Realtek SDK Miniigd UPnP SOAP Command Execution

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'Realtek SDK Miniigd UPnP SOAP Command Execution', 'Description' = %q Different devices using the Realtek SDK with the miniigd daemon...

Fortinet FortiManager 5.0.x < 5.0.11 / 5.2.x < 5.2.2 Multiple Vulnerabilities (FG-IR-15-011)

The remote host is running a version of FortiManager that is 5.0.x prior to 5.0.11 or 5.2.x prior 5.2.2. It is, therefore, affected by multiple vulnerabilities : - An unspecified flaw exists that allows an unauthenticated, remote attacker to inject arbitrary OS commands. CVE-2015-3611 - A...

OS Command Injection in Vesta Control Panel

High-Tech Bridge Security Research Lab discovered critical vulnerability in Vesta Control Panel, which can be exploited to execute arbitrary system commands and gain complete access to the vulnerable system. The vulnerability exists due to insufficient filtration of user-input passed via the...

Realtek SDK Miniigd UPnP SOAP Command Execution

Different devices using the Realtek SDK with the miniigd daemon are vulnerable to OS command injection in the UPnP SOAP interface. Since it is a blind OS command injection vulnerability, there is no output for the executed command. This module has been tested successfully on a Trendnet TEW-731BR...

Commix - Automated All-in-One OS Command Injection and Exploitation Tool

Commix short for command injection exploiter has a simple environment and it can be used, from web developers, penetration testers or even security researchers to test web applications with the view to find bugs, errors or vulnerabilities related to command injection attacks. By using this tool, ...

JVN#77792759: Multiple ASUS wireless LAN routers vulnerable to OS command injection

Multiple wireless LAN routers provided by ASUS JAPAN Inc. contain an OS command injection vulnerability. Impact An arbitrary OS command may be executed by an authenticated attacker. In addition, when this vulnerability is exploited along with the vulnerability stated in JVN32631078, an arbitrary ...

Symantec Web Gateway < 5.2.2 Authenticated OS Command Injection (SYM14-016)

According to its self-reported version number, the remote web server is hosting a version of Symantec Web Gateway prior to version 5.2.2. It is, therefore, affected by a operating system OS command injection vulnerability in an unspecified PHP script which impacts the management console. A remote...

Advantech EKI-6340 - Command Injection

Advantech EKI-6340 - Command Injection Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ Advantech EKI-6340 Command Injection 1. Advisory Information Title: Advantech EKI-6340 Command Injection Advisory ID: CORE-2014-0009 Advisory URL:...

Advantech EKI-6340 - Command Injection

Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ Advantech EKI-6340 Command Injection 1. Advisory Information Title: Advantech EKI-6340 Command Injection Advisory ID: CORE-2014-0009 Advisory URL: http://www.coresecurity.com/advisories/advantech-eki-6340-command-injection Date...

Advantech EKI-6340 2.05 Command Injection Vulnerability

Advantech EKI-6340 series is vulnerable to an OS command injection, which can be exploited by remote attackers to execute arbitrary code and commands, by using a non privileged user against a vulnerable CGI file. Advantech EKI-6340 Command Injection 1. Advisory Information Title: Advantech EKI-63...

Advantech EKI-6340 2.05 Command Injection

Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ Advantech EKI-6340 Command Injection 1. Advisory Information Title: Advantech EKI-6340 Command Injection Advisory ID: CORE-2014-0009 Advisory URL: http://www.coresecurity.com/advisories/advantech-eki-6340-command-injection Date...

Advantech EKI-6340 Command Injection

1. Advisory Information Title: Advantech EKI-6340 Command Injection Advisory ID: CORE-2014-0009 Advisory URL: http://www.coresecurity.com/advisories/advantech-eki-6340-command-injection Date published: 2014-11-19 Date of last update: 2014-11-19 Vendors contacted: Advantech Release mode: User...

Web Application Protection - Tool to detect and correct vulnerabilities in PHP web applications

WAP 2.0 is a source code static analysis and data mining tool to detect and correct input validation vulnerabilities in web applications written in PHP version 4.0 or higher and with a low rate of false positives. WAP detects and corrects the following vulnerabilities: SQL Injection SQLI Cross-si...

Weak Local Database Credentials in Infoblox Network Automation

Product: Network Automation • NetMRI • Switch Port Manager • Automation Change Manager • Security Device Controller Vendor: InfoBlox Vulnerable Versions: 6.4.X.X-6.8.4.X Tested Version: 6.8.2.11 Vendor Notification: May 12th, 2014 Public Disclosure: July 9th, 2014 Vulnerability Type: OS Command...

Brocade Vyatta 5400 vRouter contains multiple vulnerabilities

Overview Brocade Vyatta 5400 vRouter versions 6.4Rx, 6.6Rx, and 6.7R1 contain multiple vulnerabilities. Description Brocade Vyatta 5400 vRouter versions 6.4Rx, 6.6Rx, and 6.7R1 contain the following vulnerabilities:CWE-78: Improper Neutralization of Special Elements used in an OS Command 'OS...

Exploit for OS Command Injection in Gnu Bash

CGIShell ======== shellshock C...

VMTurbo Operations Manager 4.6 vmtadmin.cgi Remote Command Execution

No description provided by source. This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient include...

VMTurbo Operations Manager 4.6 vmtadmin.cgi Remote Command Execution

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'VMTurbo Operations Manager 4.6 vmtadmin.cgi Remote Command Execution', 'Description' = %q VMTurbo Operations Manager 4.6 and prior ar...

VMTurbo Operations Manager 4.6 - &#039;vmtadmin.cgi&#039; Remote Command Execution (Metasploit)

This module requires Metasploit: http//metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class Metasploit3 'VMTurbo Operations Manager 4.6 vmtadmin.cgi Remote Command Execution', 'Description' = %q VMTurbo Operations Manager 4.6 and prior ar...

VMTurbo Operations Manager 4.6 vmtadmin.cgi Remote Command Execution

VMTurbo Operations Manager 4.6 and prior are vulnerable to unauthenticated OS Command injection in the web interface. Use reverse payloads for the most reliable results. Since it is a blind OS command injection vulnerability, there is no output for the executed command when using the cmd generic...