CVE-2021-26472

CVE-2021-26472 affects VembuBDR (pre-4.2.0.1) and VembuOffsiteDR (pre-4.2.0.1) on Windows. The http API at /consumerweb/secure/download.php allows an unauthenticated attacker to inject commands and execute arbitrary OS commands with SYSTEM privileges. No remediation details are provided in the co...

PT-2021-17018

Name of the Vulnerable Software and Affected Versions VembuBDR versions prior to 4.2.0.1 VembuOffsiteDR versions prior to 4.2.0.1 Description The issue allows an unauthenticated attacker to execute arbitrary OS commands with SYSTEM privileges. This can be achieved by exploiting the http API locat...

GHSA-H72C-W3Q3-55QQ OS Command Injection in jw.util

An exploitable vulnerability exists in the configuration-loading functionality of the jw.util package before 2.3 for Python. When loading a configuration with FromString or FromStream with YAML, one can execute arbitrary Python code, resulting in OS command execution, because safeload is not used...

CVE-2020-26670: Improper Neutralization of Special Elements used in an OS Command

A vulnerability has been discovered in BigTree CMS 4.4.10 and earlier which allows an authenticated attacker to execute arbitrary commands through a crafted request sent to the server via the 'Create a New Setting' function...

PT-2021-14177

Name of the Vulnerable Software and Affected Versions: RFNTPS firmware versions System 01000004 and earlier RFNTPS firmware versions Web 01000004 and earlier Description: The issue allows an attacker on the same network segment to execute arbitrary OS commands with a root privilege via unspecifie...

CVE-2021-32605

The CVE-2021-32605 entry concerns zzzcms/zzzphp before 2.0.4, where the parserIfLabel template processing fails to validate user-provided keys in the ?location=search flow, enabling remote code execution. The vulnerability allows an attacker to run arbitrary OS commands or code via a crafted keys...

CVE-2021-30228: Improper Neutralization of Special Elements used in an OS Command

The api/ZRAndlink/setZRAndlink interface in China Mobile An Lianbao WF-1 router 1.0.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the iandlinkprocenable parameter...

CVE-2020-22000

HomeAutomation 3.3.2 suffers from an authenticated OS command execution vulnerability using custom command v0.1 plugin. This can be exploited with a CSRF vulnerability to execute arbitrary shell commands as the web user via the 'setcommandon' and 'setcommandoff' POST parameters in...

CVE-2020-22000

HomeAutomation 3.3.2 suffers from an authenticated OS command execution vulnerability using custom command v0.1 plugin. This can be exploited with a CSRF vulnerability to execute arbitrary shell commands as the web user via the 'setcommandon' and 'setcommandoff' POST parameters in...

Design/Logic Flaw

HomeAutomation 3.3.2 suffers from an authenticated OS command execution vulnerability using custom command v0.1 plugin. This can be exploited with a CSRF vulnerability to execute arbitrary shell commands as the web user via the 'setcommandon' and 'setcommandoff' POST parameters in...

CVE-2020-22000

CVE-2020-22000 affects HomeAutomation 3.3.2. An authenticated OS command execution vulnerability exists in the customcommand v0.1 plugin, exploitable via CSRF to run arbitrary shell commands as the web user through unsanitized PHP exec() calls in /system/systemplugins/customcommand/customcommand....

PT-2021-18782

Name of the Vulnerable Software and Affected Versions Symantec Security Analytics versions 7.2 prior to 7.2.7 Symantec Security Analytics version 8.1 prior to 8.1.3-NSR3 Symantec Security Analytics version 8.2 prior to 8.2.1-NSR2 or 8.2.2 Description An input validation flaw in the web UI allows ...

CVE-2020-22000: Improper Neutralization of Special Elements used in an OS Command

HomeAutomation 3.3.2 suffers from an authenticated OS command execution vulnerability using custom command v0.1 plugin. This can be exploited with a CSRF vulnerability to execute arbitrary shell commands as the web user via the 'setcommandon' and 'setcommandoff' POST parameters in...

PT-2021-10715

Name of the Vulnerable Software and Affected Versions HomeAutomation version 3.3.2 Description The issue allows for authenticated OS command execution using the custom command v0.1 plugin. This can be exploited, in conjunction with a CSRF vulnerability, to execute arbitrary shell commands as the...

CVE-2021-20708

NEC Aterm devices Aterm WF1200CR firmware Ver1.3.2 and earlier, Aterm WG1200CR firmware Ver1.3.3 and earlier, and Aterm WG2600HS firmware Ver1.5.1 and earlier allow authenticated attackers to execute arbitrary OS commands by sending a specially crafted request to a specific URL...

CVE-2021-20709

Improper validation of integrity check value vulnerability in NEC Aterm WF1200CR firmware Ver1.3.2 and earlier, Aterm WG1200CR firmware Ver1.3.3 and earlier, and Aterm WG2600HS firmware Ver1.5.1 and earlier allows an attacker with an administrative privilege to execute arbitrary OS commands by...

Design/Logic Flaw

Aterm WG2600HS firmware Ver1.5.1 and earlier allows an attacker to execute arbitrary OS commands via unspecified vectors...

CVE-2021-20711

CVE-2021-20711 affects NEC Aterm WG2600HS firmware (versions 1.5.1 and earlier). The vulnerability enables an attacker to execute arbitrary OS commands via unspecified vectors, with the specific CVE recognized in multiple sources (including JVN and CVE entries). The JVN/CNNVD/CVE records and rela...

CVE-2021-20708

CVE-2021-20708 affects NEC Aterm devices (WF1200CR: v1.3.2 and earlier; WG1200CR: v1.3.3 and earlier; WG2600HS: v1.5.1 and earlier) and allows authenticated attackers to execute arbitrary OS commands by sending a crafted request to a specific URL. Connected sources also reference related CVEs in ...

CVE-2021-27691

Command Injection in Tenda G0 routers with firmware versions v15.11.0.69039CN and v15.11.0.55876CN , and Tenda G1 and G3 routers with firmware versions v15.11.0.179502CN or v15.11.0.169024CN allows remote attackers to execute arbitrary OS commands via a crafted action/setDebugCfg request. This...