CVE-2018-0512

Devices with IP address setting tool "MagicalFinder" provided by I-O DATA DEVICE, INC. allow authenticated attackers to execute arbitrary OS commands via unspecified vectors...

CVE-2018-0512

CVE-2018-0512 involves the IP address setting tool “MagicalFinder” from I-O DATA DEVICE, INC. and is a confirmed OS command injection (CWE-78) vulnerability. The NVD/JVN entries describe that an attacker who can log in to affected devices may execute arbitrary OS commands via unspecified vectors....

PT-2018-8873

Name of the Vulnerable Software and Affected Versions MP Form Mail CGI eCommerce Edition versions 2.0.13 and earlier Description The issue allows remote attackers to execute arbitrary OS commands. Recommendations For MP Form Mail CGI eCommerce Edition versions 2.0.13 and earlier, update to a...

PT-2018-8871

Name of the Vulnerable Software and Affected Versions MagicalFinder affected versions not specified Description The issue allows authenticated attackers to execute arbitrary OS commands. Recommendations At the moment, there is no information about a newer version that contains a fix for this...

CVE-2018-0506

CVE-2018-0506 affects Nootka 1.4.4 and earlier. The vulnerability is an OS command injection that lets remote attackers execute arbitrary commands via unspecified vectors in the mobile app. Public sources (NVD, JVN, CNVD) consistently describe a remote impact and the same affected product version...

CVE-2018-0506

Nootka 1.4.4 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors...

PT-2018-8865

Name of the Vulnerable Software and Affected Versions Nootka versions 1.4.4 and earlier Description The issue allows remote attackers to execute arbitrary OS commands. Recommendations For versions 1.4.4 and earlier, at the moment, there is no information about a newer version that contains a fix...

CVE-2016-10709

pfSense before 2.3 allows remote authenticated users to execute arbitrary OS commands via a '|' character in the statusrrdgraphimg.php graph parameter, related to rrdgraphimg.php...

PT-2018-4880

Name of the Vulnerable Software and Affected Versions pfSense versions prior to 2.3 Description The issue allows remote authenticated users to execute arbitrary OS commands. This is achieved by including a '|' character in the graph parameter of the status rrd graph img.php file, which is related...

Server side request forgery (ssrf)

diagping.cmd on D-Link DSL-2640U devices with firmware IM1.00 and ME1.00, and DSL-2540U devices with firmware ME1.00, allows authenticated remote attackers to execute arbitrary OS commands via shell metacharacters in the ipaddr field of an HTTP GET request...

CVE-2017-18025

cgi-bin/drknow.cgi in Innotube ITGuard-Manager 0.0.0.1 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the username field, as demonstrated by a username beginning with "admin|" to use the '|' metacharacter...

Design/Logic Flaw

Inteno iopsys 2.0-3.14 and 4.0 devices allow remote authenticated users to execute arbitrary OS commands by modifying the leasetrigger field in the odhcpd configuration to specify an arbitrary program, as demonstrated by a program located on an SMB share. This issue existed because the...

CVE-2017-17867

Inteno iopsys 2.0-3.14 and 4.0 devices allow remote authenticated users to execute arbitrary OS commands by modifying the leasetrigger field in the odhcpd configuration to specify an arbitrary program, as demonstrated by a program located on an SMB share. This issue existed because the...

CVE-2017-17867

CVE-2017-17867 concerns Inteno IOPSYS devices (2.0–3.14 and 4.0) where remote authenticated users can execute arbitrary OS commands by manipulating the leasetrigger field in the odhcpd config via an SMB share, due to insufficient protection of OpenWrt config (not using /etc/uci-defaults). Connect...

CVE-2017-17867: Incorrect Permission Assignment for Critical Resource

Inteno iopsys 2.0-3.14 and 4.0 devices allow remote authenticated users to execute arbitrary OS commands by modifying the leasetrigger field in the odhcpd configuration to specify an arbitrary program, as demonstrated by a program located on an SMB share. This issue existed because the...

CVE-2017-17888

cgi-bin/write.cgi in Anti-Web through 3.8.7, as used on NetBiter / HMS, Ouman EH-net, Alliance System WS100 -- AWU 500, Sauter ERW100F001, Carlo Gavazzi SIU-DLG, AEDILIS SMART-1, SYXTHSENSE WebBiter, ABB SREA, and ASCON DY WebServer devices, allows remote authenticated users to execute arbitrary ...

PT-2017-15075

Name of the Vulnerable Software and Affected Versions Anti-Web through version 3.8.7 Description The issue allows remote authenticated users to execute arbitrary OS commands via crafted multipart/form-data content. This affects devices from various manufacturers, including NetBiter / HMS, Ouman...

CVE-2017-10904

Qt for Android prior to 5.9.0 allows remote attackers to execute arbitrary OS commands via unspecified vectors...

PT-2017-11596

Name of the Vulnerable Software and Affected Versions Qt for Android versions prior to 5.9.0 Description The issue allows remote attackers to execute arbitrary OS commands. Recommendations For Qt for Android versions prior to 5.9.0, update to version 5.9.0 or later to resolve the issue...

CVE-2017-16923

Command Injection vulnerability in appdatacenter on Shenzhen Tenda Ac9 USAC9V1.0BRV15.03.05.14multiTD01, Ac9 ac9kfV15.03.05.196318cn, Ac15 USAC15V1.0BRV15.03.05.18multiTD01, Ac15 USAC15V1.0BRV15.03.05.19multiTD01, Ac18 USAC18V1.0BRV15.03.05.05multiTD01, and Ac18 ac18kfV15.03.05.196318cn devices...