CVE-2020-1811

GaussDB 200 with version of 6.5.1 have a command injection vulnerability. Due to insufficient input validation, remote attackers with low permissions could exploit this vulnerability by sending crafted commands to the affected device. Successful exploit could allow an attacker to execute commands...

CVE-2019-19824

On certain TOTOLINK Realtek SDK based routers, an authenticated attacker may execute arbitrary OS commands via the sysCmd parameter to the boafrm/formSysCmd URI, even if the GUI syscmd.htm is not available. This allows for full control over the device's internals. This affects A3002RU through...

Design/Logic Flaw

Geutebruck IP Cameras G-CodeEEC-2xxx, G-CamEBC-21xx/EFD-22xx/ETHC-22xx/EWPC-22xx: All versions 1.12.0.25 and prior may allow a remote authenticated user, using a specially crafted URL command, to execute commands as root...

CVE-2019-10956

Geutebruck IP Cameras G-CodeEEC-2xxx, G-CamEBC-21xx/EFD-22xx/ETHC-22xx/EWPC-22xx: All versions 1.12.0.25 and prior may allow a remote authenticated user, using a specially crafted URL command, to execute commands as root...

CVE-2018-7859

A security vulnerability in D-Link DGS-1510-series switches with firmware 1.20.011, 1.30.007, 1.31.B003 and older that may allow a remote attacker to inject malicious scripts in the device and execute commands via browser that is configuring the unit...

Command injection

In Omron PLC CJ series, all versions and Omron PLC CS series, all versions, an attacker could spoof arbitrary messages or execute commands...

CVE-2019-18259

In Omron PLC CJ series, all versions and Omron PLC CS series, all versions, an attacker could spoof arbitrary messages or execute commands...

CVE-2018-0730

The CVE-2018-0730 entry describes a command-injection vulnerability in QNAP QTS File Station. An attacker can execute arbitrary commands on the affected device. Root cause is not elaborated beyond an input handling issue in File Station; multiple sources (NVD entry, Red Hat advisory, Tenable plug...

CVE-2019-15271

Cisco CVE-2019-15271 affects Small Business RV Series routers (RV016, RV042, RV042G, RV082). The issue is due to insufficient input validation of the HTTP payload in the web-based management interface, allowing an authenticated remote attacker with valid credentials or an active session token to ...

Mickey video pc client software suffers from dll hijacking vulnerability

Migu Video Client is a video software launched by China Mobile to watch various live broadcasts. Migu Video pc client software suffers from a dll hijacking vulnerability, which can be exploited by an attacker to inject a DLL file to execute arbitrary commands...

CVE-2019-3660 Advanced Threat Defense (ATD) - Improper Neutralization of HTTP requests

Improper Neutralization of HTTP requests in McAfee Advanced Threat Defense ATD prior to 4.8 allows remote authenticated attacker to execute commands on the server remotely via carefully constructed HTTP requests...

CVE-2019-18780

An arbitrary command injection vulnerability in the Cluster Server component of Veritas InfoScale allows an unauthenticated remote attacker to execute arbitrary commands as root or administrator. These Veritas products are affected: Access 7.4.2 and earlier, Access Appliance 7.4.2 and earlier, Fl...

CVE-2019-16965

resources/cmd.php in FusionPBX up to 4.5.7 suffers from a command injection vulnerability due to a lack of input validation, which allows authenticated administrative attackers to execute any commands on the host as www-data...

Cisco Firepower Management Center SQL Injection Vulnerability (CNVD-2019-34719)

Cisco Firepower Management Center FMC is a new generation of firewall management center software from Cisco. A SQL injection vulnerability exists in the web-based management interface of the Cisco Firepower Management Center FMC Software, which stems from the program's failure to properly validat...

CVE-2019-12685

Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center FMC Software could allow an authenticated, remote attacker to execute arbitrary SQL injections on an affected device. These vulnerabilities exist due to improper input validation. An attacker could...

Design/Logic Flaw

A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker to gain shell access on an affected device and execute commands on the underlying operating system OS. The vulnerability is due to insufficient enforcement of the consent token in authorizing shell...

CVE-2019-15000

The commit diff rest endpoint in Bitbucket Server and Data Center before 5.16.10 the fixed version for 5.16.x , from 6.0.0 before 6.0.10 the fixed version for 6.0.x, from 6.1.0 before 6.1.8 the fixed version for 6.1.x, from 6.2.0 before 6.2.6 the fixed version for 6.2.x, from 6.3.0 before 6.3.5 t...

Cross site scripting

Reflected Cross Site Scripting vulnerability in Administrators web console in McAfee Web Gateway MWG 7.8.x prior to 7.8.2.13 allows remote attackers to collect sensitive information or execute commands with the MWG administrator's credentials via tricking the administrator to click on a carefully...

CVE-2019-3638 Web Gateway (MWG) - Reflected Cross Site Scripting vulnerability

Reflected Cross Site Scripting vulnerability in Administrators web console in McAfee Web Gateway MWG 7.8.x prior to 7.8.2.13 allows remote attackers to collect sensitive information or execute commands with the MWG administrator's credentials via tricking the administrator to click on a carefully...

Ghostscript -- Security bypass vulnerabilities

Cedric Buissart Red Hat reports: A flaw was found in, ghostscript versions prior to 9.50, in the .pdfhookDSCCreator procedure where it did not properly secure its privileged calls, enabling scripts to bypass -dSAFER restrictions. A specially crafted PostScript file could disable security protecti...