CVE-2012-5878

Bulb Security Smartphone Pentest Framework SPF 0.1.2 through 0.1.4 allows remote attackers to execute arbitrary commands via shell metacharacters in the hostingPath parameter to 1 SEAttack.pl or 2 CSAttack.pl in frameworkgui/ or the 3 appURLPath parameter to frameworkgui/attachMobileModem.pl...

CVE-2012-5878

CVE-2012-5878 concerns the Smartphone Pentest Framework (SPF) versions 0.1.2–0.1.4. The connected records confirm a remote OS command injection vulnerability in SPF’s web GUI, triggered by unsanitized input in the hostingPath parameter for SEAttack.pl and CSAttack.pl (frameworkgui/), and the appU...

CVE-2012-5693

Bulb Security’s Smartphone Pentest Framework (SPF) is affected by OS command injection in SPF web GUI. CVE-2012-5693 (and related CVE-2012-5878) describe that remote attackers can execute arbitrary commands by supplying shell metacharacters in various input fields (ipAddressTB, hostingPath, appUR...

Cisco Data Center Network Manager REST API SQL Injection Vulnerability

Cisco Data Center Network Manager DCNM is a suite of data center network managers from Cisco that provides multiprotocol management of the network and troubleshooting of switch operating conditions and performance. A REST API SQL injection vulnerability exists in Cisco Data Center Network Manager...

CVE-2015-5591

SQL injection vulnerability in Zenphoto before 1.4.9 allow remote administrators to execute arbitrary SQL commands...

Sql injection

SQL injection vulnerability in Zenphoto before 1.4.9 allow remote administrators to execute arbitrary SQL commands...

Cross site request forgery (csrf)

The handlerequest function in lib/HTTPServer.pm in Monitorix before 3.3.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the URI...

CVE-2019-3984

Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitized input when the device retrieves updates scripts from the internet...

Input validation

Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitized input when the device retrieves updates scripts from the internet...

CVE-2019-3984

Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitized input when the device retrieves updates scripts from the internet...

OS Command Injection

mikehaertl/php-shellcommand is vulnerable to OS command injection. The addArg function in src/Command.php does not escape all arguments, allowing an attacker to inject arbitrary OS commands...

Command Execution Vulnerability in DLINKDIR-859 Series Routers

The D-Link DIR-859 is a wireless router from AUO D-Link of Taiwan, China. A remote command execution vulnerability exists in DLINK's DIR-859 series routers, which can be exploited by an attacker to execute arbitrary commands with root privileges on the target device...

NewStart CGSL CORE 5.05 / MAIN 5.05 : ghostscript Multiple Vulnerabilities (NS-SA-2019-0250)

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has ghostscript packages installed that are affected by multiple vulnerabilities: - psi/zfile.c in Artifex Ghostscript before 9.21rc1 permits the status command even if -dSAFER is used, which might allow remote attackers to...

Cisco NX-OS Software CLI Command Injection Vulnerability (Cisco-Sa-20190306-Nxos-Cmdinj-1609)

According to its self-reported version, Cisco NX-OS Software is affected by following vulnerability - A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system of an affected device.The...

Sql injection

SQL injection vulnerability in the wpDataTables Lite Version 2.0.11 and earlier allows remote authenticated attackers to execute arbitrary SQL commands via unspecified vectors...

The vulnerability of the McAfee Advanced Threat Defense software arises from the lack of measures taken to neutralize its special elements, allowing attackers to execute arbitrary commands.

The vulnerability of the McAfee Advanced Threat Defense security tool exists due to the failure to take measures to neutralize specific elements within it. Exploiting this vulnerability allows a malicious actor, operating remotely, to execute arbitrary commands by sending specially crafted HTTP...

Security Bulletin: A vulnerability has been identified in IBM Spectrum Scale where local attacker can execute arbitrary commands on the system (CVE-2019-4664)

Summary IBM Spectrum Scale could allow local attacker to execute specially crafted request for an exploitation of the system. Fix is available for this vulnerability. Vulnerability Details CVEID: CVE-2019-4664 DESCRIPTION: IBM Spectrum Scale could allow a local attacker to execute arbitrary...

Command Execution Vulnerability in JCG Gateway Q9PRO

JCG Q9PRO is a home wireless router that supports supports WPS one-click encryption function and more with high device compatibility. A command execution vulnerability exists in the JCG Gateway Q9PRO, which can be exploited by an attacker to execute arbitrary commands...

Command Execution Vulnerability in Minicms

MiniCMS Content Management System is a popular software under Php Source Channel. A command execution vulnerability exists in Minicms, which can be exploited by an attacker to execute arbitrary commands...

The vulnerability of the xpack.security.audit.enabled component of the Kibana data visualization service allows a perpetrator to execute arbitrary commands.

The vulnerability of the xpack.security.audit.enabled component of the Kibana data visualization service is related to insufficient validation of arguments passed to commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...