CVE-2020-35578: Improper Neutralization of Special Elements used in an OS Command

An issue was discovered in the Manage Plugins page in Nagios XI before 5.8.0. Because the line-ending conversion feature is mishandled during a plugin upload, a remote, authenticated admin user can execute operating-system commands...

MTN Group: Blind SQL Injection

hello dear support I have found Blind SQL Injection on https://futexpert.mtngbissau.com/signin/ parameters injectable phonenumber=0&pin=1&submit=Continuar via post URL:https://futexpert.mtngbissau.com/signin/ Post: email=0 my payload :...

CVE-2020-35714: Improper Neutralization of Special Elements used in an OS Command

Belkin LINKSYS RE6500 devices before 1.0.11.001 allow remote authenticated users to execute arbitrary commands via goform/systemCommand?command= in conjunction with the goform/pingstart program...

CVE-2020-35657

Jaws through 1.8.0 allows remote authenticated administrators to execute arbitrary code via crafted use of UploadTheme to upload a theme ZIP archive containing a .php file that is able to execute OS commands. NOTE: this is unrelated to the JAWS aka Job Access With Speech product...

CVE-2020-24581

CVE-2020-24581 affects D-Link DSL-2888A devices with firmware prior to AU_2.31_V1.1.47ae55. The issue stems from an execute_cmd.cgi feature (not reachable via the web UI) that allows an authenticated user to execute Operating System commands, enabling potential arbitrary command execution on the ...

CVE-2020-24581: Improper Neutralization of Special Elements used in an OS Command

An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU2.31V1.1.47ae55. It contains an executecmd.cgi feature that is not reachable via the web user interface that lets an authenticated user execute Operating System commands...

CVE-2020-25617

SolarWinds N-Central 12.3.0.670 contains a relative path traversal flaw in the AdvancedScripts HTTP endpoint . An authenticated user can exploit this to execute OS commands as root via the NAC interface, as described across multiple sources (NVD/Red Hat/CNVD listings). The root cause is path trav...

PT-2020-16129

Name of the Vulnerable Software and Affected Versions SolarWinds N-Central version 12.3.0.670 Description An issue was discovered in SolarWinds N-Central, where the AdvancedScripts HTTP endpoint allows Relative Path Traversal by an authenticated user of the N-Central Administration Console NAC,...

Directory traversal

Directory traversal vulnerability in FileZen versions from V3.0.0 to V4.2.2 allows remote attackers to upload an arbitrary file in a specific directory via unspecified vectors. As a result, an arbitrary OS command may be executed...

CVE-2020-5639

FileZen vulnerable to a directory traversal (CWE-22) in versions V3.0.0–V4.2.2, enabling a remote attacker to upload an arbitrary file to a specific directory and potentially execute arbitrary OS commands. Root cause is a directory traversal flaw in the affected FileZen appliances. Remediation pr...

CVE-2020-5639: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in FileZen versions from V3.0.0 to V4.2.2 allows remote attackers to upload an arbitrary file in a specific directory via unspecified vectors. As a result, an arbitrary OS command may be executed...

PT-2020-18606

Name of the Vulnerable Software and Affected Versions FileZen versions 3.0.0 through 4.2.2 Description A directory traversal issue allows remote attackers to upload arbitrary files to specific directories via unspecified vectors, potentially leading to the execution of arbitrary OS commands...

CVE-2020-19142

The CVE-2020-19142 entry describes a vulnerability in iCMS 7 where an attacker can execute arbitrary OS commands by injecting shell metacharacters into the DB_PREFIX parameter used by install/install.php. The issue permits unauthenticated remote command execution with high to critical impact (as ...

CVE-2020-19527

iCMS 7.0.14 attackers to execute arbitrary OS commands via shell metacharacters in the DBNAME parameter to install/install.php...

CVE-2020-19527

CVE-2020-19527 affects iCMS 7.0.14. An attacker can execute arbitrary OS commands by injecting shell metacharacters into the DB_NAME parameter in install/install.php. Documented impact is critical (C/H/I/A) with network attack vector and no user interaction. No remediation/version details are pro...

FileZen vulnerable to directory traversal

Overview FileZen provided by Soliton Systems K.K. is an appliance for secure file transfer and sharing by mail or an web interface. FileZen contains a directory traversal vulnerability CWE-22. Soliton Systems K.K. reported this vulnerability to IPA to notify users of its solution through JVN...

JVN#12884935: FileZen vulnerable to directory traversal

FileZen provided by Soliton Systems K.K. is an appliance for secure file transfer and sharing by mail or an web interface. FileZen contains a directory traversal vulnerability CWE-22. Impact A remote attacker may upload an arbitrary file in the specific directory in the product. If a specialy...

PT-2020-15168

Name of the Vulnerable Software and Affected Versions iCMS version 7 Description The issue allows attackers to execute arbitrary OS commands via shell metacharacters in the DB PREFIX parameter to install/install.php. This enables them to potentially install malicious software or perform other...

Prototype Pollution

systeminformation is vulnerable to prototype pollution. An attacker is able to overwrite arbitrary properties and functions of an object such as prototype or proto, potentially resulting in OS command execution...

Design/Logic Flaw

This affects the package systeminformation before 4.30.2. The attacker can overwrite the properties and functions of an object, which can lead to executing OS commands...