10712 matches found
Ricon Industrial Cellular Router S9922XL Remote Command Execution
Summary S9922L series LTE router is designed and manufactured by Ricon Mobile Inc., it based on 3G/LTE cellular network technology with industrial class quality. With its embedded cellular module, it widely used in multiple case like ATM connection, remote office security connection, data...
Design/Logic Flaw
Inkdrop versions prior to v5.3.1 allows an attacker to execute arbitrary OS commands on the system where it runs by loading a file or code snippet containing an invalid iframe into Inkdrop...
CVE-2021-20745
Inkdrop (Markdown editor) is affected by CVE-2021-20745. Prior to v5.3.1, loading a file or code snippet containing an invalid iframe can lead to OS command injection, allowing arbitrary commands on the host. The vulnerability is tied to input handling of iframes. According to sources, affected v...
CVE-2021-20740
CVE-2021-20740 affects Hitachi Virtual File Platform and NEC Storage M Series NAS Gateway NH4x/NH8x. Impact: remote authenticated attacker can execute arbitrary OS commands with root privileges via unspecified vectors. Affected versions: Hitachi VFP < 5.5.3-09 and < 6.4.3-09; NEC M Series N...
CVE-2021-33533 WEIDMUELLER: WLAN devices affected by OS Command Injection vulnerability
In Weidmueller Industrial WLAN devices in multiple versions an exploitable command injection vulnerability exists in the iwwebs functionality. A specially crafted iwserverip parameter can cause user input to be reflected in a subsequent iwsystem call, resulting in remote control over the device. ...
OS Command Injection
rssh is vulnerable to OS command injection. Insufficient sanitization of arguments passed to rsync can bypass the restrictions imposed by rssh, a restricted shell that should restrict users to perform only rsync operations, resulting in the execution of arbitrary shell commands...
OS Command Injection
CSV is vulnerable to OS command injection. The vulnerability allows an attacker to inject arbitrary OS commands via the Server field in an HTTP response header, which is directly injected into a CSV report...
JVN#29949691: Inkdrop vulnerable to OS command injection
Inkdrop provided by Takuya Matsuyama is a Markdown editor. Inkdrop contains an OS command injection vulnerability CWE-78. Impact If a file or code snippet containing an invalid iframe is loaded into Inkdrop, an arbitrary OS command may be executed on the system where it runs. Solution Update the...
Moodle spellchecker plugin command execution vulnerability
Summary A command execution vulnerability exists in the default legacy spellchecker plugin in Moodle 3.10. A specially crafted series of HTTP requests can lead to command execution. An attacker must have administrator privileges to exploit this vulnerabilities. Tested Versions Moodle 3.10 Product...
CODESYS Control V2 Linux SysFile library
1. EXECUTIVE SUMMARY CVSS v3 5.3 ATTENTION: Exploitable remotely/low attack complexity Vendor: CODESYS, GmbH Equipment: CODESYS V2 Runtime Toolkit Vulnerability: OS Command Injection 2. RISK EVALUATION Successful exploitation of this vulnerability may allow the control programmer to call...
Hitachi Virtual File Platform vulnerable to OS command injection
Overview Hitachi Virtual File Platform provided by Hitachi contains an OS command injection vulnerability CWE-78 due to a flaw in processing parameters of the HTTP requests. Hiroki MATSUKUMA of Cyber Defense Institute, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the...
JVN#21298724: Hitachi Virtual File Platform vulnerable to OS command injection
Hitachi Virtual File Platform provided by Hitachi contains an OS command injection vulnerability CWE-78 due to a flaw in processing parameters of the HTTP requests. Impact A remote attacker who can log in to the product may execute an arbitrary OS command with root privilege. Solution Update the...
Exploit for OS Command Injection in Zeroshell
POC CVE-2019-12725-Remote-Command-Execution ZeroShell 3.9.0 R...
Bugs Lurking in Cisco UC Provisioning Platform
The Akkadian Provisioning Manager, which is used as a third-party provisioning tool within Cisco Unified Communications environments, has three high-severity security vulnerabilities that can be chained together to enable remote code execution RCE with elevated privileges, researchers said. They...
CVE-2021-33357
A vulnerability exists in RaspAP 2.6 to 2.6.5 in the "iface" GET parameter in /ajax/networking/getnetcfg.php, when the "iface" parameter value contains special characters such as ";" which enables an unauthenticated attacker to execute arbitrary OS commands...
CVE-2021-33357
A vulnerability exists in RaspAP 2.6 to 2.6.5 in the "iface" GET parameter in /ajax/networking/getnetcfg.php, when the "iface" parameter value contains special characters such as ";" which enables an unauthenticated attacker to execute arbitrary OS commands...
Design/Logic Flaw
A vulnerability exists in RaspAP 2.6 to 2.6.5 in the "iface" GET parameter in /ajax/networking/getnetcfg.php, when the "iface" parameter value contains special characters such as ";" which enables an unauthenticated attacker to execute arbitrary OS commands...
Design/Logic Flaw
Multiple vulnerabilities exist in RaspAP 2.3 to 2.6.5 in the "interface", "ssid" and "wpapassphrase" POST parameters in /hostapd, when the parameter values contain special characters such as ";" or "$" which enables an authenticated attacker to execute arbitrary OS commands...
CVE-2021-33358
RaspAP versions 2.3–2.6.5 contain command-injection vulnerabilities in the /hostapd endpoint via the interface, ssid, and wpa_passphrase POST parameters. Values containing special characters such as ; or $() may allow an authenticated attacker to execute arbitrary OS commands. Affects RaspAP’s we...
CVE-2021-33358
Multiple vulnerabilities exist in RaspAP 2.3 to 2.6.5 in the "interface", "ssid" and "wpapassphrase" POST parameters in /hostapd, when the parameter values contain special characters such as ";" or "$" which enables an authenticated attacker to execute arbitrary OS commands...