1071 matches found
CVE-2019-11444
An issue was discovered in Liferay Portal CE 7.1.2 GA3. An attacker can use Liferay's Groovy script console to execute OS commands. Commands can be executed via a command.execute call, as demonstrated by "def cmd =" in the ServerAdminPortletscript value to group/controlpanel/manage. Valid...
PT-2019-12309 · Liferay · Liferay Portal
Name of the Vulnerable Software and Affected Versions: Liferay Portal CE version 7.1.2 GA3 Description: An issue in Liferay Portal CE allows an attacker to execute OS commands using the Groovy script console. This can be achieved via a command.execute call. The attacker needs valid credentials fo...
CVE-2018-20323
www/soap/application/MCSoap/Logs.php in MailCleaner Community Edition 2018.08 allows remote attackers to execute arbitrary OS commands...
CVE-2018-20323
CVE-2018-20323 affects MailCleaner Community Edition 2018.08. The vulnerability is a command-injection in www/soap/application/MCSoap/Logs.php that allows an authenticated user to execute arbitrary OS commands on the web server when accessing the /admin/managetracing/search/search endpoint. Publi...
[SECURITY] [DLA 1700-1] uw-imap security update
Package : uw-imap Version : 8:2007fdfsg-4+deb8u1 CVE ID : CVE-2018-19518 Debian Bug : 914632 A vulnerability was discovered in uw-imap, the University of Washington IMAP Toolkit, that might allow remote attackers to execute arbitrary OS commands if the IMAP server name is untrusted input e.g.,...
PT-2019-6248 · Vim +8 · Vim +8
Name of the Vulnerable Software and Affected Versions: Vim versions prior to 8.1.0881 Description: The issue is related to the lack of input sanitization in the Vim text editor, allowing an attacker to access confidential data, compromise its integrity, and cause a denial of service. In Vim, user...
CVE-2018-0638
Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via import.cgi encKey parameter...
CVE-2018-0639
Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via toolsfirmware.cgi date parameter, time parameter, and offset parameter...
CVE-2018-0637
Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via export.cgi encKey parameter...
Sql injection
Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via toolsfirmware.cgi date parameter, time parameter, and offset parameter...
Design/Logic Flaw
Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via export.cgi encKey parameter...
Design/Logic Flaw
Aterm W300P Ver1.0.13 and earlier allows attacker with administrator rights to execute arbitrary OS commands via targetAPSsid parameter...
CVE-2018-0636
Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via FactoryPassword parameter of a certain URL, different URL from CVE-2018-0634...
CVE-2018-0638
The CVE-2018-0638 issue affects NEC/Aterm HC100RC devices (firmware Ver1.0.1 and earlier). A local-administrator level attacker can exploit an OS command injection via the import.cgi encKey parameter to execute arbitrary commands on the underlying OS. The vulnerability arises in the product’s web...
CVE-2018-16200
CVE-2018-16200 affects Toshiba Home gateway HEM-GW16A and HEM-GW26A with firmware versions 1.2.9 and earlier. The provided documents indicate an OS command injection vulnerability that allows an attacker on the same network segment to execute arbitrary OS commands on the affected device. The root...
CVE-2018-0634
NEC Aterm HC100RC router (Firmware v1.0.1 and earlier) is affected by CVE-2018-0634 and related CVEs. A local attacker with administrator rights can execute arbitrary OS commands by supplying crafted values to the FactoryPassword or bootmode URL parameters. The issue is documented across multiple...
CVE-2018-0626
The CVE-2018-0626 entry concerns NEC Aterm WG1200HP routers. Affected firmware: Version 1.0.31 and earlier. Vulnerability: an OS command injection via the sysCmd parameter in formWsc, exploitable by an attacker with administrator rights to execute arbitrary OS commands. Impact is demonstrated as ...
CVE-2018-0629
Aterm W300P (NEC) firmware Ver1.0.13 and earlier is affected by CVE-2018-0629. The vulnerability is an OS command injection (CWE-78) in the device’s HTTP handling that allows an administrator-level attacker to execute arbitrary commands on the OS via HTTP requests/responses. The impact is elevate...
CVE-2018-0631
CVE-2018-0631 affects the NEC Aterm W300P router (firmware version: Ver1.0.13 and earlier). The vulnerability allows an attacker with administrative privileges to execute arbitrary operating system commands via the targetAPSsid parameter. Underlying issue is a command injection flaw in the device...