EulerOS 2.0 SP8 : net-snmp (EulerOS-SA-2020-2155)

According to the versions of the net-snmp packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Net-SNMP through 5.7.3 has Improper Privilege Management because SNMP WRITE access to the EXTEND MIB provides the ability to run arbitrary...

OS Command Injection

ng-packagr vulnerable to OS command injection. An attacker is able to inject and execute arbitrary OS commands via the styleIncludePaths option...

Microsoft SQL Server Reporting Services 2016 ViewState deserialization vulnerability

Added: 09/25/2020 CVE: CVE-2020-0618 Background Microsoft SQL Server Reporting Services is a set of tools and services for creating, deploying, and managing mobile and paginated reports. Problem A deserialization vulnerability in Microsoft SQL Server Reporting Services 2016 allows a remote,...

Microsoft SQL Server Reporting Services 2016 ViewState deserialization vulnerability

Added: 09/25/2020 CVE: CVE-2020-0618 Background Microsoft SQL Server Reporting Services is a set of tools and services for creating, deploying, and managing mobile and paginated reports. Problem A deserialization vulnerability in Microsoft SQL Server Reporting Services 2016 allows a remote,...

Microsoft SQL Server Reporting Services 2016 ViewState deserialization vulnerability

Added: 09/25/2020 CVE: CVE-2020-0618 Background Microsoft SQL Server Reporting Services is a set of tools and services for creating, deploying, and managing mobile and paginated reports. Problem A deserialization vulnerability in Microsoft SQL Server Reporting Services 2016 allows a remote,...

Verint PTZ Camera Command Injection (CVE-2020-24057)

A command execution vulnerability exists in Verint PTZ Camera. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands as root on the affected system...

CVE-2019-15959

A vulnerability in Cisco Small Business SPA500 Series IP Phones could allow a physically proximate attacker to execute arbitrary commands on the device. The vulnerability is due to the presence of development testing and verification scripts that remained on the device. An attacker could exploit...

CVE-2019-15959

A vulnerability in Cisco Small Business SPA500 Series IP Phones could allow a physically proximate attacker to execute arbitrary commands on the device. The vulnerability is due to the presence of development testing and verification scripts that remained on the device. An attacker could exploit...

CVE-2019-15957

A vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an authenticated, remote attacker with administrative privileges to inject arbitrary commands into the underlying operating system. When processed, the commands will be executed wit...

Input validation

A vulnerability in the web-based management interface of certain Cisco Small Business RV Series Routers could allow an authenticated, remote attacker with administrative privileges to inject arbitrary commands into the underlying operating system. When processed, the commands will be executed wit...

CVE-2019-15957

CVE-2019-15957 affects Cisco Small Business RV Series Routers (RV016, RV042, RV042G, RV082, RV320, RV325). The web-based management interface fails to validate user input, allowing an authenticated admin to inject and execute arbitrary commands on the device with root privileges. Affected firmwar...

CVE-2019-15959 Cisco Small Business SPA500 Series IP Phones Local Script Execution Vulnerability

A vulnerability in Cisco Small Business SPA500 Series IP Phones could allow a physically proximate attacker to execute arbitrary commands on the device. The vulnerability is due to the presence of development testing and verification scripts that remained on the device. An attacker could exploit...

Geniusocean News SQL Injection (CVE-2017-15981; CVE-2017-15982)

An SQL injection vulnerability exists in Geniusocean News. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary SQL commands on the affected system...

PT-2020-15505 · Jenkins · Jenkins Selection Tasks Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Selection tasks Plugin version 1.0 and earlier Description: The issue allows attackers with Job/Configure permission to execute an arbitrary system command on the Jenkins controller as the OS user that the Jenkins process is running a...

Mida Solutions eFramework ajaxreq.php Command Injection

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Mida Solutions eFramework ajaxreq.php Command Injection', 'Description' = %q This module exploits a command injection vulnerability in Mida...

Palo Alto Networks PAN-OS Command Injection Vulnerability

Palo Alto Networks PAN-OS is a set of operating systems developed for its firewall appliances. An OS command injection vulnerability exists in the Palo Alto Networks PAN-OS management interface that could be exploited by an attacker to execute arbitrary operating system commands...

Cisco Small Business RV340 Command Injection Vulnerability

The Cisco Small Business RV340 is a set of Cisco router devices. A command injection vulnerability exists in the Cisco Small Business RV340 WEB interface, which can be exploited by an authenticated, remote attacker to execute arbitrary commands on the affected device...

Zyxel VMG5313-B30B shell command injection vulnerability

The Zyxel VMG5313-B30B is a router device. A security vulnerability exists in the Zyxel VMG5313-B30B, which can be exploited by remote attackers to submit a special request that can be injected with arbitrary SHELL commands and executed...

CVE-2020-25287

Pligg 2.0.3 allows remote authenticated users to execute arbitrary commands because the template editor can edit any file, as demonstrated by an admin/admineditor.php thefile=..%2Findex.php&open=Open request...

Design/Logic Flaw

Pligg 2.0.3 allows remote authenticated users to execute arbitrary commands because the template editor can edit any file, as demonstrated by an admin/admineditor.php thefile=..%2Findex.php&open=Open request...