Tenable Appliance Arbitrary Command Execution Vulnerability

Tenable Appliance is a browser management program developed by Tenable Network Security. An arbitrary command execution vulnerability exists in Tenable Appliance versions 3.5 through 4.4.0. A remote attacker can inject arbitrary commands by manipulating the tnsappliancesessionuser parameter...

CVE-2016-6902: Undefined Security Weakness

lshell 0.9.16 allows remote authenticated users to break out of a limited shell and execute arbitrary commands...

PT-2018-07: Arbitrary Command Execution in Ipswitch WhatsUp Gold

The specialists of the Positive Research center have detected an Arbitrary Command Execution vulnerability in Ipswitch WhatsUp Gold. Vulnerability in Ipswitch WhatsUp Gold, due to TFTP server misconfiguration, allows remote attackers to execute arbitrary commands on the TFTP server, obtain access...

CVE-2017-7283

An authenticated user of Unitrends Enterprise Backup before 9.1.2 can execute arbitrary OS commands by sending a specially crafted filename to the /api/restore/download-files endpoint, related to the downloadFiles function in api/includes/restore.php...

Cisco IOS Privilege Escalation

The vulnerability in the Cisco IOS operating system exists due to the lack of measures taken to neutralize special elements used in the operating system’s commands. Exploiting this vulnerability allows a malicious actor, operating locally, to execute arbitrary commands with superuser privileges...

Dell iDRAC6 Arbitrary Command Execution Vulnerability

Dell iDRAC6 is a remote management solution on the Dell PowerEdge family of servers. An arbitrary command execution vulnerability exists in Dell iDRAC6. An attacker could exploit the vulnerability to execute arbitrary commands in the context of an affected application...

PT-2017-12133

Name of the Vulnerable Software and Affected Versions IBM API Connect version 5.0.6.0 Description The issue is caused by improper validation of URLs for the Developer Portal, allowing a remote attacker to execute arbitrary commands on the system. By crafting a malicious URL, an attacker could...

PT-2017-2028

Name of the Vulnerable Software and Affected Versions Citrix NetScaler Gateway versions 10.1 through 10.1 before 135.8/135.12 Citrix NetScaler Gateway versions 10.5 through 10.5 before 65.11 Citrix NetScaler Gateway versions 11.0 through 11.0 before 70.12 Citrix NetScaler Gateway versions 11.1...

Arbitrary Command Execution

Salt is vulnerable to command execution. If the pillar content given to cmd.run is not coming from a trusted source, attackers could execute commands on command line...

WN-G300R3 vulnerable to OS command injection

Overview WN-G300R3 provided by I-O DATA DEVICE, INC. contain an OS command injection vulnerability. Taizoh Tsukamoto of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact A...

CVE-2017-7647: Undefined Security Weakness

SolarWinds Log & Event Manager LEM before 6.3.1 Hotfix 4 allows an authenticated user to execute arbitrary commands...

CVE-2017-6606: Improper Neutralization of Special Elements used in an OS Command

A vulnerability in a startup script of Cisco IOS XE Software could allow an unauthenticated attacker with physical access to the targeted system to execute arbitrary commands on the underlying operating system with the privileges of the root user. More Information: CSCuz06639 CSCuz42122. Known...

CVE-2017-6884: Improper Neutralization of Special Elements used in an OS Command

A command injection vulnerability was discovered on the Zyxel EMG2926 home router with firmware V1.00AAQT.4b8. The vulnerability is located in the diagnostic tools, specifically the nslookup function. A malicious user may exploit numerous vectors to execute arbitrary commands on the router, such ...

SCADA engine BACnetOPCServer suffers from dll hijacking vulnerability

SCADA system is a data acquisition and monitoring control system. bacnetOPCServer is the server software for the SCADA engine. The BACnetOPCServer software's BACnSvrTest.exe component is vulnerable to DLL hijacking due to insecure loading of library files, which can be used to maliciously load a...

Arbitrary Command Execution Vulnerability in Omnicom's AuteGate Security Gateway

AuteGate is a virtual security gateway product. An arbitrary command execution vulnerability exists in the AuteGate security gateway. An attacker can exploit this vulnerability to construct specific code, remotely execute commands, write webshells, and gain server privileges, posing information...

VMware vCenter Server BlazeDS Component Remote Code Execution Vulnerability

VMware vCenter Server is a suite of server and virtualization management software from VMware. The software provides a centralized platform for managing VMware vSphere environments, automating the implementation and delivery of virtual infrastructures. A remote code execution vulnerability exists...

PT-2017-16385

Name of the Vulnerable Software and Affected Versions SaltStack Salt versions 2015.8.13 and earlier, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2 Description The issue allows arbitrary command execution on a salt-master via Salt's ssh client. Users of Salt-API and salt-ssh could execu...

PT-2018-5036 · Red Hat +2 · Ansible +2

Name of the Vulnerable Software and Affected Versions: Ansible versions prior to 2.2.0 Description: The issue arises from improper sanitization of fact variables sent from the Ansible controller. An attacker who can create special variables on the controller may be able to execute arbitrary...

Cisco: WebEx: New Arbitrary Command Execution in 1.0.5 via Module Whitelist Bypass

In version 1.0.5 of the WebEx extension, Cisco added a GpcComponentName whitelist to prevent exploitation via XSS, preventing the issue 1096. This can be defeated by putting a module signed by Cisco under GpcUrlRoot, and tricking the installation routine to overwrite one of the whitelisted module...

CVE-2014-3582

Affected product: Apache Ambari. Affects Ambari server handling of SSL certificate generation for hosts in a cluster (versions 1.2.0–2.2.2). Root cause (as described): the CVE-2014-3582 condition may allow arbitrary system command execution on the Ambari Server host during the certificate generat...