Command injection

An exploitable command injection vulnerability exists in the hostname functionality of the Moxa AWK-3131A firmware version 1.13. A specially crafted entry to network configuration information can cause execution of arbitrary system commands, resulting in full control of the device. An attacker ca...

CVE-2019-5142: Improper Neutralization of Special Elements used in an OS Command

An exploitable command injection vulnerability exists in the hostname functionality of the Moxa AWK-3131A firmware version 1.13. A specially crafted entry to network configuration information can cause execution of arbitrary system commands, resulting in full control of the device. An attacker ca...

PT-2020-9330

Name of the Vulnerable Software and Affected Versions: NETGEAR Nighthawk X10-R9000 versions prior to 1.0.4.26 Description: The issue allows an attacker to execute arbitrary system commands as root by sending a specially-crafted MAC address to the "NETGEAR Genie" SOAP endpoint at...

CVE-2019-10784

CVE-2019-10784 affects phpPgAdmin up to version 7.12.1. The issue is an improper source validation in the application, notably in database.php, enabling CSRF abuse that could let a remote attacker trick an authenticated administrator into visiting a malicious page and execute arbitrary system com...

PT-2020-9136

Name of the Vulnerable Software and Affected Versions phppgadmin versions prior to 7.12.1 Description The issue allows sensitive actions to be performed without validating the request origin, which can be exploited by a remote attacker to trick a logged-in administrator into visiting a malicious...

CVE-2019-10784: Cross-Site Request Forgery (CSRF)

phppgadmin through 7.12.1 allows sensitive actions to be performed without validating that the request originated from the application. One such area, "database.php" does not verify the source of an HTTP request. This can be leveraged by a remote attacker to trick a logged-in administrator to vis...

CVE-2019-16733

processCommandSetUid in libcommon.so in Petwant PF-103 firmware 4.22.2.42 and Petalk AI 3.2.2.30 allows remote attackers to execute arbitrary system commands as the root user...

CVE-2019-16737

The processCommandSetMac function of libcommon.so in Petwant PF-103 firmware 4.22.2.42 and Petalk AI 3.2.2.30 allows remote attackers to execute arbitrary system commands as the root user...

CVE-2019-17364

The processCommandUploadLog function of libcommon.so in Petwant PF-103 firmware 4.22.2.42 and Petalk AI 3.2.2.30 allows remote attackers to execute arbitrary system commands as the root user...

Default credentials

Use of default credentials for the TELNET server in Petwant PF-103 firmware 4.3.2.50 and Petalk AI 3.2.2.30 allows remote attackers to execute arbitrary system commands as the root user...

CVE-2019-16730

processCommandUpgrade in libcommon.so in Petwant PF-103 firmware 4.22.2.42 and Petalk AI 3.2.2.30 allows remote attackers to execute arbitrary system commands as the root user...

CVE-2019-16737

The processCommandSetMac function of libcommon.so in Petwant PF-103 firmware 4.22.2.42 and Petalk AI 3.2.2.30 allows remote attackers to execute arbitrary system commands as the root user...

PT-2019-14802

Name of the Vulnerable Software and Affected Versions Petwant PF-103 firmware version 4.3.2.50 Petalk AI version 3.2.2.30 Description The issue allows remote attackers to execute arbitrary system commands as the root user due to the use of default credentials for the TELNET server. Recommendation...

PT-2019-15105

Name of the Vulnerable Software and Affected Versions Petwant PF-103 firmware version 4.22.2.42 Petalk AI version 3.2.2.30 Description The issue allows remote attackers to execute arbitrary system commands as the root user due to a problem in the processCommandUploadLog function of libcommon.so...

CVE-2019-18610

An issue was discovered in manager.c in Sangoma Asterisk through 13.x, 16.x, 17.x and Certified Asterisk 13.21 through 13.21-cert4. A remote authenticated Asterisk Manager Interface AMI user without system authorization could use a specially crafted Originate AMI request to execute arbitrary syst...

CVE-2019-18610: Missing Authorization

An issue was discovered in manager.c in Sangoma Asterisk through 13.x, 16.x, 17.x and Certified Asterisk 13.21 through 13.21-cert4. A remote authenticated Asterisk Manager Interface AMI user without system authorization could use a specially crafted Originate AMI request to execute arbitrary syst...

PT-2019-15535

Name of the Vulnerable Software and Affected Versions Sangoma Asterisk versions 13.x through 17.x Certified Asterisk versions 13.21 through 13.21-cert4 Description An issue was discovered in the manager.c file, allowing a remote authenticated Asterisk Manager Interface AMI user without system...

CVE-2019-15014

A command injection vulnerability exists in the Zingbox Inspector versions 1.286 and earlier, that allows for an authenticated user to execute arbitrary system commands in the CLI...

CVE-2019-15014: Improper Neutralization of Special Elements used in an OS Command

A command injection vulnerability exists in the Zingbox Inspector versions 1.286 and earlier, that allows for an authenticated user to execute arbitrary system commands in the CLI...

Command injection

FusionPBX 4.4.8 allows an attacker to execute arbitrary system commands by submitting a malicious command to the serviceedit.php file which will insert the malicious command into the database. To trigger the command, one needs to call the services.php file via a GET request with the service id...