18168 matches found
Sophos XG firewall Admin Portal shell escape vulnerability
Sophos XG firewall is a next-generation endpoint protection and enterprise-class firewall product from Sophos UK.Admin Portal is one of the management portals. A security vulnerability exists in /webconsole/Controller of Admin Portal in Sophos XG firewall version 17.0.8 MR-8. The vulnerability ca...
Evernote Web Clipper Cross-Site Scripting (CVE-2019-12592)
A cross-site scripting vulnerability exists in Evernote Web Clipper Extension. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary commands on the affected system...
CVE-2018-15868
SQL injection vulnerability in ChronoScan version 1.5.4.3 and earlier allows an unauthenticated attacker to execute arbitrary SQL commands via the wcrmachineid cookie...
Sql injection
SQL injection vulnerability in ChronoScan version 1.5.4.3 and earlier allows an unauthenticated attacker to execute arbitrary SQL commands via the wcrmachineid cookie...
Sql injection
SQL injection vulnerability in AccountStatus.jsp in Admin Portal of Sophos XG firewall 17.0.8 MR-8 allow remote authenticated attackers to execute arbitrary SQL commands via the "username" GET parameter...
CVE-2019-6962
A shell injection issue in cosawifiapis.c in the RDK RDKB-20181217-1 CcspWifiAgent module allows attackers with login credentials to execute arbitrary shell commands under the CcspWifiSsp process running as root if the platform was compiled with the ENABLEFEATUREMESHWIFI macro. The attack is...
CVE-2019-6962
A shell injection issue in cosawifiapis.c in the RDK RDKB-20181217-1 CcspWifiAgent module allows attackers with login credentials to execute arbitrary shell commands under the CcspWifiSsp process running as root if the platform was compiled with the ENABLEFEATUREMESHWIFI macro. The attack is...
Sql injection
A shell injection issue in cosawifiapis.c in the RDK RDKB-20181217-1 CcspWifiAgent module allows attackers with login credentials to execute arbitrary shell commands under the CcspWifiSsp process running as root if the platform was compiled with the ENABLEFEATUREMESHWIFI macro. The attack is...
CVE-2019-6962
A shell injection issue in cosawifiapis.c in the RDK RDKB-20181217-1 CcspWifiAgent module allows attackers with login credentials to execute arbitrary shell commands under the CcspWifiSsp process running as root if the platform was compiled with the ENABLEFEATUREMESHWIFI macro. The attack is...
CVE-2019-1879
A vulnerability in the CLI of Cisco Integrated Management Controller IMC could allow an authenticated, local attacker to inject arbitrary commands that are executed with root privileges. The vulnerability is due to insufficient validation of user-supplied input at the CLI. An attacker could explo...
Input validation
A vulnerability in the CLI configuration shell of Cisco Meeting Server could allow an authenticated, local attacker to inject arbitrary commands as the root user. The vulnerability is due to insufficient input validation during the execution of a vulnerable CLI command. An attacker with...
CVE-2019-1879
CVE-2019-1879 affects Cisco Integrated Management Controller (IMC) CLI. The issue is due to insufficient validation of user-supplied input in CLI commands, allowing an authenticated local attacker to inject and execute arbitrary commands with root privileges. Exploitation requires admin authentic...
CVE-2019-1624 Cisco SD-WAN Solution Command Injection Vulnerability
A vulnerability in the vManage web-based UI Web UI in the Cisco SD-WAN Solution could allow an authenticated, remote attacker to inject arbitrary commands that are executed with root privileges. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerabilit...
CVE-2019-1623 Cisco Meeting Server CLI Command Injection Vulnerability
A vulnerability in the CLI configuration shell of Cisco Meeting Server could allow an authenticated, local attacker to inject arbitrary commands as the root user. The vulnerability is due to insufficient input validation during the execution of a vulnerable CLI command. An attacker with...
CVE-2018-16618
VTech Storio Max devices running before 56.D3JM6 are affected by CVE-2018-16618. An exposed storeintenttranslate.x service on localhost:1668 accepts requests that combine random characters with an Android activity name; the activity name is inserted into a shell command. By injecting shell metach...
CVE-2019-12491
OnApp before 5.0.0-88, 5.5.0-93, and 6.0.0-196 allows an attacker to run arbitrary commands with root privileges on servers managed by OnApp for XEN/KVM hypervisors. To exploit the vulnerability an attacker has to have control of a single server on a given cloud e.g. by renting one. From the sour...
Command Injection
Overview Versions of pullit prior to 1.4.0 are vulnerable to Command Injection. The package does not validate input on git branch names and concatenates it to an exec call, allowing attackers to run arbitrary commands in the system. Recommendation Upgrade to version 1.4.0 or later. References -...
CVE-2019-12491
OnApp before 5.0.0-88, 5.5.0-93, and 6.0.0-196 allows an attacker to run arbitrary commands with root privileges on servers managed by OnApp for XEN/KVM hypervisors. To exploit the vulnerability an attacker has to have control of a single server on a given cloud e.g. by renting one. From the sour...
CVE-2019-12491
CVE-2019-12491 affects OnApp before 5.0.0-88, 5.5.0-93, and 6.0.0-196, allowing an attacker who controls a single server in a cloud to craft and trigger commands that execute with root privileges on a target server managed by OnApp for XEN/KVM hypervisors. The issue enables remote command executi...