ICSA-19-099-02 Siemens Spectrum Power 4.7

1. EXECUTIVE SUMMARY CVSS v3 10.0 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: Siemens Equipment: Spectrum Power 4.7 Vulnerability: Command Injection 2. RISK EVALUATION Successful exploitation of this vulnerability in versions of Spectrum Power 4 using the user-specific...

HCL legacy IVR system security vulnerability

HCL legacy IVR systems are a set of interactive voice inter-response systems. A security vulnerability exists in HCL legacy IVR systems, which originates from a program that executes commands and functions with the help of audio signals. The vulnerability can be exploited by an attacker to open...

DLink #DSL2750B OS Command Injection Exploit

This Metasploit module exploits a remote command injection vulnerability in D-Link DSL-2750B devices. Vulnerability can be exploited through "cli" parameter that is directly used to invoke "ayecli" binary. Vulnerable firmwares are from 1.01 up to 1.03. This module requires Metasploit:...

Rockwell Automation Allen Bradley Micrologix 1400 Series B FRN Denial of Service Vulnerability (CNVD-2018-07294)

Allen Bradley Micrologix 1400 Series B is a programmable logic controller from Rockwell Automation. A denial of service vulnerability exists in the handling of the snmp-set command in Allen Bradley Micrologix 1400 Series B version 21.2 and lower. An attacker could exploit this vulnerability by...

CVE-2018-6530

OS command injection vulnerability in soap.cgi soapcgimain in cgibin in D-Link DIR-880L DIR-880LREVAFIRMWAREPATCH1.08B04 and previous versions, DIR-868L DIR868LA1FW112b04 and previous versions, DIR-65L DIR-865LREVAFIRMWAREPATCH1.08.B01 and previous versions, and DIR-860L DIR860LA1FW110b04 and...

CVE-2017-12552

CVE-2017-12552 is a local arbitrary command-execution flaw in HPE System Management Homepage (SMH) for Windows and Linux, affecting versions prior to 7.6.1. The root cause is an issue in SMH that permits execution of OS commands from a crafted request. The documented impact includes potential com...

The vulnerability of D-Link and TRENDnet’s microprogrammed router services allows attackers to execute arbitrary commands or bypass authentication mechanisms, thereby gaining full control over the device.

The vulnerability of D-Link and TRENDnet’s microprogrammed router software services is related to deficiencies in the authentication process when processing the ping command. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using the pingaddr parameter...

The vulnerability of D-Link and TRENDnet’s microprogrammed router services allows attackers to execute arbitrary commands or bypass authentication mechanisms, thereby gaining full control over the device.

The vulnerability of D-Link and TRENDnet’s microprogrammed router software services is related to deficiencies in the authentication process when processing the ping command. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using the pingaddr parameter...

Command injection

Ruckus Wireless Zone Director Controller firmware releases ZD9.9.x, ZD9.10.x, ZD9.13.0.x less than 9.13.0.0.232 contain OS Command Injection vulnerabilities in the ping functionality that could allow local authenticated users to execute arbitrary privileged commands on the underlying operating...

Design/Logic Flaw

A vulnerability in a specific loopback filter action command, processed in a specific logical order of operation, in a running configuration of Juniper Networks Junos OS, allows an attacker with CLI access and the ability to initiate remote sessions to the loopback interface with the defined...

CVE-2016-10118

Firejail allows local users to truncate /etc/resolv.conf via a chroot command to /...

CVE-2014-5008

Snoopy allows remote attackers to execute arbitrary commands...

Redmi 2A phone has command vulnerability in multiple devices

The Redmi 2A phone is a new model launched by Xiaomi on March 31, 2015, as a derivative of the Redmi 2 phone. The ioctl cmd=0x40046b0a for the Redmi 2A kernel device /dev/hx170dec and the ioctl cmd=0xc00c7503 handler function for /dev/comip-ureg lacks a validity judgment, which allows an attacker...

D-Link DCS IP camera 7411 command execution vulnerability

No description provided by source...

UBUNTU-CVE-2016-4453

The vmsvgafiforun function in hw/display/vmwarevga.c in QEMU allows local guest OS administrators to cause a denial of service infinite loop and QEMU process crash via a VGA command...

DLA-335-1 ntp - security update

Bulletin has no description...

Pygments FontManager._get_nix_font_path Shell Injection Vulnerability

Pygments FontManager.getnixfontpath version 1.2.2-2.0.2 suffers from a shell injection vulnerability. Shell Injection in Pygments FontManager.getnixfontpath Product: Pygments Version: 1.2.2-2.0.2 497:fe62167596bb to 3693:655dbebddc23 Tue Nov 06 17:30:45 2007 +0000 to Aug 21, 2015. Website:...

D-Link/TRENDnet NCC Service Command Injection

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'D-Link/TRENDnet NCC Service Command Injection', 'Description' = %q This module exploits a remote command injection vulnerability on...

HNAP Remote Command Elevation of Privilege Vulnerability in Multiple D-Link Products

D-link specializes in the design and development of hardware products for wireless networks and Ethernet circuits. A remote command elevation of privilege vulnerability exists in several D-Link products HNAP. This vulnerability can be exploited by attackers to elevate privileges and execute...

ElasticSearch command execution vulnerability: by perl to rally the shell-vulnerability warning-the black bar safety net

ElasticSearch is based on Lucene Search Server. It provides a distributed multi-user capability of the full-text search engine, based on the RESTful web interface. Elasticsearch is developed in Java, and as the Apache License under the terms of the open source release, is the second most popular...