CVE-2019-7670

Prima Systems FlexAir, Versions 2.3.38 and prior. The application incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component, which could allow attackers to execute commands directly on the operating system...

Unauthorized Access Vulnerability in Netcom's Next-Generation Firewalls

Netcom Next-Generation Firewall is a high-performance application layer firewall launched by Netcom Technology that can comprehensively deal with network threats. An unauthorized access vulnerability exists in Netcom Next-Generation Firewall, which can be exploited by attackers to execute command...

Buffer overflow

An issue was discovered on Moxa AWK-3121 1.14 devices. It provides functionality so that an administrator can run scripts on the device to troubleshoot any issues. However, the same functionality allows an attacker to execute commands on the device. The POST parameter "iwfilename" is susceptible ...

CVE-2019-12303

In Rancher 2 through 2.2.3, Project owners can inject additional fluentd configuration to read files or execute arbitrary commands inside the fluentd container...

Design/Logic Flaw

In Rancher 2 through 2.2.3, Project owners can inject additional fluentd configuration to read files or execute arbitrary commands inside the fluentd container...

CVE-2019-12303

In Rancher 2 through 2.2.3, Project owners can inject additional fluentd configuration to read files or execute arbitrary commands inside the fluentd container...

Micro Focus Service Manager Information Disclosure Vulnerability

Micro Focus Service Manager is a suite of service desk software from Micro Focus UK. The software supports the deployment of a comprehensive IT service management ITSM system and standardizes management processes. An information disclosure vulnerability exists in Micro Focus Service Manager. An...

Cisco IOS XE Router Command Injection (cisco-sa-20190513-webui)

Binary data 700665.prm...

Cross site scripting

A vulnerability in the REST API of Ubuntu MAAS allows an attacker to cause a logged-in user to execute commands via cross-site scripting. This issue affects MAAS versions prior to 1.9.2...

Directory traversal

Silverpeas 5.15 through 6.0.2 is affected by an authenticated Directory Traversal vulnerability that can be triggered during file uploads because core/webapi/upload/FileUploadData.java mishandles a StringUtil.java call. This vulnerability enables regular users to write arbitrary files on the...

CVE-2019-1756

A vulnerability in Cisco IOS XE Software could allow an authenticated, remote attacker to execute commands on the underlying Linux shell of an affected device with root privileges. The vulnerability occurs because the affected software improperly sanitizes user-supplied input. An attacker who has...

CVE-2019-1756

Cisco IOS XE Software contains a command-injection vulnerability (CVE-2019-1756) that can be exploited by an authenticated administrator via the web UI by supplying a malicious username payload, leading to arbitrary commands executed as root on the device. The root cause is improper input sanitiz...

CVE-2014-5433

An unauthenticated remote attacker may be able to execute commands to view wireless account credentials that are stored in cleartext on Baxter SIGMA Spectrum Infusion System version 6.05 model 35700BAX with wireless battery module WBM version 16, which may allow an attacker to gain access the hos...

CVE-2018-15723

The Logitech Harmony Hub before version 4.15.206 is vulnerable to application level command injection via crafted HTTP request. An unauthenticated remote attacker can leverage this vulnerability to execute application defined commands e.g. harmony.system?systeminfo...

Command injection

System command injection in ajaxdata.php in TerraMaster TOS 3.1.03 allows attackers to execute system commands via the "newname" parameter...

SAP Disclosure Management Arbitrary File Overwrite Vulnerability

SAP Disclosure Management is an automated financial disclosure management system. The system provides a collaborative financial disclosure process across teams, geographies, systems and data sources. An arbitrary file overwrite vulnerability exists in SAP Disclosure Management, which could be...

CVE-2018-15379

A vulnerability in which the HTTP web server for Cisco Prime Infrastructure PI has unrestricted directory permissions could allow an unauthenticated, remote attacker to upload an arbitrary file. This file could allow the attacker to execute commands at the privilege level of the user prime. This...

CVE-2018-0477

A vulnerability in the CLI parser of Cisco IOS XE Software could allow an authenticated, local attacker to execute commands on the underlying Linux shell of an affected device with root privileges. The vulnerability exist because the affected software improperly sanitizes command arguments, faili...

Design/Logic Flaw

A vulnerability in the CLI parser of Cisco IOS XE Software could allow an authenticated, local attacker to execute commands on the underlying Linux shell of an affected device with root privileges. The vulnerability exist because the affected software improperly sanitizes command arguments, faili...

CVE-2018-0440

CVE-2018-0440 concerns Cisco Data Center Network Manager (DCNM). The issue is in the web interface where incomplete input validation of HTTP requests allows an authenticated application administrator to execute commands on the underlying OS with root privileges. Impact is privilege escalation wit...