Authentication flaw

A vulnerability in the web-based management interface of the Cisco RV110W Wireless-N VPN Firewall, RV130 VPN Router, RV130W Wireless-N Multifunction VPN Router, and RV215W Wireless-N VPN Router could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary commands...

CVE-2020-3388

CVE-2020-3388 (Cisco SD-WAN vManage) involves an authenticated, local CLI input-validation flaw that allows command injection with root privileges. Affected: Cisco SD-WAN vManage Software CLI. Root cause: insufficient input validation enabling crafted CLI input to execute arbitrary commands as ro...

CVE-2020-3380 Cisco Data Center Network Manager Privilege Escalation Vulnerability

A vulnerability in the CLI of Cisco Data Center Network Manager DCNM could allow an authenticated, local attacker to elevate privileges to root and execute arbitrary commands on the underlying operating system. The vulnerability is due to insufficient restrictions during the execution of an...

CVE-2020-3380 Cisco Data Center Network Manager Privilege Escalation Vulnerability

A vulnerability in the CLI of Cisco Data Center Network Manager DCNM could allow an authenticated, local attacker to elevate privileges to root and execute arbitrary commands on the underlying operating system. The vulnerability is due to insufficient restrictions during the execution of an...

CVE-2020-3144

CVE-2020-3144 affects Cisco RV110W, RV130, RV130W, and RV215W routers. The web-based management interface is vulnerable to an unauthenticated, remote attacker bypassing authentication due to improper session management, enabling execution of arbitrary commands with administrative privileges via a...

CVE-2020-11978

An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow which would allow any authenticated user to run arbitrary commands as the user running airflow worker/scheduler depending o...

Cisco Small Business RV110W, RV130, RV130W, and RV215W Series Routers Command Shell Injection Vulnerability

A vulnerability in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Series Routers could allow an authenticated, remote attacker to inject arbitrary shell commands that are executed by an affected device. The vulnerability is due to insufficient input...

Cisco Data Center Network Manager Privilege Escalation Vulnerability

A vulnerability in the CLI of Cisco Data Center Network Manager DCNM could allow an authenticated, local attacker to elevate privileges to root and execute arbitrary commands on the underlying operating system. The vulnerability is due to insufficient restrictions during the execution of an...

Exploit for OS Command Injection in Gpononu 1Ge_Router_Wifi_Onu_V2801Rw_Firmware

A proof of concept for CVE-2020-8958 written in Python. The scri...

Security Advisory - Two Vulnerabilities in SaltStack Salt

An authentication bypass vulnerability was discovered in SaltStack Salt. An attacker may exploit the vulnerability to retrieve user tokens from the salt master and/or run arbitrary commands on salt minions. Vulnerability ID: HWPSIRT-2020-05592 This vulnerability has been assigned a Common...

CVE-2020-10987

The goform/setUsbUnload endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute arbitrary system commands via the deviceName POST parameter...

Command Execution Vulnerability in AmarBCR of Shanghai Anshuo Information Technology Co.

AmarBCR is a big data correlation risk monitoring system developed by Shanghai Anshuo Information Technology Co. AmarBCR of Shanghai Anshuo Information Technology Co. Ltd. suffers from a command execution vulnerability that can be exploited by an attacker to execute arbitrary commands...

Joomla J2 Jobs SQL Injection

An SQL injection vulnerability exists in Joomla J2 Jobs. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary SQL commands on the affected system...

CVE-2020-8197

Privilege escalation vulnerability on Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 allows a low privileged user with management access to execute arbitrary commands...

CVE-2020-8197

Privilege escalation vulnerability on Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 allows a low privileged user with management access to execute arbitrary commands...

Privilege escalation

Privilege escalation vulnerability on Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 allows a low privileged user with management access to execute arbitrary commands...

CVE-2020-8197

Privilege escalation vulnerability on Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 allows a low privileged user with management access to execute arbitrary commands...

CVE-2020-8197

CVE-2020-8197 affects Citrix ADC and Citrix Gateway (management interface). Vulnerable on versions 13.0-58.30 and earlier: 12.1-57.18, 12.0-63.21, 11.1-64.14, and 10.5-70.18. A low-privileged user with management access can execute arbitrary commands (privilege escalation). Remediation: apply fix...

CVE-2020-2034 PAN-OS: OS command injection vulnerability in GlobalProtect portal

An OS Command Injection vulnerability in the PAN-OS GlobalProtect portal allows an unauthenticated network based attacker to execute arbitrary OS commands with root privileges. An attacker requires some knowledge of the firewall to exploit this issue. This issue can not be exploited if...

Code Execution Vulnerability in Apollo at Shanghai Ctrip Business Co.

Apollo Apollo is a distributed configuration center developed by Ctrip's framework department. A code execution vulnerability exists in Apollo in Shanghai Ctrip Business Co. Ltd. that can be exploited by an attacker to execute arbitrary commands...