Apache SpamAssassin Command Execution Vulnerability (CNVD-2020-07221)

Apache SpamAssassin is an open source spam filter from the Apache USA Foundation. The product provides system administrators with a filter and support for categorizing email to block spam. An operating system command execution vulnerability exists in Apache SpamAssassin versions prior to 3.4.3. T...

CVE-2020-8438

Ruckus ZoneFlex R500 104.0.0.0.1347 devices allow an authenticated attacker to execute arbitrary OS commands via the hidden /forms/nslookupHandler form, as demonstrated by the nslookuptarget=|cat$IFS substring...

CVE-2020-8438

Ruckus ZoneFlex R500 104.0.0.0.1347 devices allow an authenticated attacker to execute arbitrary OS commands via the hidden /forms/nslookupHandler form, as demonstrated by the nslookuptarget=|cat$IFS substring...

CVE-2020-8438

The CVE-2020-8438 entry concerns Ruckus ZoneFlex R500 devices (reported as version 104.0.0.0.1347) where an authenticated attacker can execute arbitrary OS commands through the hidden /forms/nslookupHandler form, demonstrated by the nslookuptarget=|cat${IFS} payload. The connected documents provi...

CVE-2020-8438

Ruckus ZoneFlex R500 104.0.0.0.1347 devices allow an authenticated attacker to execute arbitrary OS commands via the hidden /forms/nslookupHandler form, as demonstrated by the nslookuptarget=|cat$IFS substring...

CVE-2019-20215

CVE-2019-20215 affects D-Link DIR-859 firmware 1.05 and 1.06B01 Beta01. It is a remote code execution vulnerability in the ssdpcgi() M-SEARCH handling, where the urn: service/device string is checked via strstr, enabling an attacker to append arbitrary shell commands. Related entries note additio...

PT-2020-1833

Name of the Vulnerable Software and Affected Versions D-Link DIR-859 versions 1.05 through 1.06B01 Beta01 Description The issue allows remote attackers to execute arbitrary OS commands via a urn: to the M-SEARCH method in ssdpcgi in /htdocs/cgibin, because HTTP ST is mishandled. The value of the...

PT-2020-1834

Name of the Vulnerable Software and Affected Versions D-Link DIR-859 versions 1.05 through 1.06B01 Beta01 Description The issue exists due to the mishandling of the REMOTE PORT component in the D-Link DIR-859 router's firmware, allowing an attacker to execute arbitrary OS commands. This can be...

PT-2020-1838

Name of the Vulnerable Software and Affected Versions D-Link DIR-859 versions 1.05 through 1.06B01 Beta01 Description The issue exists due to the mishandling of the SERVER ID component in the D-Link DIR-859 router's firmware, allowing a remote attacker to execute arbitrary OS commands. This is...

CVE-2019-19824

On certain TOTOLINK Realtek SDK based routers, an authenticated attacker may execute arbitrary OS commands via the sysCmd parameter to the boafrm/formSysCmd URI, even if the GUI syscmd.htm is not available. This allows for full control over the device's internals. This affects A3002RU through...

CVE-2020-7980

Intellian Aptus Web 1.24 allows remote attackers to execute arbitrary OS commands via the Q field within JSON data to the cgi-bin/libagent.cgi URI. NOTE: a valid sid cookie for a login to the intellian default account might be needed...

CVE-2019-19838

emfd in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote attackers to execute OS commands via a POST request with the attribute xcmd=get-platform-depends to admin/cmdstat.jsp via the uploadFile attribute...

CVE-2019-19839

emfd in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote attackers to execute OS commands via a POST request with the attribute xcmd=import-category to admin/cmdstat.jsp via the uploadFile attribute...

CVE-2019-19839

CVE-2019-19839 affects Ruckus Wireless Unleashed emfd; a remote attacker can execute OS commands by sending a POST to admin/_cmdstat.jsp with xcmd=import-category via the uploadFile attribute. Root cause is improper handling of the xcmd=import-category parameter in emfd, enabling command executio...

CVE-2019-19838

emfd in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote attackers to execute OS commands via a POST request with the attribute xcmd=get-platform-depends to admin/cmdstat.jsp via the uploadFile attribute...

CVE-2019-19838

CVE-2019-19838 affects Ruckus Wireless Unleashed firmware (emfd) up to and including 200.7.10.102.64. The issue allows remote command execution when an attacker crafts a POST to admin/_cmdstat.jsp with the uploadFile attribute and the xcmd=get-platform-depends parameter, triggering OS commands on...

PT-2020-10254

Name of the Vulnerable Software and Affected Versions Ruckus Wireless Unleashed versions through 200.7.10.102.64 Description The issue allows remote attackers to execute OS commands. This can be achieved by sending a POST request with the attribute xcmd=import-category to "admin/ cmdstat.jsp" via...

PT-2020-10253

Name of the Vulnerable Software and Affected Versions Ruckus Wireless Unleashed versions through 200.7.10.102.64 Description The issue allows remote attackers to execute OS commands. This can be achieved by sending a POST request with the attribute xcmd set to get-platform-depends to the "admin/...

CVE-2019-19839: Improper Neutralization of Special Elements used in an OS Command

emfd in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote attackers to execute OS commands via a POST request with the attribute xcmd=import-category to admin/cmdstat.jsp via the uploadFile attribute...

CVE-2019-19842

CVE-2019-19842 affects Ruckus Wireless Unleashed firmware (example: 200.7.10.102.64). It allows remote command execution by sending a POST to admin/_cmdstat.jsp with the attribute xcmd=spectra-analysis and the mac attribute. This is a network-accessible issue with an attacker having no authentica...