Input validation

Jenkins Sounds Plugin 0.5 and earlier does not perform permission checks in URLs performing form validation, allowing attackers with Overall/Read access to execute arbitrary OS commands as the OS user account running Jenkins...

CVE-2020-2097

Jenkins Sounds Plugin

CVE-2020-2097

Jenkins Sounds Plugin 0.5 and earlier does not perform permission checks in URLs performing form validation, allowing attackers with Overall/Read access to execute arbitrary OS commands as the OS user account running Jenkins...

CVE-2020-2098

A cross-site request forgery vulnerability in Jenkins Sounds Plugin 0.5 and earlier allows attacker to execute arbitrary OS commands as the OS user account running Jenkins...

CSRF vulnerability and missing permission checks in sounds allow OS command execution

sounds 0.5 and earlier does not perform permission checks in URLs performing form validation. This allows attackers with Overall/Read access to execute arbitrary OS commands as the OS user account running Jenkins. Additionally, these form validation URLs do not require POST requests, resulting in...

CVE-2019-18894

In Avast Premium Security 19.8.2393, attackers can send a specially crafted request to the local web server run by Avast Antivirus on port 27275 to support Bank Mode functionality. A flaw in the processing of a command allows execution of arbitrary OS commands with the privileges of the currently...

Design/Logic Flaw

netflowgetstats in functionsnetflow.php in Pandora FMS 7.0NG allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the ipsrc parameter in an index.php?operation/netflow/nfliveview request. This issue has been fixed in Pandora FMS 7.0 NG 742...

CVE-2016-11017

CVE-2016-11017 affects AKIPS Network Monitor (versions 15.37 through 16.5). The login page is vulnerable to remote, unauthenticated command injection via shell metacharacters in the username parameter, with the command output exposed in a login failure field. This is fixed in version 16.6. Remedi...

CVE-2019-5987: Improper Neutralization of Special Elements used in an OS Command

Access analysis CGI An-Analyzer released in 2019 June 24 and earlier allows remote authenticated attackers to execute arbitrary OS commands via the Management Page...

CVE-2020-5179

Comtech Stampede FX-1010 7.4.3 devices allow remote authenticated administrators to execute arbitrary OS commands by navigating to the Diagnostics Ping page and entering shell metacharacters in the Target IP address field. In some cases, authentication can be achieved with the comtech password fo...

CVE-2020-5179

Comtech Stampede FX-1010 7.4.3 devices allow remote authenticated administrators to execute arbitrary OS commands by navigating to the Diagnostics Ping page and entering shell metacharacters in the Target IP address field. In some cases, authentication can be achieved with the comtech password fo...

CVE-2019-20197

In Nagios XI 5.6.9, an authenticated user is able to execute arbitrary OS commands via shell metacharacters in the id parameter to schedulereport.php, in the context of the web-server user account...

PT-2019-16122

Name of the Vulnerable Software and Affected Versions Nagios XI version 5.6.9 Description The issue allows an authenticated user to execute arbitrary OS commands via shell metacharacters in the id parameter to "schedulereport.php", in the context of the web-server user account. Recommendations Fo...

CVE-2019-20197: Improper Neutralization of Special Elements used in an OS Command

In Nagios XI 5.6.9, an authenticated user is able to execute arbitrary OS commands via shell metacharacters in the id parameter to schedulereport.php, in the context of the web-server user account...

CVE-2019-6013

DBA-1510P firmware 1.70b009 and earlier allows authenticated attackers to execute arbitrary OS commands via Command Line Interface CLI...

CVE-2019-6014

DBA-1510P firmware 1.70b009 and earlier allows an attacker to execute arbitrary OS commands via Web User Interface...

CVE-2019-6013

DBA-1510P firmware 1.70b009 and earlier allows authenticated attackers to execute arbitrary OS commands via Command Line Interface CLI...

CVE-2019-6014

The CVE-2019-6014 vulnerability affects the D-Link DBA-1510P, specifically in the Web User Interface. The root cause is an OS command injection flaw in the Web UI (and related CLI issue for CVE-2019-6013) that allows an attacker to execute arbitrary commands on the device. Impact is execution of ...

CVE-2019-17270

Yachtcontrol through 2019-10-06: It's possible to perform direct Operating System commands as an unauthenticated user via the "/pages/systemcall.php?command=COMMAND" page and parameter, where COMMAND will be executed and returning the results to the client. Affects Yachtcontrol webservers disclos...

CVE-2019-17270

CVE-2019-17270 affects Yachtcontrol Webapplication 1.0. It enables unauthenticated remote command execution via /pages/systemcall.php?command={COMMAND}, allowing arbitrary OS commands and exposure of command output on affected Yachtcontrol webservers exposed to Dutch GPRS/4G ranges. The issue ari...