CVE-2020-2159

Jenkins CryptoMove Plugin 0.1.33 and earlier allows attackers with Job/Configure access to execute arbitrary OS commands on the Jenkins master as the OS user account running Jenkins...

CVE-2020-2159

Jenkins CryptoMove Plugin 0.1.33 and earlier allows attackers with Job/Configure access to execute arbitrary OS commands on the Jenkins master as the OS user account running Jenkins...

CVE-2020-2159

CVE-2020-2159 affects Jenkins CryptoMove Plugin versions 0.1.33 and earlier. The vulnerability arises because the CryptoMove plugin allows configuration of an OS command to execute as part of a build step, which will run on the Jenkins controller as the OS user running Jenkins. An attacker with J...

PT-2020-12006

Name of the Vulnerable Software and Affected Versions BWA DiREX-Pro version 1.2181 Description The issue allows remote attackers to execute arbitrary OS commands via shell metacharacters in the PKG parameter to "uninstall.php3" API endpoint. Recommendations For BWA DiREX-Pro version 1.2181, as a...

CVE-2020-2159: Improper Neutralization of Special Elements used in an OS Command

Jenkins CryptoMove Plugin 0.1.33 and earlier allows attackers with Job/Configure access to execute arbitrary OS commands on the Jenkins master as the OS user account running Jenkins...

CVE-2020-10221

lib/ajaxHandlers/ajaxAddTemplate.php in rConfig through 3.94 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the fileName POST parameter...

CVE-2020-10221

lib/ajaxHandlers/ajaxAddTemplate.php in rConfig through 3.94 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the fileName POST parameter...

CVE-2020-10221

lib/ajaxHandlers/ajaxAddTemplate.php in rConfig through 3.94 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the fileName POST parameter...

CVE-2020-10216: Improper Neutralization of Special Elements used in an OS Command

An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. They allow remote attackers to execute arbitrary commands via the date parameter in a systemtime.cgi POST request. TRENDnet TEW-632BRP 1.010B32 is also affected...

CVE-2020-9380

IPTV Smarters WEB TV PLAYER through 2020-02-22 allows attackers to execute OS commands by uploading a script...

CVE-2020-9380

The CVE-2020-9380 entry concerns IPTV Smarters WEB TV PLAYER prior to 2020-02-22, where uploading a script enables an attacker to execute OS commands. The Red Hat entry and related advisories corroborate the issue description but do not provide product-specific version ranges or remediation steps...

CVE-2020-9380: Unrestricted Upload of File with Dangerous Type

IPTV Smarters WEB TV PLAYER through 2020-02-22 allows attackers to execute OS commands by uploading a script...

MTN Group: Remote OS Command Execution on Oracle Weblogic server via [CVE-2017-3506]

Summary Hello. I was able to identify RCE vulnerability due to the outdated Oracle Weblogic instance on https://raebilling.mtn.co.za. Steps To Reproduce To reproduce, try this request with BurpSuite This request to the https://raebilling.mtn.co.za/wls-wsat/RegistrationRequesterPortType will trigg...

MTN Group: Remote OS Command Execution on Oracle Weblogic server via [CVE-2017-10271]

Summary Hello. I was able to identify RCE vulnerability due to the outdated Oracle Weblogic instance on https://raebilling.mtn.co.za. Steps To Reproduce To reproduce, launch this request with BurpSuite This request to the https://raebilling.mtn.co.za/wls-wsat/CoordinatorPortType will trigger slee...

PT-2020-20677

Name of the Vulnerable Software and Affected Versions Centreon version 19.10 Description The issue allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the server ip field in JSON data in an "api/internal.php?object=centreon configuration remote" request...

CVE-2020-8813

graphrealtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has the graph real-time privilege...

CVE-2020-8813

The Cacti network monitoring tool (version 1.2.8 ) is vulnerable to Remote Code Execution (RCE) due to an issue in the graph_realtime.php file. An authenticated guest user with graph real-time privileges can execute arbitrary operating system commands by providing shell metacharacters within a co...

CVE-2020-8813

graphrealtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has the graph real-time privilege...

CVE-2020-8813

graphrealtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has the graph real-time privilege...

CVE-2020-6841

Summary: CVE-2020-6841 affects the D-Link DCH-M225 Wi‑Fi audio extender (versions 1.05b01 and earlier). The vulnerability arises in the spotifyConnect.php script where userName input is not properly neutralized, allowing an attacker to inject shell metacharacters and execute arbitrary OS commands...