Alcatel OpenTouch Command Injection (CVE-2020-11794)

A command injection vulnerability exists in Alcatel OpenTouch. Successful exploitation of this vulnerability would allow remote attackers to inject arbitrary commands via shell...

D-Link DIR-859 Remote Code Execution (CVE-2019-20215)

A remote code execution vulnerability exists in D-Link DIR-859. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

Sql injection

SQL injection vulnerability in the Paid Memberships versions prior to 2.3.3 allows attacker with administrator rights to execute arbitrary SQL commands via unspecified vectors...

Cisco Webex Teams Logging Feature Command Execution Vulnerability

According to its self-reported version, Cisco Webex Teams client for Windows is affected by a command execution vulnerability due to improper restrictions on software logging features. An unauthenticated, remote attacker could exploit this vulnerability by convincing a targeted user to visit a...

The vulnerability of Timelion, the virtualization service for Kibana data visualization, allows a perpetrator to execute arbitrary commands.

The vulnerability of the Timelion virtualization service for Kibana visualization data is related to insufficient control over code generation. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

CVE-2019-20798

An XSS issue was discovered in handlerserverinfo.c in Cherokee through 1.2.104. The requested URL is improperly displayed on the About page in the default configuration of the web server and its administrator panel. The XSS in the administrator panel can be used to reconfigure the server and...

Arbitrary Command Execution

targetcli is vulnerable to privilege escalation. World writable /var/run/targetclid.sock allows unprivileged user to execute arbitrary commands...

Command injection

An OS command injection vulnerability in the management server component of PAN-OS allows an authenticated user to potentially execute arbitrary commands with root privileges. This issue affects: All PAN-OS 7.1 versions; PAN-OS 8.1 versions earlier than 8.1.14; PAN-OS 9.0 versions earlier than...

CVE-2020-2007 PAN-OS: OS command injection in management server

An OS command injection vulnerability in the management server component of PAN-OS allows an authenticated user to potentially execute arbitrary commands with root privileges. This issue affects: All PAN-OS 7.1 versions; PAN-OS 8.1 versions earlier than 8.1.14; PAN-OS 9.0 versions earlier than...

curlrequest allows execution of arbitrary commands

curlrequest through 1.0.1 allows execution of arbitrary commands. It is possible to inject arbitrary commands by using a semicolon char in any of the options values...

Druva inSync inSyncCPHwnet64.exe RPC Type 5 Privilege Escalation

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Druva inSync inSyncCPHwnet64.exe RPC Type 5 Privilege Escalation', 'Description' = %q Druva inSync client for Windows exposes a network service o...

CuteNews 2.1.2 - Authenticated Arbitrary File Upload Vulnerability

Exploit for php platform in category web applications Exploit Title: CuteNews 2.1.2 - Authenticated Arbitrary File Upload Author: Vigov5 - SunCSR Team Vendor Homepage: https://cutephp.com Software Link: https://cutephp.com/click.php?cutenewslatest Version: v2.1.2 Tested on: Ubuntu 18.04 / Kali...

Druva inSync inSyncCPHwnet64.exe RPC Type 5 Privilege Escalation Exploit

Druva inSync client for Windows exposes a network service on TCP port 6064 on the local network interface. inSync versions 6.5.2 and prior do not validate user-supplied program paths in RPC type 5 messages, allowing execution of arbitrary commands as SYSTEM. This Metasploit module has been tested...

Node.js third-party modules: [gfc] Command Injection via insecure command formatting

I would like to report a Command Injection issue in the gfc module. It allows to execute arbitrary commands on the victim's PC. Module module name: gfc version: 2.0.2 npm page: https://www.npmjs.com/package/gfc Module Description Simple way to initialize a new git repository in an empty directory...

UADMIN Botnet SQL Injection

An SQL injection vulnerability exists in UADMIN botnet. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system...

SIYUCMS 5.1 suffers from a command execution vulnerability (CNVD-2020-31713)

SIYUCMS is a content management system based on ThinkPHP5 + AdminLTE. SIYUCMS 5.1 suffers from a command execution vulnerability that can be exploited by an attacker to execute arbitrary commands and gain administrative privileges on the web server...

Command Injection in forsigner/node-pngdefry

Overview Affected versions execute arbitrary commands remotely inside the victim's PC. The issue occurs because user input is formatted inside a command that will be executed without any checks...

[SECURITY] [DSA 4676-2] salt security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4676-2 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso May 07, 2020 https://www.debian.org/security/faq -...

Bolt CMS 3.7.0 - Authenticated Remote Code Execution

This module exploits multiple vulnerabilities in Bolt CMS version 3.7.0 and 3.6. in order to execute arbitrary commands as the user running Bolt. This module first takes advantage of a vulnerability that allows an authenticated user to change the username in /bolt/profile to a PHP system$GET""...

GHSA-RC77-XXQ6-4MFF Command Injection in hot-formula-parser

Versions of hot-formula-parser prior to 3.0.1 are vulnerable to Command Injection. The package fails to sanitize values passed to the parse function and concatenates it in an eval call. If a value of the formula is supplied by user-controlled input it may allow attackers to run arbitrary commands...