979 matches found
Supervene RazDC Reset Password CGI Command Injection (CVE-2018-15549)
A command injection vulnerability exists in Supervene RazDC. Successful exploitation of this vulnerability would allow remote attackers to execute arbitrary OS commands in the effected system...
PT-2019-5830
Name of the Vulnerable Software and Affected Versions D-Link DIR-846 version 100A35 Description The issue is related to insufficient argument checking in the SetMasterWLanSettings function of the D-Link DIR-846 firmware, allowing remote attackers to execute arbitrary OS commands as root. This can...
Citrix SD-WAN Center Command Injection (CVE-2019-10883)
A Command Injection vulnerability exists in Citrix SD-WAN Center. This vulnerability is due to insufficient validation of user-supplied data in one of the controllers. Successful exploitation of this vulnerability would allow remote attacker to execute arbitrary OS commands on the remote host...
CVE-2019-13598
LuaUPnP in Vera Edge Home Controller 1.7.4452 allows remote unauthenticated users to execute arbitrary OS commands via the code parameter to /port3480/datarequest because the "No unsafe lua allowed" code block is skipped...
CVE-2019-13598
LuaUPnP in Vera Edge Home Controller 1.7.4452 allows remote unauthenticated users to execute arbitrary OS commands via the code parameter to /port3480/datarequest because the "No unsafe lua allowed" code block is skipped...
CVE-2019-13598
CVE-2019-13598 affects Vera Edge Home Controller (version 1.7.4452) via LuaUPnP. A remote, unauthenticated attacker can trigger arbitrary OS commands by passing the code parameter to /port_3480/data_request, because the expected safety check for unsafe Lua code is skipped. This is a remote code e...
PT-2019-13443
Name of the Vulnerable Software and Affected Versions Vera Edge Home Controller version 1.7.4452 Description The issue allows remote unauthenticated users to execute arbitrary OS commands. This is achieved via the code parameter to the "/port 3480/data request" API endpoint, where the "No unsafe...
CVE-2018-16117
A shell escape vulnerability in /webconsole/Controller in Admin Portal of Sophos XG firewall 17.0.8 MR-8 allow remote authenticated attackers to execute arbitrary OS commands via shell metacharacters in the "dbName" POST parameter...
CVE-2018-15890
An issue was discovered in EthereumJ 1.8.2. There is Unsafe Deserialization in ois.readObject in mine/Ethash.java and decoder.readObject in crypto/ECKey.java. When a node syncs and mines a new block, arbitrary OS commands can be run on the server...
Design/Logic Flaw
A shell escape vulnerability in /webconsole/Controller in Admin Portal of Sophos XG firewall 17.0.8 MR-8 allow remote authenticated attackers to execute arbitrary OS commands via shell metacharacters in the "dbName" POST parameter...
PT-2019-9221
Name of the Vulnerable Software and Affected Versions Sophos XG firewall version 17.0.8 MR-8 Description A shell escape issue in the Admin Portal of Sophos XG firewall allows remote authenticated attackers to execute arbitrary OS commands. This is achieved by injecting shell metacharacters in the...
PT-2019-9196
Name of the Vulnerable Software and Affected Versions EthereumJ version 1.8.2 Description An issue was discovered in EthereumJ where there is unsafe deserialization in ois.readObject in mine/Ethash.java and decoder.readObject in crypto/ECKey.java. This allows arbitrary OS commands to be run on th...
PT-2019-9222
Name of the Vulnerable Software and Affected Versions Sophos XG firewall version 17.0.8 MR-8 Description A shell escape issue in the API Configuration component allows remote attackers to execute arbitrary OS commands. This is achieved by injecting shell metacharacters into the X-Forwarded-for HT...
CVE-2019-12735
getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via the :source! command in a modeline, as demonstrated by execute in Vim, and assertfails or nviminput in Neovim...
CVE-2019-12735
getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via the :source! command in a modeline, as demonstrated by execute in Vim, and assertfails or nviminput in Neovim...
CVE-2019-12735
getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via the :source! command in a modeline, as demonstrated by execute in Vim, and assertfails or nviminput in Neovim...
PT-2019-9365
Name of the Vulnerable Software and Affected Versions Imperva SecureSphere versions 13.0.0.10 and 13.1.0.10 Gateway Description A command injection issue in PWS allows an attacker with authenticated access to execute arbitrary OS commands on a vulnerable installation. Recommendations For Imperva...
CVE-2018-20434: Improper Neutralization of Special Elements used in an OS Command
LibreNMS 1.46 allows remote attackers to execute arbitrary OS commands by using the $POST'community' parameter to html/pages/addhost.inc.php during creation of a new device, and then making a /ajaxoutput.php?id=capture&format=text&type=snmpwalk&hostname=localhost request that triggers...
CVE-2018-13285
Command injection vulnerability in ftpd in Synology Router Manager SRM before 1.1.7-6941-1 allows remote authenticated users to execute arbitrary OS commands via the 1 MKD or 2 RMD command...