CVE-2018-1640: Improper Input Validation

IBM Security Privileged Identity Manager Virtual Appliance 2.2.1 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary commands on the system. IBM X-Force I...

PT-2019-2519

Name of the Vulnerable Software and Affected Versions D-Link DSL-3782 version 1.01 Description The issue is related to insufficient argument validation in the Acl.asp component of the D-Link DSL-3782 router's microprogram, which can be exploited by a remote attacker to execute arbitrary commands...

CVE-2019-1754

A vulnerability in the authorization subsystem of Cisco IOS XE Software could allow an authenticated but unprivileged level 1, remote attacker to run privileged Cisco IOS commands by using the web UI. The vulnerability is due to improper validation of user privileges of web UI users. An attacker...

Phoenix Contact RAD-80211-XD/HP-BUS and Phoenix Contact RAD-80211-XD Command Injection Vulnerability

The Phoenix Contact RAD-80211-XD/HP-BUS and Phoenix Contact RAD-80211-XD are both high power WLAN wireless transceivers from Phoenix Contact, Germany. A command injection vulnerability exists in the PHOENIX CONTACT RAD-80211-XD and RAD-80211-XD/HP-BUS, which can be exploited by an attacker to...

PT-2019-9888

Name of the Vulnerable Software and Affected Versions ADTRAN PMAA versions 1.6.2-1 through 1.6.4 Description An issue was discovered that allows unprivileged users to create privileged users and execute arbitrary commands. This is achieved through the use of the diagnostic-profile over RESTCONF,...

openSUSE Security Update : containerd / docker and go (openSUSE-2019-1044)

This update for containerd, docker and go fixes the following issues : containerd and docker : - Add backport for building containerd bsc1102522, bsc1113313 - Upgrade to containerd v1.1.2, which is required for Docker v18.06.1-ce. bsc1102522 - Enable seccomp support fate325877 - Update to...

CVE-2018-19648: Improper Privilege Management

An issue was discovered in ADTRAN PMAA 1.6.2-1, 1.6.3, and 1.6.4. NETCONF Access Management NACM allows unprivileged users to create privileged users and execute arbitrary commands via the use of the diagnostic-profile over RESTCONF...

CVE-2019-10061

utils/find-opencv.js in node-opencv aka OpenCV bindings for Node.js prior to 6.1.0 is vulnerable to Command Injection. It does not validate user input allowing attackers to execute arbitrary commands...

Vdsm Arbitrary Command Execution Vulnerability

oVirt Virtual Desktop Server Manager vdsm is a virtual machine host manager for managing virtual machines running KVM hypervisor technology. The product is capable of managing virtual host storage, memory, and network resources, among other things, and supports the creation of virtual hosts. A...

CVE-2019-3831

CVE-2019-3831 affects vdsm, versions 4.19–4.30.3 and 4.30.5–4.30.8. The vulnerability arises from the systemd_run function exposed to the vdsm system user, which could be abused to execute arbitrary commands as root. The provided documents do not specify exploit details beyond this or a concrete ...

PHP Thumb Fltr Parameter Command Injection

A command injection vulnerability exists in a PHPThumb phpThumb fltr parameter. A remote, authenticated attacker can exploit this vulnerability by sending crafted requests to phpThumb web page. Successful exploitation will result in arbitrary command execution...

CVE-2019-3831: Incorrect Authorization

A vulnerability was discovered in vdsm, version 4.19 through 4.30.3 and 4.30.5 through 4.30.8. The systemdrun function exposed to the vdsm system user could be abused to execute arbitrary commands as root...

Arbitrary Command Execution

donfig is vulnerable to arbitrary command execution. The collectyaml function in configobj.py does not prevent the loading of unsafe .yaml files provided by the user or by third-party packages, allowing for arbitrary code execution...

Cisco Nexus Command Execution

The vulnerability of the command-line interface of the Cisco Nexus Operating System is related to insufficient checking of arguments passed in commands. Exploiting this vulnerability allows a local attacker to execute arbitrary commands...

Cisco Nexus Command Execution

The vulnerability of the command-line interface of the Cisco Nexus Operating System is related to insufficient checking of arguments passed in commands. Exploiting this vulnerability allows a local attacker to execute arbitrary commands...

Cisco NX-OS Command Execution

The vulnerability of the command-line interface implementation in Cisco NX-OS network operating systems for Cisco Nexus 9000 series routers is related to deficiencies in access control for certain functions. Exploiting this vulnerability can allow an attacker to execute arbitrary commands...

CVE-2019-7537

An issue was discovered in Donfig 0.3.0. There is a vulnerability in the collectyaml method in configobj.py. It can execute arbitrary Python commands, resulting in command execution...

CVE-2019-5490

Certain versions between 2.x to 5.x refer to advisory of the NetApp Service Processor firmware were shipped with a default account enabled that could allow unauthorized arbitrary command execution. Any platform listed in the advisory Impact section may be affected and should be upgraded to a fixe...

CUJO Smart Firewall Injection Vulnerability

CUJO Smart Firewall is a home smart firewall device from CUJO USA. An injection vulnerability exists in the configuration of the DHCP daemon in CUJO Smart Firewall using firmware version 7003. An attacker can exploit this vulnerability to execute arbitrary system commands...

CVE-2019-5490: Initialization of a Resource with an Insecure Default

Certain versions between 2.x to 5.x refer to advisory of the NetApp Service Processor firmware were shipped with a default account enabled that could allow unauthorized arbitrary command execution. Any platform listed in the advisory Impact section may be affected and should be upgraded to a fixe...