1064 matches found
LogicalDOC Enterprise 7.7.4 - Root Remote Code Execution
LogicalDOC Enterprise 7.7.4 - Root Remote Code Execution LogicalDOC Enterprise 7.7.4 Post-Auth Command Execution Via Binary Path Manipulation Vendor: LogicalDOC Srl Product web page: https://www.logicaldoc.com Affected version: 7.7.4 7.7.3 7.7.2 7.7.1 7.6.4 7.6.2 7.5.1 7.4.2 7.1.1 Summary:...
LogicalDOC Enterprise 7.7.4 - Root Remote Code Execution
LogicalDOC Enterprise 7.7.4 Post-Auth Command Execution Via Binary Path Manipulation Vendor: LogicalDOC Srl Product web page: https://www.logicaldoc.com Affected version: 7.7.4 7.7.3 7.7.2 7.7.1 7.6.4 7.6.2 7.5.1 7.4.2 7.1.1 Summary: LogicalDOC is a free document management system that is designe...
CVE-2018-0514
MP Form Mail CGI eCommerce Edition Ver 2.0.13 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors...
CVE-2018-6388
iBall iB-WRA150N 1.2.6 build 110401 Rel.47776n devices allow remote authenticated users to execute arbitrary OS commands via shell metacharacters in the ping test arguments on the Diagnostics page...
CVE-2018-6388
The CVE-2018-6388 entry concerns iBall iB-WRA150N devices (firmware version 1.2.6, build 110401 Rel.47776n). Affected component is the Diagnostics page’s ping test argument handling, where remote authenticated users can inject shell metacharacters to execute arbitrary OS commands. This is a remot...
CVE-2017-17888
The CVE-2017-17888 entry concerns Anti-Web (up to version 3.8.7) used in multiple industrial/OT devices (NetBiter/HMS, Ouman EH-net, Alliance WS100 → AWU 500, Sauter ERW100F001, Carlo Gavazzi SIU-DLG, AEDILIS SMART-1, SYXTHSENSE WebBiter, ABB SREA, ASCON DY WebServer). Vulnerability: remote authe...
Design/Logic Flaw
Qt for Android prior to 5.9.0 allows remote attackers to execute arbitrary OS commands via unspecified vectors...
CVE-2017-10904
CVE-2017-10904 affects Qt for Android prior to 5.9.0, where remote attackers can execute arbitrary OS commands via unspecified vectors. Root cause is not detailed in the provided documents, but the vulnerability impacts Android builds using Qt’s framework up to version 5.8.x. Practical impact is ...
Design/Logic Flaw
The web server on DBL DBLTek devices allows remote attackers to execute arbitrary OS commands by obtaining the admin password via a frame.html?content=/dev/mtdblock/5 request, and then using this password for the HTTP Basic Authentication needed for a changepassword.csp request, which supports a...
D-Link DIR-850L - OS Command Execution (Metasploit)
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'openssl' class MetasploitModule 'DIR-850L Unauthenticated OS Command Exec', 'Description' = %q This module leverages an unauthenticated credential disclosure...
CVE-2017-16641
lib/rrd.php in Cacti 1.1.27 allows remote authenticated administrators to execute arbitrary OS commands via the pathrrdtool parameter in an action=save request to settings.php...
Netgear DGN1000 1.1.00.48 - 'Setup.cgi' Remote Code Execution (Metasploit)
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Netgear DGN1000 Setup.cgi Unauthenticated RCE', 'Description' = %q This module exploits an unauthenticated OS command execution vulneralbility in...
Netgear DGN1000 Setup.cgi Remote Command Execution
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Netgear DGN1000 Setup.cgi Unauthenticated RCE', 'Description' = %q This module exploits an unauthenticated OS command execution vulneralbility in...
CVE-2017-10813
CG-WLR300NM Firmware version 1.90 and earlier allows an attacker to execute arbitrary OS commands via unspecified vectors...
CVE-2017-10813
CVE-2017-10813 affects Corega CG-WLR300NM firmware 1.90 and earlier. The vulnerability is an OS command injection (OS Command Injection, CWE-78) that can be exploited via an attack vector available to users who can access the device’s administrative console, allowing arbitrary OS commands to be e...
CVE-2017-14135
enigma2-plugins/blob/master/webadmin/src/WebChilds/Script.py in the webadmin plugin for opendreambox 2.0.0 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the command parameter to the /script URI...
Design/Logic Flaw
Buffalo WCR-1166DS devices with firmware 1.30 and earlier allow an attacker to execute arbitrary OS commands via unspecified vectors...
CVE-2017-10811
The CVE-2017-10811 entry affects Buffalo WCR-1166DS devices. Firmware versions 1.30 and earlier are vulnerable to an OS command injection (CWE-78) when an attacker with access to the device’s administrative console can trigger arbitrary OS commands. Root cause is an OS command injection flaw. Imp...
CVE-2017-2281
The CVE-2017-2281 entry affects the I-O DATA WN-AX1167GR wireless router. Firmware version 3.00 and earlier contains an OS command injection vulnerability that could allow an attacker with network access to execute arbitrary OS commands on the device via unspecified vectors. Affected product/vari...