CVE-2018-4859

CVE-2018-4859 affects SIEMENS SCALANCE M875 devices. A vulnerability allows an authenticated remote attacker with access to the web interface (443/tcp) to execute arbitrary operating system commands. Successful exploitation requires network access to the web interface and administrative credentia...

CVE-2018-0569

baserCMS baserCMS 4.1.0.1 and earlier versions, baserCMS 3.0.15 and earlier versions allows remote authenticated attackers to execute arbitrary OS commands via unspecified vectors...

PT-2018-8927

Name of the Vulnerable Software and Affected Versions baserCMS versions 4.1.0.1 and earlier baserCMS versions 3.0.15 and earlier Description The issue allows remote authenticated attackers to execute arbitrary OS commands. Recommendations For versions 4.1.0.1 and earlier, update to a version late...

Nikto 2.1.6 CSV Injection

Exploit Title: Nikto 2.1.6 - CSV Injection Google Dork: N/A Date: 2018-06-01 Exploit Author: Adam Greenhill Vendor Homepage: https://cirt.net/Nikto2 Software Link: https://github.com/sullo/nikto Affected Version: 2.1.6, 2.1.5 Category: Applications Tested on: Kali Linux 4.14 x64 CVE :...

CVE-2017-3936

OS Command Injection vulnerability in McAfee ePolicy Orchestrator ePO 5.9.0, 5.3.2, 5.3.1, 5.1.3, 5.1.2, 5.1.1, and 5.1.0 allows attackers to run arbitrary OS commands with limited privileges via not sanitizing the user input data before exporting it into a CSV format output...

Design/Logic Flaw

QNAP NAS application Proxy Server through version 1.2.0 allows remote attackers to run arbitrary OS commands against the system with root privileges...

HPE iMC 7.3 - Remote Code Execution (Metasploit)

Exploit Title: HPE iMC EL Injection Unauthenticated RCE Date: 6 February, 2018 Exploit Author: TrendyTofu Vendor Homepage: https://www.hpe.com/us/en/home.html Software Link: http://h10145.www1.hpe.com/Downloads/SoftwareReleases.aspx?ProductNumber=JG747AAE&lang=en&cc=us&prodSeriesId=4176535 Versio...

CVE-2018-0545

LXR version 1.0.0 to 2.3.0 allows remote attackers to execute arbitrary OS commands via unspecified vectors...

CVE-2018-0545

CVE-2018-0545 concerns LXR, version 1.0.0 through 2.3.0. The connected sources confirm a remote OS command injection vulnerability (CWE-78) that could allow an attacker to execute arbitrary commands on a server running the affected LXR releases. The vulnerability arises in LXR’s handling of input...

PT-2018-8903

Name of the Vulnerable Software and Affected Versions LXR versions 1.0.0 through 2.3.0 Description The issue allows remote attackers to execute arbitrary OS commands. Recommendations For versions 1.0.0 through 2.3.0, at the moment, there is no information about a newer version that contains a fix...

CVE-2018-0556: Improper Neutralization of Special Elements used in an OS Command

Buffalo WZR-1750DHP2 Ver.2.30 and earlier allows an attacker to execute arbitrary OS commands via unspecified vectors...

PT-2018-8882

Name of the Vulnerable Software and Affected Versions Buffalo WXR-1900DHP2 firmware versions prior to 2.49 Description The issue allows an attacker to execute arbitrary OS commands. Recommendations For Buffalo WXR-1900DHP2 firmware versions prior to 2.49, update to a version later than 2.48 to...

CVE-2018-0523: Improper Neutralization of Special Elements used in an OS Command

Buffalo WXR-1900DHP2 firmware Ver.2.48 and earlier allows an attacker to execute arbitrary OS commands via unspecified vectors...

CVE-2018-6911

The VBWinExec function in Node\AspVBObj.dll in Advantech WebAccess 8.3.0 allows remote attackers to execute arbitrary OS commands via a single argument aka the command parameter...

CVE-2018-6911

The VBWinExec function in Node\AspVBObj.dll in Advantech WebAccess 8.3.0 allows remote attackers to execute arbitrary OS commands via a single argument aka the command parameter...

CVE-2018-6911: Improper Neutralization of Special Elements used in an OS Command

The VBWinExec function in Node\AspVBObj.dll in Advantech WebAccess 8.3.0 allows remote attackers to execute arbitrary OS commands via a single argument aka the command parameter...

CVE-2018-0512

Devices with IP address setting tool "MagicalFinder" provided by I-O DATA DEVICE, INC. allow authenticated attackers to execute arbitrary OS commands via unspecified vectors...

CVE-2018-0512

CVE-2018-0512 involves the IP address setting tool “MagicalFinder” from I-O DATA DEVICE, INC. and is a confirmed OS command injection (CWE-78) vulnerability. The NVD/JVN entries describe that an attacker who can log in to affected devices may execute arbitrary OS commands via unspecified vectors....

CVE-2018-0512

Devices with IP address setting tool "MagicalFinder" provided by I-O DATA DEVICE, INC. allow authenticated attackers to execute arbitrary OS commands via unspecified vectors...

PT-2018-8871

Name of the Vulnerable Software and Affected Versions MagicalFinder affected versions not specified Description The issue allows authenticated attackers to execute arbitrary OS commands. Recommendations At the moment, there is no information about a newer version that contains a fix for this...