arbitrary commands or set a new password via shell metacharacters to the goform/setSysAdm page...

CVE-2020-35715

Belkin LINKSYS RE6500 devices before 1.0.012.001 allow remote authenticated users to execute arbitrary commands via shell metacharacters in a filename to the uploadsettings.cgi page...

Code injection

Belkin LINKSYS RE6500 devices before 1.0.012.001 allow remote authenticated users to execute arbitrary commands via shell metacharacters in a filename to the uploadsettings.cgi page...

Code injection

Belkin LINKSYS RE6500 devices before 1.0.012.001 allow remote attackers to execute arbitrary commands or set a new password via shell metacharacters to the goform/setSysAdm page...

Design/Logic Flaw

Belkin LINKSYS RE6500 devices before 1.0.11.001 allow remote authenticated users to execute arbitrary commands via goform/systemCommand?command= in conjunction with the goform/pingstart program...

CVE-2020-35713

Belkin LINKSYS RE6500 devices before 1.0.012.001 allow remote attackers to execute arbitrary commands or set a new password via shell metacharacters to the goform/setSysAdm page...

CVE-2020-35714

Belkin LINKSYS RE6500 devices before 1.0.11.001 allow remote authenticated users to execute arbitrary commands via goform/systemCommand?command= in conjunction with the goform/pingstart program...

CVE-2020-35715

Belkin LINKSYS RE6500 devices before 1.0.012.001 allow remote authenticated users to execute arbitrary commands via shell metacharacters in a filename to the uploadsettings.cgi page...

Command execution vulnerability exists in FasterXML jackson-databind (CNVD-2021-00632)

FasterXML Jackson is a U.S. FasterXML company for Java data processing tools . jackson-databind is one of the components with data binding capabilities . A command execution vulnerability exists in FasterXML jackson-databind, which can be exploited by an attacker to execute arbitrary commands...