CVE-2021-27104: Improper Neutralization of Special Elements used in an OS Command

Accellion FTA 912370 and earlier is affected by OS command execution via a crafted POST request to various admin endpoints. The fixed version is FTA912380 and later...

CVE-2021-26752

NeDi 1.9C allows an authenticated user to execute operating system commands in the Nodes Traffic function on the endpoint /Nodes-Traffic.php via the md or ag HTTP GET parameter. This allows an attacker to obtain access to the operating system where NeDi is installed and to all application data...

CVE-2021-26752

NeDi 1.9C allows an authenticated user to execute operating system commands in the Nodes Traffic function on the endpoint /Nodes-Traffic.php via the md or ag HTTP GET parameter. This allows an attacker to obtain access to the operating system where NeDi is installed and to all application data...

CVE-2021-20649

CVE-2021-20649 affects ELECOM WRC-300FEBK-S with an improper server certificate verification (CWE-295). A MITM can modify the response, potentially allowing arbitrary OS commands to be executed on the device. Affected product in this CVE entry is the WRC-300FEBK-S; impact is confirmed as remote e...

CVE-2021-20638

LOGITEC LAN-W300N/PGRB allows an attacker with administrative privilege to execute arbitrary OS commands via unspecified vectors...

CVE-2021-20639

LOGITEC LAN-W300N/PGRB allows an attacker with administrative privilege to execute arbitrary OS commands via unspecified vectors...

PT-2021-14101

Name of the Vulnerable Software and Affected Versions: LOGITEC LAN-W300N/PGRB affected versions not specified Description: A buffer overflow issue allows an attacker with administrative privilege to execute an arbitrary OS command via unspecified vectors. There is no information provided about th...

CVE-2021-20649: Improper Certificate Validation

ELECOM WRC-300FEBK-S contains an improper certificate validation vulnerability. Via a man-in-the-middle attack, an attacker may alter the communication response. As a result, an arbitrary OS command may be executed on the affected device...

CVE-2021-20648: Improper Neutralization of Special Elements used in an OS Command

ELECOM WRC-300FEBK-S allows an attacker with administrator rights to execute arbitrary OS commands via unspecified vectors...

CVE-2021-20639: Improper Neutralization of Special Elements used in an OS Command

LOGITEC LAN-W300N/PGRB allows an attacker with administrative privilege to execute arbitrary OS commands via unspecified vectors...

PT-2021-17123

Name of the Vulnerable Software and Affected Versions NeDi version 1.9C Description The issue allows an authenticated user to execute operating system commands in the Nodes Traffic function on the endpoint "/Nodes-Traffic.php" via the md or ag HTTP GET parameter. This enables an attacker to obtai...

PT-2021-11221

Name of the Vulnerable Software and Affected Versions: Dell EMC PowerScale OneFS versions 8.1.0 through 9.1.0 Description: The issue is related to improper input validation, allowing a user with the ISI PRIV CLUSTER privilege to execute arbitrary OS commands on the application's underlying OS wit...

CVE-2020-5626

Logstorage version 8.0.0 and earlier, and ELC Analytics version 3.0.0 and earlier allow remote attackers to execute arbitrary OS commands via a specially crafted log file...

CVE-2020-5626

CVE-2020-5626 affects Logstorage up to v8.0.0 and ELC Analytics up to v3.0.0, where a specially crafted log file can lead to remote OS command execution via the log processing component. The connected records corroborate this as an OS command injection vulnerability in Infoscience log tools, with...

JVN#41853173: OS command injection vulnerability in multiple Infoscience Corporation log management tools

Infoscience Corporation's multiple log management tools provide an FTP upload function as one of the log collection methods, and is able to set to allow the adminitrators to accept FTP uploads. In a situation where the FTP upload function is enabled and there is a flaw of input value handling in...

CVE-2021-3291

Zen Cart 1.5.7b allows admins to execute arbitrary OS commands by inspecting an HTML radio input element within the modules edit page and inserting a command...

CVE-2021-3291

Zen Cart 1.5.7b allows admins to execute arbitrary OS commands by inspecting an HTML radio input element within the modules edit page and inserting a command...

CVE-2020-35578

Nagios XI before 5.8.0 is affected by CVE-2020-35578 in the Manage Plugins page. The issue arises from mishandled line-ending conversion during plugin uploads, allowing a remote, authenticated admin to execute operating-system commands and achieve remote code execution (as the apache user) via a ...

CVE-2020-5685

UNIVERGE SV9500 series from V1 to V7and SV8500 series from S6 to S8 allows an attacker to execute arbitrary OS commands or cause a denial-of-service DoS condition by sending a specially crafted request to a specific URL...

Design/Logic Flaw

UNIVERGE SV9500 series from V1 to V7and SV8500 series from S6 to S8 allows an attacker to execute arbitrary OS commands or cause a denial-of-service DoS condition by sending a specially crafted request to a specific URL...