1624 matches found
CVE-2021-28482
Microsoft Exchange Server Remote Code Execution Vulnerability...
CVE-2021-21425: Improper Access Control
Grav Admin Plugin is an HTML user interface that provides a way to configure Grav and create and modify pages. In versions 1.10.7 and earlier, an unauthenticated user can execute some methods of administrator controller without needing any credentials. Particular method execution will result in...
CVE-2021-28113: Improper Neutralization of Special Elements used in an OS Command
A command injection vulnerability in the cookieDomain and relayDomain parameters of Okta Access Gateway before 2020.9.3 allows attackers with admin access to the Okta Access Gateway UI to execute OS commands as a privileged system account...
CVE-2021-20682
CVE-2021-20682 affects baserCMS versions prior to 4.4.5. The vulnerability is an OS command injection that allows a remote attacker with administrative privileges to execute arbitrary commands. Exploitation details are not explicitly provided in the initial documents; however, multiple CVE record...
CVE-2020-10583
CVE-2020-10583 affects Invigo Automatic Device Management (ADM) up to version 5.0. The vulnerability is an arbitrary OS command injection in the /admin/admapi.php script, exploitable by remote authenticated attackers who execute commands on the server as the application user. This is documented a...
CVE-2021-21386
The CVE-2021-21386 entry concerns APKLeaks, an open-source APK scanner. The vulnerability arises in APKLeaks prior to v2.0.3, where a crafted package name inside an Android app manifest can lead to remote command execution on the host system. This could allow an attacker to run arbitrary OS comma...
CVE-2021-26970: Improper Neutralization of Special Elements used in an OS Command
A remote authenticated arbitrary command execution vulnerability was discovered in Aruba AirWave Management Platform versions: Prior to 8.2.12.0. Vulnerabilities in the AirWave web-base management interface could allow remote authenticated users to run arbitrary commands on the underlying host. A...
EPrints Command Injection Vulnerability
EPrints is a free open source software package for building open access repositories compliant with the OAI-PMH protocol. EPrints 3.4.2 suffers from a command injection vulnerability. A remote attacker can exploit this vulnerability by entering specially crafted data into cgi/cal?year= URI to...
CVE-2021-26476
EPrints 3.4.2 allows remote attackers to execute OS commands via crafted LaTeX input to a cgi/cal?year= URI...
CVE-2021-26476
EPrints 3.4.2 allows remote attackers to execute OS commands via crafted LaTeX input to a cgi/cal?year= URI...
CVE-2021-20658
SolarView Compact SV-CPT-MC310 prior to Ver.6.5 allows an attacker to execute arbitrary OS commands with the web server privilege via unspecified vectors...
CVE-2021-20658
CVE-2021-20658 affects SolarView Compact SV-CPT-MC310. The vulnerability is an OS command injection in the web server context, allowing an attacker to execute arbitrary OS commands with the web server’s privileges via unspecified vectors. Affected product/version: SolarView Compact SV-CPT-MC310 p...
CVE-2021-20658
SolarView Compact SV-CPT-MC310 prior to Ver.6.5 allows an attacker to execute arbitrary OS commands with the web server privilege via unspecified vectors...
CVE-2021-20658: Improper Neutralization of Special Elements used in an OS Command
SolarView Compact SV-CPT-MC310 prior to Ver.6.5 allows an attacker to execute arbitrary OS commands with the web server privilege via unspecified vectors...
Acronis: SQL injection in https://www.acronis.cz/ via the log parameter
I have discovered a SQL injection in https://www.acronis.cz/ using the POST request via the log parameter. Using sqlmap, I have retrieved the current user: 'uacronis@localhost'' The command used: sqlmap -p log -r request-cz.txt --current-user --level=2 --risk=2 I did not perform any other actions...
Cyber Criminals Exploit Accellion FTA for Data Theft and Extortion
Starting in mid-December 2020, malicious actors that Mandiant tracks as UNC2546 exploited multiple zero-day vulnerabilities in Accellion’s legacy File Transfer Appliance FTA to install a newly discovered web shell named DEWMODE. The motivation of UNC2546 was not immediately apparent, but starting...
NeDi OS Command Injection Vulnerability
NeDi is an open source software tool that discovers, maps and inventories network devices and tracks connected end nodes. NeDi 1.9C suffers from an OS command injection vulnerability. The vulnerability can be exploited to execute OS commands in the Nodes Traffic function of endpoint...
NeDi <= 1.9C, 2.0 Multiple Vulnerabilities
NeDi is prone to multiple vulnerabilities. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribu...
