Arbitrary Command Execution

spamassassin is vulnerable to command execution. The vulnerability exists as crafted nefarious Configuration .cf files can be configured to run system commands similar to CVE-2018-11805...

PT-2020-5338

Name of the Vulnerable Software and Affected Versions D-Link DSR-250 version 3.17 D-Link DSR-150 affected versions not specified D-Link DSR-150N affected versions not specified D-Link DSR-250N affected versions not specified D-Link DSR-500 affected versions not specified D-Link DSR-500N affected...

CVE-2020-5609

Directory traversal vulnerability in CAMS for HIS CENTUM CS 3000 includes CENTUM CS 3000 Small R3.08.10 to R3.09.50, CENTUM VP includes CENTUM VP Small, Basic R4.01.00 to R6.07.00, B/M9000CS R5.04.01 to R5.05.01, and B/M9000 VP R6.01.01 to R8.03.01 allows a remote unauthenticated attacker to crea...

CVE-2020-5609: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in CAMS for HIS CENTUM CS 3000 includes CENTUM CS 3000 Small R3.08.10 to R3.09.50, CENTUM VP includes CENTUM VP Small, Basic R4.01.00 to R6.07.00, B/M9000CS R5.04.01 to R5.05.01, and B/M9000 VP R6.01.01 to R8.03.01 allows a remote unauthenticated attacker to crea...

PT-2020-10164

Name of the Vulnerable Software and Affected Versions Wowza Streaming Engine versions prior to 4.8.5 Description The issue concerns insecure permissions in the Linux version of the server, potentially allowing a local attacker to escalate privileges by writing arbitrary commands in any file and...

CVE-2020-14487: Hidden Functionality

OpenClinic GA 5.09.02 contains a hidden default user account that may be accessed if an administrator has not expressly turned off this account, which may allow an attacker to login and execute arbitrary commands...

CVE-2020-14493: Execution with Unnecessary Privileges

A low-privilege user may use SQL syntax to write arbitrary files to the OpenClinic GA 5.09.02 and 5.89.05b server, which may allow the execution of arbitrary commands...

PT-2020-19721

Name of the Vulnerable Software and Affected Versions Gerapy versions 0 through 0.9.3 Description The issue arises from unsanitized input being passed to Popen via the "project configure" endpoint. Recommendations For Gerapy versions 0 through 0.9.3, update to version 0.9.3 or later to resolve th...

PT-2020-14035

Name of the Vulnerable Software and Affected Versions OpenClinic GA version 5.09.02 Description The issue concerns a hidden default user account in OpenClinic GA. If an administrator has not explicitly disabled this account, it may be accessed by an attacker, potentially allowing them to log in a...

Nagios XI Arbitrary Command Execution Vulnerability (CNVD-2020-64267)

Nagios XI is a suite of IT infrastructure monitoring solutions from the US-based Nagios. The solution supports monitoring and alerting of applications, services, operating systems and more. An arbitrary command execution vulnerability exists in the ajaxhelper.php file in Nagios XI versions prior ...

Grandstream GWN7000 Arbitrary OS Command Execution Vulnerability

The Grandstream GWN7000 is an enterprise-class multi-WAN Gigabit VPN router. An arbitrary OS command execution vulnerability exists in the Grandstream GWN7000 version 1.0.9.4 and earlier. The vulnerability stems from the fact that the product allows an authenticated remote user to modify the...

vManage CLI Command Execution Root Privilege

The vulnerability of the command-line interface CLI of the vManage web interface for the Cisco SD-WAN network is due to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to execute arbitrary commands with root privileges...

Apache Airflow Operating System Command Injection Vulnerability

Apache Airflow is an open source platform for creating, managing and monitoring workflows. Apache Airflow suffers from an operating system command injection vulnerability that allows remote attackers to exploit the vulnerability to submit a specially crafted malicious load to execute arbitrary...

CVE-2020-5756

Grandstream GWN7000 firmware version 1.0.9.4 and below allows authenticated remote users to modify the system's crontab via undocumented API. An attacker can use this functionality to execute arbitrary OS commands on the router...

CVE-2020-3380: Improper Neutralization of Argument Delimiters in a Command

A vulnerability in the CLI of Cisco Data Center Network Manager DCNM could allow an authenticated, local attacker to elevate privileges to root and execute arbitrary commands on the underlying operating system. The vulnerability is due to insufficient restrictions during the execution of an...

Advantech WebAccess/SCADA has a Logic Flaw Vulnerability

Advantech WebAccess/SCADA is a suite of SCADA software based on a browser architecture. A logic flaw vulnerability exists in Advantech WebAccess/SCADA. The vulnerability can be exploited to gain access to modify the registry of a user's system and execute arbitrary commands on the user's system...

CVE-2020-8197: Undefined Security Weakness

Privilege escalation vulnerability on Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 allows a low privileged user with management access to execute arbitrary commands...

EthereumJ Code Issues

EthereumJ is a Java language implementation of the Ethernet protocol. A code issue vulnerability exists in the crypto/ECKey.java file's decoder.readObject and the mine/Ethash.java file's ois.readObject in EthereumJ version 1.8.2. An attacker could exploit this vulnerability to execute arbitrary...

CVE-2020-9413

The MFT Browser file transfer client and MFT Browser admin client components of TIBCO Software Inc.'s TIBCO Managed File Transfer Command Center and TIBCO Managed File Transfer Internet Server contain a vulnerability that theoretically allows an attacker to craft an URL that will execute arbitrar...

CVE-2020-9413

CVE-2020-9413 affects TIBCO Managed File Transfer Command Center (CC) and Internet Server (IS) up to version 8.2.1 and earlier. The vulnerability resides in the MFT Browser file transfer and MFT Browser admin client components, allowing an attacker to craft a URL that, when visited by an authenti...