CVE-2019-9624

CVE-2019-9624 affects Webmin up to version 1.900 (and lower per sources). An authenticated user with the Upload and Download privilege can upload a crafted .cgi file via the /updown/upload.cgi URI, which enables remote code execution on the server. Exploitation is described as an authenticated RC...

CVE-2019-9624

Webmin 1.900 allows remote attackers to execute arbitrary code by leveraging the "Java file manager" and "Upload and Download" privileges to upload a crafted .cgi file via the /updown/upload.cgi URI...

Webmin Arbitrary Code Execution Vulnerability

Webmin is a Web-based system configuration tool for Unix-like systems, and the latest version can also be installed and run on Windows. An arbitrary code execution vulnerability exists in Webmin 1.900. A remote attacker can use the "Java File Manager" and "Upload and Download" privileges to uploa...

Usermin 1.750 - Remote Command Execution Exploit

Exploit for linux platform in category web applications This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'uri' class MetasploitModule 'Usermin 1.750 - Remote Command Execution', 'Description' ...

Usermin 1.750 - Remote Command Execution (Metasploit)

Usermin 1.750 - Remote Command Execution Metasploit This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'uri' class MetasploitModule 'Usermin 1.750 - Remote Command Execution', 'Description' = %q...

Usermin 1.750 - Remote Command Execution (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' require 'uri' class MetasploitModule 'Usermin 1.750 - Remote Command Execution', 'Description' = %q This module exploits an arbitrary command execution...

Command execution vulnerability in Bell Optical Cat backend dd***.cgi file

Nokia Bell Shanghai is a company that provides end-to-end information and communication solutions and high-quality services to carrier and non-carrier customers. A command execution vulnerability exists in the dd.cgi file in the background of Bell Fiber Optic Cats, which can be exploited by...

ASUSTOR ADM OS Command Injection Vulnerability (CNVD-2018-26927)

ASUSTOR ADM is an operating system from ASUSTOR dedicated to ASUSTOR NAS storage devices. An operating system command injection vulnerability exists in the user.cgi file in ASUSTOR ADM version 3.1.1, which can be exploited to execute system commands with the help of the 'name' POST parameter...

TP-Link TL-WR840N/TL-WR841N - Authenticaton Bypass

Title: TP-Link Multiple RouterTL-WR840N and TL-WR841N Unauthenticated Router Access Vulnerability Author: BlackFog Team Date: 27 May 2018 Website: SecureLayer7.net Contact: [email protected] Version: 0.9.1 4.16 v0001.0 Build 170622 Rel.64334n Hardware: TL-WR841N v13 00000013 Version : Firmwar...

WePresent WiPG-1000 - Command Injection (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'WePresent WiPG-1000 Command Injection', 'Description' = %q This module exploits a command injection vulnerability in an...

WePresent WiPG-1000 Command Injection

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'WePresent WiPG-1000 Command Injection', 'Description' = %q This module exploits a command injection vulnerability in an...

WePresent WiPG-1000 Command Injection Exploit

This Metasploit module exploits a command injection vulnerability in an undocumented CGI file in several versions of the WePresent WiPG-1000 devices. Version 2.0.0.7 was confirmed vulnerable, 2.2.3.0 patched this vulnerability. This module requires Metasploit: http://metasploit.com/download Curre...

[CORE-2015-0012] - AirLive Multiple Products OS Command Injection

Advisory Information Title: AirLive Multiple Products OS Command Injection Advisory ID: CORE-2015-0012 Advisory URL: http://www.coresecurity.com/advisories/airlive-multiple-products-os-command-injection Date published: 2015-07-06 Date of last update: 2015-07-06 Vendors contacted: AirLive Release...

AirLive (Multiple Products) - OS Command Injection

AirLive Multiple Products - OS Command Injection 1. Advisory Information Title: AirLive Multiple Products OS Command Injection Advisory ID: CORE-2015-0012 Advisory URL: http://www.coresecurity.com/advisories/airlive-multiple-products-os-command-injection Date published: 2015-07-06 Date of last...

AirLive 系列 IP 摄像头命令注入漏洞

大量AirLive IP监控摄像机被曝存在命令注入漏洞，攻击者可利用该漏洞窃取用户登录凭证并控制设备。漏洞原理及影响范围OvisLink公司制造的大量AirLive IP监控摄像机中都存在着命令注入漏洞，通过该漏洞，网络攻击者可以解码用户登录凭证，并可以完全控制监控设备。根据Core安全公司的专家们的消息，至少5种不同型号的AirLive监控摄像机都受此漏洞的影响。这5种型号的监控摄像机分别如下：1、AirLive BU-2015，固件版本1.03.18 16.06.20142、AirLive BU-3026，固件版本1.43 21.08.20143、AirLive...

AirLive Multiple Products OS Command Injection (Jul 2015) - Active Check

There is an OS Command Injection in the cgitest.cgi binary file in the AirLive MD-3025, BU-3026 and BU-2015 cameras when handling certain parameters. That specific CGI file can be requested without authentication, unless the user specified in the configuration of the camera that every communicati...

[CORE-2014-0009] - Advantech EKI-6340 Command Injection

Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ Advantech EKI-6340 Command Injection 1. Advisory Information Title: Advantech EKI-6340 Command Injection Advisory ID: CORE-2014-0009 Advisory URL: http://www.coresecurity.com/advisories/advantech-eki-6340-command-injection Date...

Advantech EKI-6340 - Command Injection

Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ Advantech EKI-6340 Command Injection 1. Advisory Information Title: Advantech EKI-6340 Command Injection Advisory ID: CORE-2014-0009 Advisory URL: http://www.coresecurity.com/advisories/advantech-eki-6340-command-injection Date...

Advantech EKI-6340 - Command Injection

Advantech EKI-6340 - Command Injection Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ Advantech EKI-6340 Command Injection 1. Advisory Information Title: Advantech EKI-6340 Command Injection Advisory ID: CORE-2014-0009 Advisory URL:...

Advantech EKI-6340 2.05 Command Injection

Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ Advantech EKI-6340 Command Injection 1. Advisory Information Title: Advantech EKI-6340 Command Injection Advisory ID: CORE-2014-0009 Advisory URL: http://www.coresecurity.com/advisories/advantech-eki-6340-command-injection Date...