451 matches found
Command injection
Command Injection in Simiki v1.6.2.1 and prior allows remote attackers to execute arbitrary system commands via line 64 of the component 'simiki/blob/master/simiki/config.py'...
CVE-2020-19001
CVE-2020-19001 affects Simiki (v1.6.2.1 and earlier). The issue is a command injection vulnerability in the component at simiki/blob/master/simiki/config.py (line 64), enabling remote attackers to execute arbitrary system commands. The CVE is rated as high/critical by NVD (CVSSv3.1: CVSS:3.1/AV:N...
F5 BIG-IP TMUI Remote Command Execution Vulnerability
F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, remote access policy management, etc. A remote command execution vulnerability exists in the F5 BIG-IP TMUI, which can be exploited by an authenticated attacker wi...
F5 BIG-IP Advanced WAF and ASM TMUI is vulnerable to unspecified vulnerabilities
F5 BIG-IP is an application delivery platform from F5 that integrates network traffic orchestration, load balancing, intelligent DNS, remote access policy management, etc. An unspecified vulnerability exists in the F5 BIG-IP Advanced WAF and ASM TMUI, which, when cracked, allows an authenticated...
SAP Enterprise Portal 代码问题漏洞
SAP Enterprise Portal is an application from SAP, Germany. A comprehensive integration and application platform that facilitates the alignment of people, information and business processes across organizational and technology boundaries. SAP Enterprise Portal has a code issue vulnerability that...
CVE-2020-21937
An command injection vulnerability in HNAP1/SetWLanApcliSettings of Motorola CX2 router CX 1.0.2 Build 20190508 Rel.97360n allows attackers to execute arbitrary system commands...
QSAN Storage Manager Hardcoded Credentials Vulnerability
QSAN Storage Manager is a NAS operating system from Quantium Technologies Incorporated QSAN. A hard-coded credentials vulnerability exists in QSAN Storage Manager version 3.3.1 build 202101041800 and prior versions. An attacker can exploit this vulnerability to open the control interface via the...
Command injection
In Weidmueller Industrial WLAN devices in multiple versions an exploitable command injection vulnerability exists in the hostname functionality. A specially crafted entry to network configuration information can cause execution of arbitrary system commands, resulting in full control of the device...
CVE-2021-33534 WEIDMUELLER: WLAN devices affected by OS Command Injection vulnerability
In Weidmueller Industrial WLAN devices in multiple versions an exploitable command injection vulnerability exists in the hostname functionality. A specially crafted entry to network configuration information can cause execution of arbitrary system commands, resulting in full control of the device...
AGG Software Web Server Plugin
1. EXECUTIVE SUMMARY CVSS v3 8.2 ATTENTION: Exploitable remotely/low attack complexity Vendor: AGG Software Equipment: Web Server Vulnerabilities: Path Traversal, Cross-site Scripting 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow remote code execution and...
Command Execution Vulnerability in NETSYS of Shenzhen Network Domain Technology Co. Ltd (CNVD-2021-43932)
Founded in 2004, Shenzhen Domain Technology Co., Ltd. is a national high-tech enterprise specializing in the research and development, production, sales and service of products in the field of network information security. A command execution vulnerability exists in Shenzhen NETSYS Technology Co...
Directory Traversal
@backstage/techdocs-common is vulnerable to directory traversal. An attacker can read arbitrary system files from the environment where TechDocs documentation is built and published by setting a particular path for docsdir in mkdocs.yml...
Command Execution Vulnerability in BHW L7 Cloud Route Wireless Operations Edition (CNVD-2021-41531)
BHW L7 Cloud Road Wireless Operations Edition is a dedicated network device uniquely designed for commercial wireless managers in hotels, resorts, shopping malls and stations. The device is equipped with multiple functions such as routing, firewall, flow control, wireless AC controller, and WeCha...
Codiad 2.8.4 - Remote Code Execution (Authenticated) (2)
Exploit Title: Codiad 2.8.4 - Remote Code Execution Authenticated 2 Date: 21.05.2021 Exploit Author: Ron Jost Hacker5preme Credits to: https://herolab.usd.de/security-advisories/usd-2019-0049/ Tobias Neitzel Vendor Homepage: http://codiad.com/ Software Link:...
Command execution vulnerability in nginxWebUI
nginxWebUI is an open source tool for the web. A command execution vulnerability exists in nginxWebUI. An attacker can exploit the vulnerability to execute arbitrary system commands...
Directory Traversal
gnome-autoar is vulnerable to information disclosure. The autoar-extractor.c module allows an attacker to exploit a directory traversal vulnerability during extraction as it lacks symlink validation, resulting in writing of files in arbitrary system directories...
XML External Entity (XXE)
Wordpress is vulnerable to XML external entity attack. A user with the ability to upload files like an Author is able to exploit an XML external entity vulnerability in the Media Library to retrieve arbitrary system files...
Updated velocity packages fix security vulnerability
An attacker that is able to modify Velocity templates may execute arbitrary Java code or run arbitrary system commands with the same privileges as the account running the Servlet container. This applies to applications that allow untrusted users to upload/modify velocity templates running Apache...
