CVE-2021-3291

Zen Cart 1.5.7b allows admins to execute arbitrary OS commands by inspecting an HTML radio input element within the modules edit page and inserting a command...

CVE-2020-35578

Nagios XI before 5.8.0 is affected by CVE-2020-35578 in the Manage Plugins page. The issue arises from mishandled line-ending conversion during plugin uploads, allowing a remote, authenticated admin to execute operating-system commands and achieve remote code execution (as the apache user) via a ...

CVE-2020-5685

UNIVERGE SV9500 series from V1 to V7and SV8500 series from S6 to S8 allows an attacker to execute arbitrary OS commands or cause a denial-of-service DoS condition by sending a specially crafted request to a specific URL...

Design/Logic Flaw

UNIVERGE SV9500 series from V1 to V7and SV8500 series from S6 to S8 allows an attacker to execute arbitrary OS commands or cause a denial-of-service DoS condition by sending a specially crafted request to a specific URL...

CVE-2020-5685

The CVE-2020-5685 exposure affects UNIVERGE SV9500 series (V1–V7) and SV8500 series (S6–S8). The issue is an OS command injection vulnerability in the Remote System Maintenance web console, triggered by a specially crafted request to a specific URL, allowing an attacker to execute arbitrary OS co...

CVE-2020-5685: Improper Neutralization of Special Elements used in an OS Command

UNIVERGE SV9500 series from V1 to V7and SV8500 series from S6 to S8 allows an attacker to execute arbitrary OS commands or cause a denial-of-service DoS condition by sending a specially crafted request to a specific URL...

CVE-2020-35578: Improper Neutralization of Special Elements used in an OS Command

An issue was discovered in the Manage Plugins page in Nagios XI before 5.8.0. Because the line-ending conversion feature is mishandled during a plugin upload, a remote, authenticated admin user can execute operating-system commands...

MTN Group: Blind SQL Injection

hello dear support I have found Blind SQL Injection on https://futexpert.mtngbissau.com/signin/ parameters injectable phonenumber=0&pin=1&submit=Continuar via post URL:https://futexpert.mtngbissau.com/signin/ Post: email=0 my payload :...

CVE-2020-35714: Improper Neutralization of Special Elements used in an OS Command

Belkin LINKSYS RE6500 devices before 1.0.11.001 allow remote authenticated users to execute arbitrary commands via goform/systemCommand?command= in conjunction with the goform/pingstart program...

CVE-2020-35657

Jaws through 1.8.0 allows remote authenticated administrators to execute arbitrary code via crafted use of UploadTheme to upload a theme ZIP archive containing a .php file that is able to execute OS commands. NOTE: this is unrelated to the JAWS aka Job Access With Speech product...

CVE-2020-24581

CVE-2020-24581 affects D-Link DSL-2888A devices with firmware prior to AU_2.31_V1.1.47ae55. The issue stems from an execute_cmd.cgi feature (not reachable via the web UI) that allows an authenticated user to execute Operating System commands, enabling potential arbitrary command execution on the ...

CVE-2020-24581: Improper Neutralization of Special Elements used in an OS Command

An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU2.31V1.1.47ae55. It contains an executecmd.cgi feature that is not reachable via the web user interface that lets an authenticated user execute Operating System commands...

CVE-2020-25617

SolarWinds N-Central 12.3.0.670 contains a relative path traversal flaw in the AdvancedScripts HTTP endpoint . An authenticated user can exploit this to execute OS commands as root via the NAC interface, as described across multiple sources (NVD/Red Hat/CNVD listings). The root cause is path trav...

Directory traversal

Directory traversal vulnerability in FileZen versions from V3.0.0 to V4.2.2 allows remote attackers to upload an arbitrary file in a specific directory via unspecified vectors. As a result, an arbitrary OS command may be executed...

CVE-2020-5639

FileZen vulnerable to a directory traversal (CWE-22) in versions V3.0.0–V4.2.2, enabling a remote attacker to upload an arbitrary file to a specific directory and potentially execute arbitrary OS commands. Root cause is a directory traversal flaw in the affected FileZen appliances. Remediation pr...

CVE-2020-5639: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in FileZen versions from V3.0.0 to V4.2.2 allows remote attackers to upload an arbitrary file in a specific directory via unspecified vectors. As a result, an arbitrary OS command may be executed...

CVE-2020-19142

The CVE-2020-19142 entry describes a vulnerability in iCMS 7 where an attacker can execute arbitrary OS commands by injecting shell metacharacters into the DB_PREFIX parameter used by install/install.php. The issue permits unauthenticated remote command execution with high to critical impact (as ...

CVE-2020-19527

CVE-2020-19527 affects iCMS 7.0.14. An attacker can execute arbitrary OS commands by injecting shell metacharacters into the DB_NAME parameter in install/install.php. Documented impact is critical (C/H/I/A) with network attack vector and no user interaction. No remediation/version details are pro...

CVE-2020-19527

iCMS 7.0.14 attackers to execute arbitrary OS commands via shell metacharacters in the DBNAME parameter to install/install.php...

FileZen vulnerable to directory traversal

Overview FileZen provided by Soliton Systems K.K. is an appliance for secure file transfer and sharing by mail or an web interface. FileZen contains a directory traversal vulnerability CWE-22. Soliton Systems K.K. reported this vulnerability to IPA to notify users of its solution through JVN...