Command injection

Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to an authenticated blind OS Command Injection...

CVE-2020-12513

Pepperl+Fuchs Comtrol IO-Link Master Series is affected by CVE-2020-12513. Vulnerable versions include System 1.36 and Application 1.5.28 (and 1.5.48 and earlier per CVE listing) with an authenticated blind OS Command Injection. Fixed versions are System 1.52 and Application 1.6.11. The vulnerabi...

Exploit for OS Command Injection in Xstream

Description XStream can be used for Remote Code Execution...

CVE-2021-3190

The CVE-2021-3190 issue affects the Node.js package async-git prior to 1.13.2, where OS Command Injection via shell metacharacters (demonstrated by git.reset and git.tag) is possible. The vulnerability may enable remote code execution in vulnerable environments. A remediation is to upgrade async-...

Exploit for OS Command Injection in Seowonintech Slc-130_Firmware

Description On August 21, 2020, seown SLC 130 router was exp...

CVE-2020-27298

Philips CVE-2020-27298 affects Interventional Workspot (1.3.2–1.4.5), Coronary Tools/Dynamic Coronary Roadmap/Stentboost Live (1.0), and ViewForum (6.3V1L10). Root cause: improper neutralization of special characters when constructing OS commands from externally influenced input, enabling OS comm...

PT-2021-11378 · Philips · Philips Interventional Workspot +1

Name of the Vulnerable Software and Affected Versions: Philips Interventional Workspot versions 1.3.2 through 1.4.5 Coronary Tools/Dynamic Coronary Roadmap/Stentboost Live version 1.0 ViewForum version 6.3V1L10 Description: The software constructs all or part of an OS command using externally...

Philips Interventional Workstations

1. EXECUTIVE SUMMARY CVSS v3 6.5 ATTENTION: Low skill level to exploit Vendor: Philips Equipment: Philips Interventional WorkSpot, Coronary Tools/Dynamic Coronary Roadmap/Stentboost Live, ViewForum Vulnerability: OS Command Injection 2. RISK EVALUATION Successful exploitation of this...

CVE-2020-29495

DELL EMC Avamar Server, versions 19.1, 19.2, 19.3, contain an OS Command Injection Vulnerability in Fitness Analyzer. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the application's underlying OS with high...

CVE-2020-29495

DELL EMC Avamar Server, versions 19.1, 19.2, 19.3, contain an OS Command Injection Vulnerability in Fitness Analyzer. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the application's underlying OS with high...

CVE-2020-29495

Dell EMC Avamar Server (versions 19.1–19.3) contains an OS Command Injection vulnerability in Fitness Analyzer. Exploitation requires remote access with no authentication and can lead to arbitrary OS commands execution on the underlying OS with high privileges, effectively risking full compromise...

CVE-2020-29495

DELL EMC Avamar Server, versions 19.1, 19.2, 19.3, contain an OS Command Injection Vulnerability in Fitness Analyzer. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the application's underlying OS with high...

CVE-2020-29017

CVE-2020-29017 is an OS command injection vulnerability in FortiDeceptor (versions 3.1.0, 3.0.1, 3.0.0) that lets an authenticated remote attacker execute arbitrary commands on the system. The root cause is a command injection on the Customization page of the FortiDeceptor management interface. E...

Improper access control

Improper access control vulnerability in acmailer ver. 4.0.1 and earlier, and acmailer DB ver. 1.1.3 and earlier allows remote attackers to execute an arbitrary OS command, or gain an administrative privilege which may result in obtaining the sensitive information on the server via unspecified...

JVN#35906450: Multiple vulnerabilities in acmailer

acmailer provided by Seeds Co.,Ltd. contains multiple vulnerabilities listed below. Improper Access Control CWE-284 - CVE-2021-20617 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H| Base Score: 9.8 CVSS v2| AV:N/AC:L/Au:N/C:P/I:P/A:P| Base Score: 7.5...

CVE-2020-35578

Nagios XI before 5.8.0 is affected by CVE-2020-35578 in the Manage Plugins page. The issue arises from mishandled line-ending conversion during plugin uploads, allowing a remote, authenticated admin to execute operating-system commands and achieve remote code execution (as the apache user) via a ...

CVE-2020-5685

UNIVERGE SV9500 series from V1 to V7and SV8500 series from S6 to S8 allows an attacker to execute arbitrary OS commands or cause a denial-of-service DoS condition by sending a specially crafted request to a specific URL...

Design/Logic Flaw

UNIVERGE SV9500 series from V1 to V7and SV8500 series from S6 to S8 allows an attacker to execute arbitrary OS commands or cause a denial-of-service DoS condition by sending a specially crafted request to a specific URL...

CVE-2020-5685

The CVE-2020-5685 exposure affects UNIVERGE SV9500 series (V1–V7) and SV8500 series (S6–S8). The issue is an OS command injection vulnerability in the Remote System Maintenance web console, triggered by a specially crafted request to a specific URL, allowing an attacker to execute arbitrary OS co...

CVE-2020-5146

A vulnerability in SonicWall SMA100 appliance allow an authenticated management-user to perform OS command injection using HTTP POST parameters. This vulnerability affected SMA100 Appliance version 10.2.0.2-20sv and earlier...