11790 matches found
cgi_test.cgi Arbitrary Command Execution
The vulnerability in cgitest.cgi of the built-in microprogramming software for AirLive BU-3026, AirLive BU-2015, and AirLive MD-3025 exists due to the failure to take measures to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a malicious...
Toshiba HEM-GW16A Router Command Execution
The vulnerability of the built-in microprogramming software in Toshiba HEM-GW16A and Toshiba HEM-GW26A home routers exists due to the failure to take measures to neutralize the special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execut...
CVE-2015-3431: Improper Neutralization of Special Elements used in an OS Command
Pydio formerly AjaXplorer before 6.0.7 allows remote attackers to execute arbitrary commands via unspecified vectors, aka "Pydio OS Command Injection Vulnerabilities."...
PT-2017-3110
Name of the Vulnerable Software and Affected Versions MobaXterm version 10.4 Description The issue is related to the TELNET service in MobaXterm, which does not require authentication. This allows remote attackers to execute arbitrary commands via TCP port 23. The lack of authentication procedure...
PT-2017-3934
Name of the Vulnerable Software and Affected Versions Evince versions prior to 3.25.91 Description The issue is related to command injection in Evince when printing to PDF, specifically due to inadequate handling of special elements in filenames. This could allow an attacker to execute arbitrary...
[ASA-201709-11] newsbeuter: arbitrary command execution
Arch Linux Security Advisory ASA-201709-11 ========================================== Severity: High Date : 2017-09-16 CVE-ID : CVE-2017-12904 CVE-2017-14500 Package : newsbeuter Type : arbitrary command execution Remote : Yes Link : https://security.archlinux.org/AVG-401 Summary ======= The...
Alienvault OSSIM av-centerd Util.pm sync_rserver Command Execution
require 'msf/core' class MetasploitModule 'Alienvault OSSIM av-centerd Util.pm syncrserver Command Execution', 'Description' = %q This module exploits a command injection vulnerability found within the syncrserver function in Util.pm. The vulnerability is triggered due to an incomplete blacklist...
Alienvault OSSIM av-centerd Util.pm sync_rserver - Command Execution Exploit
Exploit for linux platform in category remote exploits require 'msf/core' class MetasploitModule 'Alienvault OSSIM av-centerd Util.pm syncrserver Command Execution', 'Description' = %q This module exploits a command injection vulnerability found within the syncrserver function in Util.pm. The...
Surveillance Station Network Storage Unauthorized Access Command Execution
The vulnerability of the Surveillance Station network storage component of QNAP TS212P is related to deficiencies in access control for device functions. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to the device and execute arbitrary commands...
CVE-2017-6796: Improper Neutralization of Special Elements used in an OS Command
A vulnerability in the USB-modem code of Cisco IOS XE Software running on Cisco ASR 920 Series Aggregation Services Routers could allow an authenticated, local attacker to inject and execute arbitrary commands on the underlying operating system of an affected device. The vulnerability is due to...
UBUNTU-CVE-2015-0853
svn-workbench 1.6.2 and earlier on a system with xeyes installed allows local users to execute arbitrary commands by using the "Command Shell" menu item while in the directory trunk/$xeyes...
Cisco IOS XE Software for Cisco ASR 920 Series Routers Arbitrary Command Execution Vulnerability
A vulnerability in the USB-modem code of Cisco IOS XE Software running on Cisco ASR 920 Series Aggregation Services Routers could allow an authenticated, local attacker to inject and execute arbitrary commands on the underlying operating system of an affected device. The vulnerability is due to...
PT-2017-6459
Name of the Vulnerable Software and Affected Versions svn-workbench versions 1.6.2 and earlier Description The issue allows local users to execute arbitrary commands. This can be achieved by using the "Command Shell" menu item while in a specific directory, namely trunk/$xeyes, on a system with...
Eyes Of Network (EON) < 5.2 Multiple Vulnerabilities
Eyes Of Network EON is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
Unauthorized Access Vulnerability in China Mobile and Routing Apps
China Mobile He-Route APP is a cell phone supporting service software for He-Route. Unauthorized access vulnerability exists in China Mobile and Router APP. By analyzing the packet grabbing of the app to get the command interface to control the router, an attacker without administrator...
Digium Asterisk Open Source and Certified Asterisk Arbitrary Command Execution Vulnerabilities
Digium Asterisk Open Source and Certified Asterisk are both open source telephone exchange PBX system software from Digium, Inc. in the United States. The software supports voicemail, multi-party voice conferencing, and interactive voice response IVR. There are security vulnerabilities in Asteris...
CVE-2017-0899: Improper Neutralization of Escape, Meta, or Control Sequences
RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications that include terminal escape characters. Printing the gem specification would execute terminal escape sequences...
Cisco Meeting Server Command Injection Vulnerability
Cisco WebEx Meetings are web conferencing solutions. Cisco Meeting Server has a security vulnerability in the CLI command parsing code that allows local attackers to exploit the vulnerability to submit a special request, inject arbitrary commands, and execute them...
CVE-2017-11610: Incorrect Default Permissions
The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisord namespace lookups...