11703 matches found
PT-2020-17488
Name of the Vulnerable Software and Affected Versions HGiga MailSherlock affected versions not specified Description The issue is related to improper validation of specific parameters, allowing attackers to launch command inject attacks remotely and execute arbitrary commands on the system. This...
CVE-2020-25847: Improper Neutralization of Special Elements used in a Command
This command injection vulnerability allows attackers to execute arbitrary commands in a compromised application. QNAP have already fixed this vulnerability in the following versions of QTS and QuTS hero...
Command execution vulnerability exists in FasterXML jackson-databind (CNVD-2021-00629)
FasterXML Jackson is a U.S. FasterXML company for Java data processing tools . jackson-databind is one of the components with data binding capabilities . A command execution vulnerability exists in FasterXML jackson-databind, which can be exploited by an attacker to execute arbitrary commands...
Webmin 1.962 - 'Package Updates' Escape Bypass RCE (Metasploit)
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Webmin 1.962 - Package Update Escape Bypass RCE Metasploit', 'Description' = %q This module exploits an arbitrary command execution vulnerability...
Rake FileList Command Execution
The vulnerability of the Rake::FileList class implementation in the Rake tool for automating the compilation of software code is related to the lack of measures taken to eliminate special elements used in operating system commands. Exploiting this vulnerability allows an attacker to execute...
Webmin Arbitrary Command Execution Vulnerability (CNVD-2021-07125)
Webmin is a Web-based system configuration tool for Unix-like systems, and the latest version can also be installed and run on Windows. An arbitrary command execution vulnerability exists in Webmin 1.962 and earlier versions. An attacker can exploit this vulnerability to execute arbitrary command...
CVE-2020-35606
Arbitrary command execution can occur in Webmin through 1.962. Any user authorized for the Package Updates module can execute arbitrary commands with root privileges via vectors involving %0A and %0C. NOTE: this issue exists because of an incomplete fix for CVE-2019-12840...
CVE-2020-35606
Arbitrary command execution can occur in Webmin through 1.962. Any user authorized for the Package Updates module can execute arbitrary commands with root privileges via vectors involving %0A and %0C. NOTE: this issue exists because of an incomplete fix for CVE-2019-12840...
Command injection
Arbitrary command execution can occur in Webmin through 1.962. Any user authorized for the Package Updates module can execute arbitrary commands with root privileges via vectors involving %0A and %0C. NOTE: this issue exists because of an incomplete fix for CVE-2019-12840...
CVE-2020-35606
Arbitrary command execution can occur in Webmin through 1.962. Any user authorized for the Package Updates module can execute arbitrary commands with root privileges via vectors involving %0A and %0C. NOTE: this issue exists because of an incomplete fix for CVE-2019-12840...
CVE-2020-35606
CVE-2020-35606 affects Webmin 1.962 and earlier. An authenticated user in the Package Updates module can trigger arbitrary commands with root privileges via vectors involving %0A and %0C, due to an incomplete fix for CVE-2019-12840. Public references describe this as a remote command execution vu...
CVE-2020-26284: Improper Neutralization of Special Elements used in an OS Command
Hugo is a fast and Flexible Static Site Generator built in Go. Hugo depends on Go's os/exec for certain features, e.g. for rendering of Pandoc documents if these binaries are found in the system %PATH% on Windows. In Hugo before version 0.79.1, if a malicious file with the same name exe or bat is...
CVE-2020-35606: Improper Neutralization of Special Elements used in an OS Command
Arbitrary command execution can occur in Webmin through 1.962. Any user authorized for the Package Updates module can execute arbitrary commands with root privileges via vectors involving %0A and %0C. NOTE: this issue exists because of an incomplete fix for CVE-2019-12840...
PT-2020-17359
Name of the Vulnerable Software and Affected Versions Webmin versions prior to 1.963 Description Arbitrary command execution can occur due to an incomplete fix for a previous issue. This allows any user authorized for the Package Updates module to execute arbitrary commands with root privileges v...
CVE-2020-25494
Xinuos formerly SCO Openserver v5 and v6 allows attackers to execute arbitrary commands via shell metacharacters in outputform or toclevels parameter to cgi-bin/printbook...
CVE-2020-25494
CVE-2020-25494 affects Xinuos OpenServer v5/v6. The vulnerability is in the CGI component cgi-bin/printbook (parameters outputform and toclevels), enabling shell metacharacter input and arbitrary command execution. Exploitation details in public sources confirm OS command injection with remote, u...
Xinuos Openserver Parameter Injection Vulnerability
Xinuos Openserver is a FreeBSD-based operating system from the US company Xinuos. A security vulnerability exists in Xinuos formerly SCO Openserver versions v5 and v6 that allows an attacker to execute arbitrary commands to the cgi-bin printbook via the shell metacharacter outputform or toclevels...
PT-2020-15254
Name of the Vulnerable Software and Affected Versions zzzphp version 1.7.2 Description The issue is related to an eval injection vulnerability in the parserCommom method within the ParserTemplate class in zzz template.php. This vulnerability allows remote attackers to execute arbitrary commands...
Vulnerabilities fixed in Brocade Fabric OS
Broadcom has released updates to fix vulnerabilities in Brocade Fabric OS. An authenticated malicious person without the proper LDAP group memberships could log into a switch as a regular user. The switch is only vulnerable to this to this when it is active in "Virtual Fabric" mode. Also, a local...
