1787 matches found
CVE-2020-10789
openITCOCKPIT before 3.7.3 has a web-based terminal that allows attackers to execute arbitrary OS commands via shell metacharacters that are mishandled on an su command line in app/Lib/SudoMessageInterface.php...
CVE-2020-10789
OpenITCOCKPIT prior to version 3.7.3 exposes a web-based terminal that can execute arbitrary OS commands due to mishandling of shell metacharacters in the su path (app/Lib/SudoMessageInterface.php). Affected product/component: OpenITCOCKPIT web UI; root cause: improper handling of shell metachara...
CVE-2020-5561
Keijiban Tsumiki v1.15 allows remote attackers to execute arbitrary OS commands via unspecified vectors...
CVE-2020-5561: Improper Neutralization of Special Elements used in an OS Command
Keijiban Tsumiki v1.15 allows remote attackers to execute arbitrary OS commands via unspecified vectors...
CVE-2020-10674
PerlSpeak through 2.01 allows attackers to execute arbitrary OS commands, as demonstrated by use of system and 2-argument open...
CVE-2020-10674
CVE-2020-10674 affects PerlSpeak up to version 2.01, where an attacker can execute arbitrary operating-system commands via Perl’s system call and a two-argument open. This is documented across multiple sources (NVD, Red Hat CVE entry, and related feeds). The Red Hat entry reiterates the same desc...
CVE-2019-18582
Dell EMC Data Protection Advisor versions 6.3, 6.4, 6.5, 18.2 versions prior to patch 83, and 19.1 versions prior to patch 71 contain a server-side template injection vulnerability in the REST API. A remote authenticated malicious user with administrative privileges may potentially exploit this...
Sql injection
Dell EMC Data Protection Advisor versions 6.3, 6.4, 6.5, 18.2 versions prior to patch 83, and 19.1 versions prior to patch 71 contain a server-side template injection vulnerability in the REST API. A remote authenticated malicious user with administrative privileges may potentially exploit this...
CVE-2019-18581
Dell EMC Data Protection Advisor versions 6.3, 6.4, 6.5, 18.2 versions prior to patch 83, and 19.1 versions prior to patch 71 contain a server missing authorization vulnerability in the REST API. A remote authenticated malicious user with administrative privileges may potentially exploit this...
CVE-2019-18582
Dell EMC Data Protection Advisor versions 6.3, 6.4, 6.5, 18.2 versions prior to patch 83, and 19.1 versions prior to patch 71 contain a server-side template injection vulnerability in the REST API. A remote authenticated malicious user with administrative privileges may potentially exploit this...
CVE-2019-18582
Dell EMC Data Protection Advisor (DPA) REST API versions 6.3/6.4/6.5, 18.2 before patch 83, and 19.1 before patch 71 are affected by a server-side template injection vulnerability. A remote authenticated attacker with admin privileges can inject scripts via the report generation feature, potentia...
PT-2020-9968
Name of the Vulnerable Software and Affected Versions: Dell EMC Data Protection Advisor versions 6.3, 6.4, 6.5 Dell EMC Data Protection Advisor versions 18.2 prior to patch 83 Dell EMC Data Protection Advisor versions 19.1 prior to patch 71 Description: The issue concerns a server-side template...
PT-2020-9967
Name of the Vulnerable Software and Affected Versions: Dell EMC Data Protection Advisor versions 6.3 through 6.5 Dell EMC Data Protection Advisor version 18.2 prior to patch 83 Dell EMC Data Protection Advisor version 19.1 prior to patch 71 Description: The issue concerns a server missing...
CVE-2020-10674: Improper Neutralization of Special Elements used in an OS Command
PerlSpeak through 2.01 allows attackers to execute arbitrary OS commands, as demonstrated by use of system and 2-argument open...
CVE-2019-18582: Improper Control of Generation of Code
Dell EMC Data Protection Advisor versions 6.3, 6.4, 6.5, 18.2 versions prior to patch 83, and 19.1 versions prior to patch 71 contain a server-side template injection vulnerability in the REST API. A remote authenticated malicious user with administrative privileges may potentially exploit this...
CVE-2019-18581: Missing Authorization
Dell EMC Data Protection Advisor versions 6.3, 6.4, 6.5, 18.2 versions prior to patch 83, and 19.1 versions prior to patch 71 contain a server missing authorization vulnerability in the REST API. A remote authenticated malicious user with administrative privileges may potentially exploit this...
CVE-2019-5175
An exploitable command injection vulnerability exists in the iocheckd service ‘I/O-Check’ function of the WAGO PFC 200 Firmware version 03.02.0214. A specially crafted XML cache file written to a specific location on the device can be used to inject OS commands. An attacker can send a specially...
rConfig < 3.9.5 Multiple Vulnerabilities
rConfig is prone to multiple vulnerabilities. Copyright C 2020 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation;...