NEC Aterm WF1200C, Aterm WG1200CR and Aterm WG2600HS Operating System Command Injection Vulnerability

The NEC Aterm WF1200C and others are a wireless router from Nippon Electric NEC. An operating system command injection vulnerability exists in the NEC Aterm WF1200C 1.2.1 and earlier, Aterm WG1200CR 1.2.1 and earlier, and Aterm WG2600HS 1.3.2 and earlier, where the vulnerability arises from a...

NEC Aterm WF1200C, Aterm WG1200CR and Aterm WG2600HS Operating System Command Injection Vulnerability

The NEC Aterm WF1200C and others are a wireless router from Nippon Electric NEC. An operating system command injection vulnerability exists in the NEC Aterm WF1200C 1.2.1 and earlier, Aterm WG1200CR 1.2.1 and earlier, and Aterm WG2600HS 1.3.2 and earlier, where the vulnerability arises from a...

CVE-2020-1790

GaussDB 200 with version of 6.5.1 have a command injection vulnerability. The software constructs part of a command using external input from users, but the software does not sufficiently validate the user input. Successful exploit could allow the attacker to inject certain commands...

Schmid ZI 620 V400 VPN 090 Router OS Command Injection Vulnerability

The Schmid ZI 620 V400 VPN 090 Router is a router device. An operating system command injection vulnerability exists in the Schmid ZI 620 V400 VPN 090 Router, which can be exploited by an attacker to execute illegal operating system commands, due to a failure of the network system or product to...

EyesOfNetwork API SQL Injection Vulnerability

EyesOfNetwork EON is an open source, free IT monitoring solution. The solution provides features such as a business process configuration tool, generating pop-up windows when events occur in the active queue, and more. A SQL injection vulnerability exists in the EyesOfNetwork API that stems from ...

Apache SpamAssassin Command Execution Vulnerability (CNVD-2020-07221)

Apache SpamAssassin is an open source spam filter from the Apache USA Foundation. The product provides system administrators with a filter and support for categorizing email to block spam. An operating system command execution vulnerability exists in Apache SpamAssassin versions prior to 3.4.3. T...

UBUNTU-CVE-2019-20149

ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': 'name':'Symbol'. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result...

CVE-2019-20149

ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': 'name':'Symbol'. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result...

node-df code injection vulnerability

node-df is a cross-platform wrapper for Node.js. A code injection vulnerability exists in node-df version v0.1.4. The vulnerability stems from the process of constructing a code snippet from externally inputted data, where the network system or product does not properly filter special elements of...

tree-kill code injection vulnerability (CNVD-2020-03698)

tree-kill is a package for killing processes in the process tree. A code injection vulnerability exists in tree-kill Windows. The vulnerability arises from a network system or product that does not properly filter specific elements of externally input data during the construction of a code segmen...

Multiple SQLite, Chrome WebSQL Component Remote Code Execution Vulnerabilities

SQLite is one of the most widely used lightweight database systems.Chrome is a browser developed by Google that includes a WebSQL feature that allows SQL statements to be executed directly through the browser. This feature is powered by SQLite. A remote code execution vulnerability exists in...

Amazon Blink XT2 Sync Module OS Command Injection Vulnerability (CNVD-2020-09705)

Blink XT2 Sync Module is a camera synchronization device. Amazon Blink XT2 Sync Module suffers from an operating system command injection vulnerability. The vulnerability arises from a network system or product not properly filtering special characters, commands, etc. from external input data...

TCL Communication Alcatel Cingular Flip 2 B9HUAH1 OS Command Injection Vulnerability

The TCL Communication Alcatel Cingular Flip 2 B9HUAH1 is a cell phone from TCL Communication China. omamock is one of the components. An operating system command injection vulnerability exists in the omamock in the TCL Communication Alcatel Cingular Flip 2 B9HUAH1. The vulnerability arises from a...

Tenda AC9 Command Injection Vulnerability

Tenda AC9 is a wireless router from Tenda, a Chinese company. An operating system command injection vulnerability exists in the /goform/WanParameterSetting function in the Tenda AC9. The vulnerability arises when the network system or product fails to properly filter special characters, commands,...

newbee-mall SQL Injection Vulnerability

newbee-mall is an e-commerce system. A SQL injection vulnerability exists in the main/resources/mapper/NewBeeMallGoodsMapper.xml file in versions of newbee-mall prior to 2019-10-23, which stems from a lack of validation of externally entered SQL statements in database-based applications and can b...

CVE-2019-18954

Pomelo v2.2.5 allows external control of critical state data. A malicious user input can corrupt arbitrary methods and attributes in template/game-server/app/servers/connector/handler/entryHandler.js because certain internal attributes can be overwritten via a conflicting name. Hence, a malicious...

Trend Micro Apex One Command Injection Vulnerability

Trend Micro Apex One is a suite of endpoint security protection software from Trend Micro that provides automated threat detection and response capabilities. A command injection vulnerability exists in Trend Micro Apex One, which can be exploited by an attacker to execute an illegal command if a...

Zoho ManageEngine OpManager SQL Injection Vulnerability

Zoho ManageEngine OpManager is a suite of network, server and virtualization monitoring software from Zoho. Zoho ManageEngine OpManager suffers from a SQL injection vulnerability that arises from a database-based application that lacks validation of externally entered SQL statements. An attacker...

TOPMeeting SQL Injection Vulnerability

TOPMeeting is a video conferencing solution. A SQL injection vulnerability exists in versions prior to TOPMeeting 8.8 2019/08/19. The vulnerability stems from a lack of validation of externally entered SQL statements in database-based applications. An attacker can exploit the vulnerability to...

CVE-2019-11278

CF UAA versions prior to 74.1.0, allow external input to be directly queried against. A remote malicious user with 'client.write' and 'groups.update' can craft a SCIM query, which leaks information that allows an escalation of privileges, ultimately allowing the malicious user to gain control of...