CVE-2020-2261

Jenkins Perfecto Plugin 1.17 and earlier executes a command on the Jenkins controller, allowing attackers with Job/Configure permission to run arbitrary commands on the Jenkins controller...

CVE-2020-2261

Jenkins Perfecto Plugin 1.17 and earlier executes a command on the Jenkins controller, allowing attackers with Job/Configure permission to run arbitrary commands on the Jenkins controller...

CVE-2020-2261

Jenkins Perfecto Plugin 1.17 and earlier executes a command on the Jenkins controller, allowing attackers with Job/Configure permission to run arbitrary commands on the Jenkins controller...

CVE-2020-25287: Unrestricted Upload of File with Dangerous Type

Pligg 2.0.3 allows remote authenticated users to execute arbitrary commands because the template editor can edit any file, as demonstrated by an admin/admineditor.php thefile=..%2Findex.php&open=Open request...

Command Injection in wizard-syncronizer

All versions of wizard-syncronizer are vulnerable to Command Injection. The package does not validate input on the cloneAndSync function and concatenates it to an exec call. This can be abused through a malicious widget containing the payload in the gitURL value or through a MITM attack since the...

PT-2020-21361

Name of the Vulnerable Software and Affected Versions wxchangba versions affected versions not specified Description The issue concerns a Command Injection problem. It arises because the package fails to validate user input on the reqPostMaterial function. Specifically, the contents of the file...

CVE-2020-10050

SIMATIC RTLS Locating Manager (Siemens) versions prior to 2.10.2 are affected by CVE-2020-10050. The vulnerability arises from the directory of service executables, enabling a local attacker to include arbitrary commands that execute with SYSTEM privileges on system restart. Impact is local privi...

Siemens SIMATIC RTLS Locating Manager Elevation of Privilege Vulnerability

SIMATIC RTLS is a real-time wireless positioning system for locating solutions.Siemens SIMATIC RTLS Locating Manager is used for the configuration, operation and maintenance of SIMATIC RTLS installations. An elevation of privilege vulnerability exists in Siemens SIMATIC RTLS Locating Manager. An...

Siemens SIMATIC RTLS Locating Manager Elevation of Privilege Vulnerability (CNVD-2020-51249)

SIMATIC RTLS is a real-time wireless positioning system for locating solutions.Siemens SIMATIC RTLS Locating Manager is used for the configuration, operation and maintenance of SIMATIC RTLS installations. An elevation of privilege vulnerability exists in Siemens SIMATIC RTLS Locating Manager. An...

CVE-2020-10051: Unquoted Search Path or Element

A vulnerability has been identified in SIMATIC RTLS Locating Manager All versions V2.10.2. Multiple services of the affected application are executed with SYSTEM privileges while the call path is not quoted. This could allow a local attacker to inject arbitrary commands that are execeuted instead...

CVE-2020-10049: Incorrect Default Permissions

A vulnerability has been identified in SIMATIC RTLS Locating Manager All versions V2.10.2. The start-stop scripts for the services of the affected application could allow a local attacker to include arbitrary commands that are executed when services are started or stopped interactively by system...

CVE-2020-10050: Incorrect Default Permissions

A vulnerability has been identified in SIMATIC RTLS Locating Manager All versions V2.10.2. The directory of service executables of the affected application could allow a local attacker to include arbitrary commands that are executed with SYSTEM privileges when the system restarts...

CVE-2020-24986

Concrete5 (CMS) up to and including 8.5.2 is vulnerable to an Unrestricted Upload of a dangerous file type (e.g., .php) via the File Manager, enabling execution of arbitrary commands. Affected: Concrete5 8.5.2 and earlier. Root cause: file-type upload not sufficiently restricted. Impact: potentia...

CVE-2020-3451

Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV340 Series Routers could allow an authenticated, remote attacker with administrative credentials to execute arbitrary commands on the underlying operating system OS as a restricted user. For more information...

PT-2020-15877

Name of the Vulnerable Software and Affected Versions Concrete5 versions up to and including 8.5.2 Description The issue allows for the unrestricted upload of files with dangerous types, such as .php files, via the File Manager. This can be achieved by modifying the site configuration to upload t...

PT-2020-21025

Name of the Vulnerable Software and Affected Versions addax versions prior to 1.1.0 Description The issue concerns a Command Injection problem. It arises because the package does not validate user input on the presignPath function, which receives input directly from an API endpoint. To exploit th...

PT-2020-21583

Name of the Vulnerable Software and Affected Versions rpc-websocket versions 0.7.6 and later Description The issue concerns malicious code in the rpc-websocket package that opens a backdoor to a remote server, allowing the execution of arbitrary commands. This effectively turns the package into a...

PT-2020-21544

Name of the Vulnerable Software and Affected Versions local-devices versions prior to 3.0.0 Description The issue concerns Command Injection due to a lack of input validation on IP addresses, which are concatenated to an exec call. This allows attackers to execute arbitrary commands in the system...

PT-2020-21419

Name of the Vulnerable Software and Affected Versions expressfs versions all versions Description The issue concerns a lack of validation for user input on several API endpoints, allowing attackers to execute arbitrary commands in the system. The affected endpoints include expressfs.appendFile,...

D-Link DCS-2530L and DCS-2670L Command Injection Vulnerability

The DCS-2530L and DCS-2670L are Full HD 180-degree Wi-Fi cameras from D-Link. A command injection vulnerability exists in cgi-bin/ddnsenc.cgi in the D-Link DCS-2530L and DCS-2670L. The vulnerability stems from a network system or product not properly filtering specific elements of externally...