Insecure Deserialization in Apache Commons Collection

Serialized-object interfaces in Java applications using the Apache Commons Collections ACC library may allow remote attackers to execute arbitrary commands via a crafted serialized Java object...

CVE-2020-14081

TRENDnet TEW-827DRU devices through 2.06B04 contain multiple command injections in apply.cgi via the action sendlogemail with the key authacname or authpasswd, allowing an authenticated user to run arbitrary commands on the device...

CVE-2020-14075

TRENDnet TEW-827DRU devices through 2.06B04 contain multiple command injections in apply.cgi via the action pppoeconnect, rupppoeconnect, or dhcpconnect with the key wanifname or wan0dns, allowing an authenticated user to run arbitrary commands on the device...

Symphony CMS SQL Injection (CVE-2010-3458)

An SQL injection vulnerability exists in the Symphony CMS. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system...

Palo Alto Networks PAN-OS Operating System Command Injection Vulnerability (CNVD-2021-22179)

Palo Alto Networks PAN-OS is an operating system developed by Palo Alto Networks for its firewall appliances. An operating system command injection vulnerability exists in the management server in Palo Alto Networks PAN-OS. An attacker could exploit this vulnerability to execute arbitrary operati...

Plex Media Server < 1.18.2 Privilege Escalation

According to its self-reported version number, the version of Plex Media Server installed on the remote Windows host is prior to 1.18.2. It is, therefore, affected by a local privilege escalation vulnerability. The vulnerability exists in the Plex Update Service due to exposed functionality over ...

Command injection

An OS Command Injection vulnerability in PAN-OS management server allows authenticated administrators to execute arbitrary OS commands with root privileges when uploading a new certificate in FIPS-CC mode. This issue affects: All versions of PAN-OS 7.1 and PAN-OS 8.0; PAN-OS 8.1 versions earlier...

Command injection

An OS Command Injection vulnerability in the PAN-OS web management interface allows authenticated administrators to execute arbitrary OS commands with root privileges by sending a malicious request to generate new certificates for use in the PAN-OS configuration. This issue affects: All versions ...

NOKIA VitalSuite SPM SQL Injection (CVE-2021-41487)

An SQL injection vulnerability exists in the NOKIA VitalSuite SPM. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system...

The vulnerability of the microprogrammed control module software for Schneider Electric Easergy T300 (HU250) automation systems for transformer substations stems from improper verification of integrity. This allows a perpetrator to inject additional code into the device’s firmware and execute arbitrary commands.

The vulnerability of the microprogrammed control module software for automation of transformer substations of Schneider Electric Easergy T300 HU250 is related to improper verification of integrity. Exploiting this vulnerability allows a malicious actor to inject additional code into the device’s...

CVE-2020-9412

The file transfer component of TIBCO Software Inc.'s TIBCO Managed File Transfer Platform Server for IBM i contains a vulnerability that theoretically allows execution of arbitrary commands at the privilege level of the affected system following a failed file transfer. Affected releases are TIBCO...

Design/Logic Flaw

The file transfer component of TIBCO Software Inc.'s TIBCO Managed File Transfer Platform Server for IBM i contains a vulnerability that theoretically allows execution of arbitrary commands at the privilege level of the affected system following a failed file transfer. Affected releases are TIBCO...

CVE-2020-9412

The vulnerability affects TIBCO Managed File Transfer Platform Server for IBM i (file transfer component). Affects versions 7.1.0 and below, and 8.0.0. Root cause and impact: arbitrary command execution at the privilege level of the affected system after a failed file transfer, with network-based...

CVE-2020-13976

An issue was discovered in DD-WRT through 16214. The Diagnostic page allows remote attackers to execute arbitrary commands via shell metacharacters in the host field of the ping command. Exploitation through CSRF might be possible. NOTE: software maintainers consider the report invalid because it...

CVE-2020-13976

An issue was discovered in DD-WRT through 16214. The Diagnostic page allows remote attackers to execute arbitrary commands via shell metacharacters in the host field of the ping command. Exploitation through CSRF might be possible. NOTE: software maintainers consider the report invalid because it...

CVE-2020-12773 Realtek ADSL/PON Modem SoC - Security Misconfiguration

A security misconfiguration vulnerability exists in the SDK of some Realtek ADSL/PON Modem SoC firmware, which allows attackers using a default password to execute arbitrary commands remotely via the build-in network monitoring tool...

Cisco IOS XE Software Command Injection (cisco-sa-ngwc-cmdinj-KEwWVWR)

According to its self-reported version, Cisco IOS XE Software is affected by a command injection vulnerability due to insufficient input validation of boot options. An authenticated, local attacker with root privileges can exploit this, by modifying device boot options, to execute arbitrary...

QNAP QTS Remote Command Injection (CVE-2019-7193)

A remote command injection vulnerability exists in QNAP QTS. An authenticated attacker can exploit this vulnerability by injecting arbitrary PHP code into the session. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

Cisco IOS XE Software Privilege License and Access Control Issues Vulnerability

Cisco IOS XE is the United States Cisco Cisco company's set of operating system developed for its network equipment. A privilege permission and access control issue vulnerability exists in ROMMON in Cisco IOS XE Software. An attacker can exploit this vulnerability by sending parameters to elevate...

Cisco IOS XE Software Command Injection Vulnerability

Cisco IOS XE is the United States Cisco Cisco company's set of operating system developed for its network equipment. A command injection vulnerability exists in the Web UI in Cisco IOS XE Software, which stems from a lack of validation of user input. An attacker can exploit this vulnerability by...