Command injection

The async-git package before 1.13.2 for Node.js allows OS Command Injection via shell metacharacters, as demonstrated by git.reset and git.tag...

CVE-2020-27298

Philips Interventional Workspot Release 1.3.2, 1.4.0, 1.4.1, 1.4.3, 1.4.5, Coronary Tools/Dynamic Coronary Roadmap/Stentboost Live Release 1.0, ViewForum Release 6.3V1L10. The software constructs all or part of an OS command using externally influenced input from an upstream component but does no...

JVN#96783542: Multiple vulnerabilities in multiple LOGITEC products

Multiple products provided by LOGITEC CORPORATION contain multiple vulnerabilities listed below. Improper restriction of excessive authentication attempts CWE-307 - CVE-2021-20635 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N| Base Score: 4.3 CVSS v2|...

CVE-2020-12513

Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to an authenticated blind OS Command Injection...

Command injection

Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to an authenticated blind OS Command Injection...

CVE-2020-12513

Pepperl+Fuchs Comtrol IO-Link Master Series is affected by CVE-2020-12513. Vulnerable versions include System 1.36 and Application 1.5.28 (and 1.5.48 and earlier per CVE listing) with an authenticated blind OS Command Injection. Fixed versions are System 1.52 and Application 1.6.11. The vulnerabi...

Exploit for OS Command Injection in Xstream

Description XStream can be used for Remote Code Execution...

CVE-2021-3190

The CVE-2021-3190 issue affects the Node.js package async-git prior to 1.13.2, where OS Command Injection via shell metacharacters (demonstrated by git.reset and git.tag) is possible. The vulnerability may enable remote code execution in vulnerable environments. A remediation is to upgrade async-...

Exploit for OS Command Injection in Seowonintech Slc-130_Firmware

Description On August 21, 2020, seown SLC 130 router was exp...

CVE-2020-27298

Philips CVE-2020-27298 affects Interventional Workspot (1.3.2–1.4.5), Coronary Tools/Dynamic Coronary Roadmap/Stentboost Live (1.0), and ViewForum (6.3V1L10). Root cause: improper neutralization of special characters when constructing OS commands from externally influenced input, enabling OS comm...

Philips Interventional Workstations

1. EXECUTIVE SUMMARY CVSS v3 6.5 ATTENTION: Low skill level to exploit Vendor: Philips Equipment: Philips Interventional WorkSpot, Coronary Tools/Dynamic Coronary Roadmap/Stentboost Live, ViewForum Vulnerability: OS Command Injection 2. RISK EVALUATION Successful exploitation of this...

CVE-2020-29495

DELL EMC Avamar Server, versions 19.1, 19.2, 19.3, contain an OS Command Injection Vulnerability in Fitness Analyzer. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the application's underlying OS with high...

CVE-2020-29495

DELL EMC Avamar Server, versions 19.1, 19.2, 19.3, contain an OS Command Injection Vulnerability in Fitness Analyzer. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the application's underlying OS with high...

CVE-2020-29495

DELL EMC Avamar Server, versions 19.1, 19.2, 19.3, contain an OS Command Injection Vulnerability in Fitness Analyzer. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the application's underlying OS with high...

CVE-2020-29495

Dell EMC Avamar Server (versions 19.1–19.3) contains an OS Command Injection vulnerability in Fitness Analyzer. Exploitation requires remote access with no authentication and can lead to arbitrary OS commands execution on the underlying OS with high privileges, effectively risking full compromise...

CVE-2020-29017

CVE-2020-29017 is an OS command injection vulnerability in FortiDeceptor (versions 3.1.0, 3.0.1, 3.0.0) that lets an authenticated remote attacker execute arbitrary commands on the system. The root cause is a command injection on the Customization page of the FortiDeceptor management interface. E...

CVE-2020-5146

A vulnerability in SonicWall SMA100 appliance allow an authenticated management-user to perform OS command injection using HTTP POST parameters. This vulnerability affected SMA100 Appliance version 10.2.0.2-20sv and earlier...

CVE-2020-5146

A vulnerability in SonicWall SMA100 appliance allow an authenticated management-user to perform OS command injection using HTTP POST parameters. This vulnerability affected SMA100 Appliance version 10.2.0.2-20sv and earlier...

CVE-2020-5146

A vulnerability in SonicWall SMA100 appliance allow an authenticated management-user to perform OS command injection using HTTP POST parameters. This vulnerability affected SMA100 Appliance version 10.2.0.2-20sv and earlier...

CVE-2020-5146

CVE-2020-5146 concerns SonicWall SMA100 appliance. An authenticated management-user can perform OS command injection via HTTP POST parameters, affecting SMA100 builds up to version 10.2.0.2-20sv and earlier. Documents indicate the vulnerability exists in the SMA100 line; no explicit exploit detai...