759 matches found
Command injection
An OS command injection vulnerability in the web administration component of Micro Focus Secure Messaging Gateway SMG allows a remote attacker authenticated as a privileged user to execute arbitrary OS commands on the SMG server. This can be exploited in conjunction with CVE-2018-12464 to achieve...
CVE-2018-4859
CVE-2018-4859 affects SIEMENS SCALANCE M875 devices. A vulnerability allows an authenticated remote attacker with access to the web interface (443/tcp) to execute arbitrary operating system commands. Successful exploitation requires network access to the web interface and administrative credentia...
CVE-2018-4859
A vulnerability has been identified in SCALANCE M875 All versions. An authenticated remote attacker with access to the web interface 443/tcp, could execute arbitrary operating system commands. Successful exploitation requires that the attacker has network access to the web interface. The attacker...
CVE-2018-0569
baserCMS baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions allows remote authenticated attackers to execute arbitrary OS commands via unspecified vectors...
Nikto 2.1.6 CSV Injection
Exploit Title: Nikto 2.1.6 - CSV Injection Google Dork: N/A Date: 2018-06-01 Exploit Author: Adam Greenhill Vendor Homepage: https://cirt.net/Nikto2 Software Link: https://github.com/sullo/nikto Affected Version: 2.1.6, 2.1.5 Category: Applications Tested on: Kali Linux 4.14 x64 CVE :...
CVE-2017-3936
OS Command Injection vulnerability in McAfee ePolicy Orchestrator ePO 5.9.0, 5.3.2, 5.3.1, 5.1.3, 5.1.2, 5.1.1, and 5.1.0 allows attackers to run arbitrary OS commands with limited privileges via not sanitizing the user input data before exporting it into a CSV format output...
Design/Logic Flaw
QNAP NAS application Proxy Server through version 1.2.0 allows remote attackers to run arbitrary OS commands against the system with root privileges...
HPE iMC 7.3 - Remote Code Execution (Metasploit)
Exploit Title: HPE iMC EL Injection Unauthenticated RCE Date: 6 February, 2018 Exploit Author: TrendyTofu Vendor Homepage: https://www.hpe.com/us/en/home.html Software Link: http://h10145.www1.hpe.com/Downloads/SoftwareReleases.aspx?ProductNumber=JG747AAE&lang=en&cc=us&prodSeriesId=4176535 Versio...
CVE-2018-0545
LXR version 1.0.0 to 2.3.0 allows remote attackers to execute arbitrary OS commands via unspecified vectors...
CVE-2018-0545
CVE-2018-0545 concerns LXR, version 1.0.0 through 2.3.0. The connected sources confirm a remote OS command injection vulnerability (CWE-78) that could allow an attacker to execute arbitrary commands on a server running the affected LXR releases. The vulnerability arises in LXR’s handling of input...
CVE-2018-0556: Improper Neutralization of Special Elements used in an OS Command
Buffalo WZR-1750DHP2 Ver.2.30 and earlier allows an attacker to execute arbitrary OS commands via unspecified vectors...
CVE-2018-0523: Improper Neutralization of Special Elements used in an OS Command
Buffalo WXR-1900DHP2 firmware Ver.2.48 and earlier allows an attacker to execute arbitrary OS commands via unspecified vectors...
CVE-2018-6911
The VBWinExec function in Node\AspVBObj.dll in Advantech WebAccess 8.3.0 allows remote attackers to execute arbitrary OS commands via a single argument aka the command parameter...
CVE-2018-6911
The VBWinExec function in Node\AspVBObj.dll in Advantech WebAccess 8.3.0 allows remote attackers to execute arbitrary OS commands via a single argument aka the command parameter...
CVE-2018-6911: Improper Neutralization of Special Elements used in an OS Command
The VBWinExec function in Node\AspVBObj.dll in Advantech WebAccess 8.3.0 allows remote attackers to execute arbitrary OS commands via a single argument aka the command parameter...
CVE-2018-0512
Devices with IP address setting tool "MagicalFinder" provided by I-O DATA DEVICE, INC. allow authenticated attackers to execute arbitrary OS commands via unspecified vectors...
CVE-2018-0512
Devices with IP address setting tool "MagicalFinder" provided by I-O DATA DEVICE, INC. allow authenticated attackers to execute arbitrary OS commands via unspecified vectors...
CVE-2018-0512
CVE-2018-0512 involves the IP address setting tool “MagicalFinder” from I-O DATA DEVICE, INC. and is a confirmed OS command injection (CWE-78) vulnerability. The NVD/JVN entries describe that an attacker who can log in to affected devices may execute arbitrary OS commands via unspecified vectors....
CVE-2018-0506
CVE-2018-0506 affects Nootka 1.4.4 and earlier. The vulnerability is an OS command injection that lets remote attackers execute arbitrary commands via unspecified vectors in the mobile app. Public sources (NVD, JVN, CNVD) consistently describe a remote impact and the same affected product version...