CVE-2021-1487

A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Evolved Programmable Network EPN Manager could allow an authenticated, remote attacker to execute arbitrary commands on an affected system. The vulnerability is due to insufficient validation of user-supplied...

mariadb: writable system variables allows a database user with SUPER privilege to execute arbitrary code as the system mysql user

A vulnerability was found in mariadb and in the mysql wsrep patch that allows remote code execution. A user with SUPER privileges could execute arbitrary shell commands in the context of the mariadb server process...

The vulnerability in the web interface for managing microprogrammed software on Cisco Small Business 100, 300, 500 Series Wireless Access Points allows a attacker to obtain confidential information or execute arbitrary commands.

The vulnerability of the web-based management interface for Cisco Small Business 100, 300, 500 Series Wireless Access Points relates to the lack of measures taken to neutralize special elements used in the operating system teams. Exploiting this vulnerability can allow a remote attacker to obtain...

The vulnerability of the web interface of the Cisco HyperFlex virtual machine installer allows a attacker to execute arbitrary commands on the target system with root user privileges.

The vulnerability of the Cisco HyperFlex virtual machine installer’s web interface is related to the lack of measures taken to neutralize special elements used in operating system teams. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands on the target system with...

The vulnerability of Cisco Enterprise NFV Infrastructure Software (NFVIS) lies in the lack of measures to neutralize special elements used in operating system commands, allowing attackers to execute arbitrary commands with root privileges.

The vulnerability of Cisco Enterprise NFV Infrastructure Software NFVIS is related to the lack of measures taken to neutralize special elements used in operating system commands. Exploiting this vulnerability allows an attacker to execute arbitrary commands with root privileges...

Cisco Prime Infrastructure 操作系统命令注入漏洞

Cisco Prime Infrastructure is a software application from Cisco USA. It is used to simplify the management of wireless and wired networks. An operating system command injection vulnerability exists in Cisco Prime Infrastructure and Evolved Programmable Network EPN Manager, which can be exploited ...

The vulnerability in the web interface for controlling the Cisco HyperFlex data platform allows a attacker to execute arbitrary commands on the target system with user-level privileges on the Tomcat8 server.

The vulnerability of the Cisco HyperFlex data platform’s web management interface relates to the lack of measures taken to neutralize special elements used in operating system teams. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands on the target system with...

The vulnerability of the messaging service provided by the microprogramming software for Cisco RV340, RV340W, RV345, and RV345P allows a hacker to execute arbitrary commands with root privileges.

The vulnerability of the message exchange service provided by the microprogramming software for Cisco RV340, RV340W, RV345, and RV345P routers is related to the execution of operations outside the buffer boundaries. Exploiting this vulnerability could allow an attacker to execute arbitrary comman...

CVE-2021-32305

WebSVN before 2.6.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the search parameter...

Code injection

WebSVN before 2.6.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the search parameter...

Projectworlds Online Book Store SQL Injection (CVE-2020-19114)

An SQL injection vulnerability exists in Projectworlds Online Book Store . Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system...

CVE-2020-36198

A command injection vulnerability has been reported to affect certain versions of Malware Remover. If exploited, this vulnerability allows remote attackers to execute arbitrary commands. This issue affects: QNAP Systems Inc. Malware Remover versions prior to 4.6.1.0. This issue does not affect:...

Command injection

A command injection vulnerability has been reported to affect certain versions of Malware Remover. If exploited, this vulnerability allows remote attackers to execute arbitrary commands. This issue affects: QNAP Systems Inc. Malware Remover versions prior to 4.6.1.0. This issue does not affect:...

Qnap Systems Malware Remover 操作系统命令注入漏洞

Qnap Systems Malware Remover is an application from the Chinese company Qnap Systems. A malware removal tool. An operating system command injection vulnerability exists in Qnap Systems Malware Remover prior to version 4.6.1.0. A remote attacker could exploit this vulnerability to execute arbitrar...

Cisco HyperFlex HX Command Injection Vulnerabilities (cisco-sa-hyperflex-rce-TjjNrkpR)

The version of Cisco HyperFlex HX installed on the remote host is affected by multiple command injection vulnerabilities. An unauthenticated, remote attacker can exploit these to execute arbitrary commands on an affected system. Note that Nessus has not tested for this issue but has instead relie...

Cross-site Scripting (XSS) - Reflected in falconchristmas/fpp

✍️ Description FalconChristmas/fpp suffer from a XSS vulnerability. In https://github.com/FalconChristmas/fpp/blob/master/www/playlists.phpL15 we see : php var initialPlaylist = ""; XSS is possible because the playlist variable isn't sanitized before reflection in the webpage. 🕵️‍♂️ Proof of...

Remote Code Execution (RCE)

pomelo-monitor is vulnerable to remote code execution. An attacker is able to inject and execute arbitrary commands through pomelo-monitor parameter...

AMD Secure Encrypted Virtualization 命令注入漏洞

AMD Secure Encrypted Virtualization is a software application from AMD USA. Hardware-accelerated memory encryption to protect data in use. AMD Secure Encrypted Virtualization suffers from a command injection vulnerability that can be exploited by an attacker to execute arbitrary commands...

Input validation

On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.3, 14.1.x before 14.1.4, and 13.1.x before 13.1.4, lack of input validation for items used in the system support functionality may allow users granted either "Resource Administrator" or "Administrator" roles to execute arbitrary bash...

Vtiger SQL Injection (CVE-2020-22807)

An SQL injection vulnerability exists in Vtiger. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system...