18312 matches found
Command Injection
Overview gulp-tape is a to run Tape tests in Gulp. Affected versions of this package are vulnerable to Command Injection. It is possible to inject arbitrary commands as part of gulp-tape options. PoC var root = require"gulp-tape"; var gulp = require"gulp"; var options = name: "& touch JHU.txt"...
Huawei EulerOS: Security Advisory for polkit (EulerOS-SA-2020-1193)
The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Cisco ASA Software CLI Command Injection (cisco-sa-20200226-fxos-ucs-cmdinj)
According to its self-reported version, Cisco ASA Software is affected by a vulnerability in the CLI due to insufficient input validation. An authenticated, local attacker can exploit this, by including crafted arguments to specific commands, in order to execute arbitrary commands on the underlyi...
Cisco UCS Manager Software CLI Command Injection (cisco-sa-20200226-fxos-ucs-cmdinj)
According to its self-reported version, Cisco UCS Manager Software is affected by a vulnerability in the CLI due to insufficient input validation. An authenticated, local attacker can exploit this, by including crafted arguments to specific commands, in order to execute arbitrary commands on the...
Mozilla Firefox ESR Security Advisories (MFSA2020-08, MFSA2020-09) - Windows
Mozilla Firefox ESR is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:firefoxesr";...
CVE-2019-10807
Blamer versions prior to 1.0.1 allows execution of arbitrary commands. It is possible to inject arbitrary commands as part of the arguments provided to blamer...
CVE-2019-10807
Blamer versions prior to 1.0.1 allows execution of arbitrary commands. It is possible to inject arbitrary commands as part of the arguments provided to blamer...
QIWI: SQL injection on contactws.contact-sys.com in TRateObject.AddForOffice in USER_ID parameter leads to remote code execution
Summary The API interface on https://contactws.contact-sys.com:3456/ accepts a body to interact with the server's AppServ object. Because of insufficient input validation, an attacker can abuse the USERID parameter of the TRateObject.AddForOffice method to inject arbitrary SQL statements. This...
Asus Rt Ac3200 Firmware Command Injection (CVE-2018-14714)
A command injection vulnerability exists in Asus Rt Ac3200 Firmware. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...
Cisco FXOS Software Local Management CLI Command Injection Vulnerability (cisco-sa-20200226-fxos-ucs-cli-cmdinj)
According to its self-reported version, Cisco FXOS Software is affected by a command injection vulnerability within the local management local-mgmt CLI of Cisco FXOS Software due to insufficient input validation. An authenticated, local attacker can exploit this to execute arbitrary commands on t...
RICOH Aficio Printer Command Injection (CVE-2019-11845)
A command injection vulnerability exists in RICOH Aficio Printer. Successful exploitation of this vulnerability could allow remote attackers to execute system arbitrary commands in the affected system...
Cisco Adaptive Security Appliance (ASA) Software Command Injection Vulnerability (cisco-sa-20200226-fxos-ucs-cli-cmdinj)
According to its self-reported version, Cisco ASA Software is affected by a command injection vulnerability within the local management local-mgmt CLI of Cisco ASA Software due to insufficient input validation. An authenticated, local attacker can exploit this to execute arbitrary commands on the...
CVE-2019-10807
Blamer versions prior to 1.0.1 allows execution of arbitrary commands. It is possible to inject arbitrary commands as part of the arguments provided to blamer...
Debian: Security Advisory (DSA-4637-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Nagios XI - Authenticated Remote Command Execution Exploit
This Metasploit module exploits a vulnerability in Nagios XI versions before 5.6.6 in order to execute arbitrary commands as root. The module uploads a malicious plugin to the Nagios XI server and then executes this plugin by issuing an HTTP GET request to download a system profile from the serve...
USN-4295-1: Rake vulnerability | Cloud Foundry
Severity Medium Vendor Canonical Ubuntu Versions Affected Canonical Ubuntu 18.04 Description It was discovered that Rake incorrectly handled certain files. An attacker could use this issue to possibly execute arbitrary commands. CVEs contained in this USN include: CVE-2020-8130. Affected Cloud...
[SECURITY] [DSA 4637-1] network-manager-ssh security update
------------------------------------------------------------------------- Debian Security Advisory DSA-4637-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso March 09, 2020 https://www.debian.org/security/faq -...
CVE-2016-6918
Lexmark Markvision Enterprise MVE before 2.4.1 allows remote attackers to execute arbitrary commands by uploading files...
CVE-2016-6918
Summary: CVE-2016-6918 affects Lexmark Markvision Enterprise (MVE) prior to version 2.4.1, where a remote attacker can execute arbitrary commands by uploading files. The connected documents consistently describe this as a vulnerability in MVE before 2.4.1 with no explicit exploitation details inc...