CVE-2019-19875

CVE-2019-19875 affects B&R Industrial Automation APROL before R4.2 V7.08. The vulnerability arises from the AprolCluster script, which is invoked via sudo and executes with root privileges, allowing arbitrary commands to be injected and run. This is a different issue than CVE-2019-16364; multiple...

CVE-2019-19875

An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08. Arbitrary commands could be injected using Python scripts via the AprolCluster script that is invoked via sudo and thus executes with root privileges, a different vulnerability than CVE-2019-16364...

CVE-2019-19872

An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08. The AprolLoader could be used to inject and execute arbitrary unintended commands via an unspecified attack scenario, a different vulnerability than CVE-2019-16364...

Command injection

An issue was discovered in B&R Industrial Automation APROL before R4.2 V7.08. The AprolLoader could be used to inject and execute arbitrary unintended commands via an unspecified attack scenario, a different vulnerability than CVE-2019-16364...

Security Bulletin: A security vulnerability in Node.js jison affectsI BM Cloud Automation Manager

Summary A security vulnerability in Node.js jison affectsI BM Cloud Automation Manager Vulnerability Details CVEID: CVE-2020-8178 DESCRIPTION: Node.js jison could allow a remote attacker to execute arbitrary commands on the system, caused by insufficient input validation. By sending a specially...

Security Bulletin: IBM Cloud Pak for Security (CP4S) is potentially vulnerable to CVS injection (CVE-2020-4627)

Summary IBM Cloud Pak for Security CP4S potentially vulnerable to CVS Injection due to improper data sanitization. The issue has been addressed. Vulnerability Details CVEID: CVE-2020-4627 DESCRIPTION: IBM Cloud Pak for Security CP4S potentially vulnerable to CVS Injection. A remote attacker could...

ASUS TM-AC1900 Command Injection

A command injection vulnerability exists in ASUS TM-AC1900. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

OpenMediaVault rpc.php Authenticated PHP Code Injection

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'OpenMediaVault rpc.php Authenticated PHP Code Injection', 'Description' = %q This module exploits an authenticated PHP code injection vulnerabili...

RAD SecFlow-1v Cross Site Request Forgery (CVE-2020-13259)

A cross site request forgery vulnerability exists in RAD SecFlow-1v. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

IBM Cloud Pak for Security 注入漏洞

IBM Cloud Pak System is a full-stack, converged infrastructure with configurable, pre-integrated software from IBM USA. The product supports deploying, managing and moving application environments across hybrid clouds. An injection vulnerability exists in IBM Cloud Pak for Security, which is caus...

Vulnerabilities in VMware products

There is a vulnerability in a number of VMware products. The vulnerability allows a malicious person with access to the administrative configurator on port 8443 and valid admin credentials for this remote configurator to execute arbitrary commands with elevated privileges to execute arbitrary...

Winston Command Injection (CVE-2020-16257)

A command injection vulnerability exists in Winston. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

Rebar3 Command Injection (CVE-2020-13802)

A command injection vulnerability exists in Rebar3. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

Apache Struts 2.x < 2.3.1.1 Multiple Vulnerabilities

The version of Apache Struts running on the remote host is prior to 2.3.1.1. It, therefore, affected by multiple vulnerabilities: - The CookieInterceptor component in Apache Struts before 2.3.1.1 does not use the parameter-name whitelist, which allows remote attackers to execute arbitrary command...

CVE-2020-11830

QualityProtect has a vulnerability to execute arbitrary system commands, affected product is com.oppo.qualityprotect V2.0...

Cisco Secure Web Appliance Elevation of Privilege Vulnerability

Cisco AsyncOS is an operating system for Cisco devices from Cisco USA. Cisco AsyncOS for the Cisco Secure Web Appliance suffers from an operating system command injection vulnerability that stems from insufficient validation of user-supplied web interface and CLI input. The vulnerability can be...

OPPO Oppo QualityProtect Security Breach

OPPO Oppo QualityProtect is a security protection service for devices from OPPO Guangdong Mobile Communications OPPO, China. A security vulnerability exists in com.oppo.qualityprotect version 2.0, which stems from a vulnerability in QualityProtect to execute arbitrary system commands...

Code Injection in jadonk/bonescript

Overview BoneScript is a node.js library for physical computing on embedded Linux, starting with support for BeagleBone. Affected versions of this package are vulnerable to Command Injection. It is possible to inject arbitrary commands by using a semicolon char in the setDate function. Proof of...

CVE-2020-28581

A command injection vulnerability in ModifyVLANItem of Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an authenticated, remote attacker to send specially crafted HTTP messages and execute arbitrary OS commands with elevated privileges...

CVE-2020-3586

A vulnerability in the web-based management interface of Cisco DNA Spaces Connector could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected device. The vulnerability is due to insufficient validation of user-supplied input in the web-based management interface...