CVE-2021-24015

FortiMail before 6.4.4 exposes an OS command injection in its administrative interface. An authenticated attacker can craft specific HTTP requests to execute commands on the device (CWE-78). Impact is user-controlled command execution with high risk; no exploitation details are provided in the do...

CVE-2021-26106

An improper neutralization of special elements used in an OS Command vulnerability in FortiAP's console 6.4.1 through 6.4.5 and 6.2.4 through 6.2.5 may allow an authenticated attacker to execute unauthorized commands by running the kdbg CLI command with specifically crafted arguments...

Command injection

An improper neutralization of special elements used in an OS Command vulnerability in FortiAP's console 6.4.1 through 6.4.5 and 6.2.4 through 6.2.5 may allow an authenticated attacker to execute unauthorized commands by running the kdbg CLI command with specifically crafted arguments...

CVE-2021-26106

An improper neutralization of special elements used in an OS Command vulnerability in FortiAP's console 6.4.1 through 6.4.5 and 6.2.4 through 6.2.5 may allow an authenticated attacker to execute unauthorized commands by running the kdbg CLI command with specifically crafted arguments...

CVE-2021-26106

Fortinet FortiAP OS command injection (CVE-2021-26106) affects FortiAP console versions 6.4.1–6.4.5 and 6.2.4–6.2.5. The vulnerability is due to improper neutralization of special elements in an OS command, enabling an authenticated, local attacker to execute unauthorized commands by issuing the ...

CVE-2021-26106

An improper neutralization of special elements used in an OS Command vulnerability in FortiAP's console 6.4.1 through 6.4.5 and 6.2.4 through 6.2.5 may allow an authenticated attacker to execute unauthorized commands by running the kdbg CLI command with specifically crafted arguments...

Exploit for OS Command Injection in Apache Kylin

CVE-2020-1956 CVE-2020-1956 Apache Kylin...

CVE-2021-32531

OS command injection vulnerability in Init function in QSAN XEVO allows remote attackers to execute arbitrary commands without permissions. The referred vulnerability has been solved with the updated version of QSAN XEVO v2.1.0...

Command injection

OS command injection vulnerability in Array function in QSAN XEVO allows remote unauthenticated attackers to execute arbitrary commands via status parameter. The referred vulnerability has been solved with the updated version of QSAN XEVO v2.1.0...

CVE-2021-32531

The CVE-2021-32531 vulnerability affects QSAN XEVO (flash data management system). It stems from an input handling flaw in the Init function that allows OS command injection, enabling remote attackers to execute arbitrary commands without privileges. Impact is high (CVE-2021-32531, CVSS v3.1: 9.8...

CVE-2021-32530

CVE-2021-32530 describes an OS command injection in the QSAN XEVO product’s Array function, where the status parameter could be used by a remote, unauthenticated attacker to execute arbitrary commands. Reports from multiple sources (NVD entry and CNVD/CNNVD-style disclosures) confirm the vulnerab...

CVE-2021-20739

WRC-300FEBK, WRC-F300NF, WRC-733FEBK, WRH-300RD, WRH-300BK, WRH-300SV, WRH-300WH, WRH-H300WH, WRH-H300BK, WRH-300BK-S, and WRH-300WH-S all versions allows an unauthenticated network-adjacent attacker to execute an arbitrary OS command via unspecified vectors...

Command injection

WRC-300FEBK, WRC-F300NF, WRC-733FEBK, WRH-300RD, WRH-300BK, WRH-300SV, WRH-300WH, WRH-H300WH, WRH-H300BK, WRH-300BK-S, and WRH-300WH-S all versions allows an unauthenticated network-adjacent attacker to execute an arbitrary OS command via unspecified vectors...

CVE-2021-20739

WRC-300FEBK, WRC-F300NF, WRC-733FEBK, WRH-300RD, WRH-300BK, WRH-300SV, WRH-300WH, WRH-H300WH, WRH-H300BK, WRH-300BK-S, and WRH-300WH-S all versions allows an unauthenticated network-adjacent attacker to execute an arbitrary OS command via unspecified vectors...

CVE-2021-20739

CVE-2021-20739 affects ELECOM WRC-300FEBK, WRC-F300NF, WRC-733FEBK, WRH-300RD, WRH-300BK, WRH-300SV, WRH-300WH, WRH-H300WH, WRH-H300BK, WRH-300BK-S, and WRH-300WH-S. Description: unauthenticated, network-adjacent attacker can execute arbitrary OS commands via unspecified vectors. No exploit detai...

FortiMail - OS Command injection

An improper neutralization of special elementsused in an OS Command vulnerability CWE-78 in FortiMail's administrative interface may allow an authenticated attacker to execute unauthorized commands via specifically crafted HTTP requests...

FortiAP - OS command Injection through kdbg CLI command

An instance of improper neutralization of special elements used in an OS Command found in FortiAP's console may allow an authenticated attacker to execute unauthorized commands by running the kdbg CLI command with specifically crafted arguments...

Visual Tools DVR VX16 4.2.28.0 - OS Command Injection (Unauthenticated)

Exploit Title: Visual Tools DVR VX16 4.2.28.0 - OS Command Injection Unauthenticated Date: 2021-07-05 Exploit Author: Andrea D'Ubaldo Vendor Homepage: https://visual-tools.com/ Version: Visual Tools VX16 v4.2.28.0 Tested on: VX16 Embedded Linux 2.6.35.4. CVE: CVE-2021-42071 Reference:...

EulerOS Virtualization 3.0.2.2 : ruby (EulerOS-SA-2021-2167)

According to the versions of the ruby packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - Onigmo through 6.2.0 has a NULL pointer dereference in onigerrorcodetostr because of fetchtoken in regparse.c.CVE-2019-16161 - Onig...

Ricon Industrial Cellular Router S9922XL - Remote Command Execution Exploit

Exploit Title: Ricon Industrial Cellular Router S9922XL - Remote Command Execution RCE Exploit Author: LiquidWorm Vendor Homepage: https://www.riconmobile.com !/usr/bin/env python3 -- coding: utf-8 -- Ricon Industrial Cellular Router S9922XL Remote Command Execution Vendor: Ricon Mobile Inc...