Code injection

D-Link DIR-655 C devices before 3.02B05 BETA03 allow remote attackers to execute arbitrary commands via shell metacharacters in the onlinefirmwarecheck.cgi checkfwurl parameter...

CVE-2019-13561

The CVE affects D-Link DIR-655 C devices prior to version 3.02B05 BETA03, where an attacker can remotely execute arbitrary commands via shell metacharacters in the online_firmware_check.cgi check_fw_url parameter. Affected component is the firmware check URL handling in DIR-655 C; root cause is u...

The vulnerability of the configuration management system and remote execution capabilities of SaltStack Salt, related to authentication procedures’ deficiencies, allows attackers to bypass the authentication process or execute arbitrary commands.

The vulnerability of the Configuration Management system and the remote execution of operations in SaltStack Salt is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to bypass the authentication process or execute arbitrary commands...

The vulnerability of the QPID broker software used in the centralized lifecycle management software for Red Hat Satellite products allows a malicious actor to gain access to the QMF methods and execute arbitrary commands in a privileged mode.

The vulnerability of the QPID broker software used in the Red Hat Satellite product lifecycle management system is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to gain access to the QMF methods and execute arbitrary commands in privileged mode...

Cross-Site Request Forgery (CSRF)

react-dev-utils is vulnerable to cross-site request forgery. Local unauthenticated attackers could exploit the flawed Webserver component to execute arbitrary commands on the targeted system via the unsanitized input command to launch an editor...

OS Command Injection

kill-port is vulnerable to OS command injection. An attacker is able to inject arbitrary OS commands due to the usage of exec function, if the attacker is able to control the port...

Command Execution Vulnerability in Ziggy's Fortress (CNVD-2019-22668)

Zhejiang Qiji Technology Co., Ltd. is a company mainly engaged in computer hardware and software, network products, technology development and other projects. A command execution vulnerability exists in Qiji Fortress, which can be exploited by an attacker to execute arbitrary commands...

CentOS Web Panel Command Injection (CVE-2018-18322)

A command injection vulnerability exists in CentOS Web Panel. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

CVE-2019-13475

In MobaXterm 11.1, the mobaxterm: URI handler has an argument injection vulnerability that allows remote attackers to execute arbitrary commands when the user visits a specially crafted URL. Based on the available command-line arguments of the software, one can simply inject -exec to execute...

CVE-2019-13475

CVE-2019-13475 affects Mobatek MobaXterm 11.1. The vulnerability is in the mobaxterm: URI handler, enabling an argument injection that allows an attacker to execute arbitrary commands when a user visits a crafted URL. The payload can inject -exec to run commands, with -hideterm and -exitwhendone ...

Code Execution Vulnerability in AIT CMS

Hainan Zanzan Network Technology Co., Ltd. is a professional website construction, network services, operation technology output network company in the industry. AIT CMS code execution vulnerabilities, attackers can use the vulnerability to execute arbitrary commands, access to server privileges...

Code Execution Vulnerability in ThinkSNS Backend

Wise Software Beijing Co., Ltd. is committed to the wide application of SNS in various business fields, and strives to become a more comprehensive and professional software products and services provider. A code execution vulnerability exists in the backend of ThinkSNS, which allows an attacker t...

D-Link DCS-1100 and D-Link DCS-1130 Cross-Site Request Forgery Vulnerabilities (CNVD-2019-23333)

The D-Link DCS-1100 and the D-Link DCS-1130 are both network cameras from Taiwan, China-based AUO D-Link. A cross-site request forgery vulnerability exists in the D-Link DCS-1100 and DCS-1130. An attacker could exploit this vulnerability to execute arbitrary commands on the device...

Sql injection

Dynacolor FCM-MB40 v1.2.0.0 devices allow remote attackers to execute arbitrary commands via a crafted parameter to a CGI script, as demonstrated by sed injection in cgi-bin/camctrlsaveprofile.cgi save parameter and cgi-bin/ddns.cgi...

CVE-2019-13398

Dynacolor FCM-MB40 v1.2.0.0 devices allow remote attackers to execute arbitrary commands via a crafted parameter to a CGI script, as demonstrated by sed injection in cgi-bin/camctrlsaveprofile.cgi save parameter and cgi-bin/ddns.cgi...

Mobatek MobaXterm v11.1 - Code Execution Vulnerability

Document Title: =============== Mobatek MobaXterm v11.1 - Code Execution Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2186 Video: https://www.youtube.com/watch?v=Oz0rCBuRKrY Refernces:...

Mobatek MobaXterm v11.1 - Code Execution Vulnerability

Document Title: =============== Mobatek MobaXterm v11.1 - Code Execution Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2186 Video: https://www.youtube.com/watch?v=Oz0rCBuRKrY Refernces:...

Fortinet FCM-MB40 Remote Command Execution

A remote command execution vulnerability exists in Fortinet FCM-MB40. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

Input validation

A vulnerability in Cisco Enterprise NFV Infrastructure Software NFVIS could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system OS of an affected device as root. The vulnerability is due to insufficient input validation of a configuration file...

CVE-2019-1893

CVE-2019-1893 : Cisco Enterprise NFV Infrastructure Software (NFVIS) contains a command injection vulnerability caused by insufficient input validation of a configuration file accessible to a local shell user. An authenticated, local attacker can exploit this by supplying malicious input during t...