2287 matches found
CVE-2019-20197
In Nagios XI 5.6.9, an authenticated user is able to execute arbitrary OS commands via shell metacharacters in the id parameter to schedulereport.php, in the context of the web-server user account...
CVE-2019-20197
In Nagios XI 5.6.9, CVE-2019-20197 describes an OS command-injection vulnerability where an authenticated user can execute arbitrary commands via shell metacharacters in the id parameter to schedulereport.php, running with the web-server user context. The issue is triggered by crafted input, enab...
CVE-2019-6013
DBA-1510P firmware 1.70b009 and earlier allows authenticated attackers to execute arbitrary OS commands via Command Line Interface CLI...
CVE-2019-6014
DBA-1510P firmware 1.70b009 and earlier allows an attacker to execute arbitrary OS commands via Web User Interface...
Authentication flaw
Yachtcontrol through 2019-10-06: It's possible to perform direct Operating System commands as an unauthenticated user via the "/pages/systemcall.php?command=COMMAND" page and parameter, where COMMAND will be executed and returning the results to the client. Affects Yachtcontrol webservers disclos...
CVE-2019-17270
Yachtcontrol through 2019-10-06: It's possible to perform direct Operating System commands as an unauthenticated user via the "/pages/systemcall.php?command=COMMAND" page and parameter, where COMMAND will be executed and returning the results to the client. Affects Yachtcontrol webservers disclos...
Yachtcontrol Webapplication 1.0 - Unauthenticated Remote Code Execution
Exploit Title: Yachtcontrol Webapplication 1.0 - Unauthenticated Remote Code Execution Google Dork: N/A Date: 2019-12-06 Exploit Author: Hodorsec Vendor Homepage: http://www.yachtcontrol.nl/en/ Version: 1.0 Software Link: http://download.yachtcontrol.nl/klant/Software/ &...
Tenda AC9 /goform/WanParameterSetting DNS1 Command Injection Vulnerability
The Tenda AC9 is a wireless router. A security vulnerability in the Tenda AC9 /goform/WanParameterSetting implementation for handling DNS1 POST parameters allows remote attackers to exploit the vulnerability by submitting a special request that can execute arbitrary OS commands...
Remote Code Execution
centreon/centreon is vulnerable to remote code execution. An administrator with access to modify the Macro Expression location settings is able to execute arbitrary OS commands on the system through the comments field by changing the Macro Expression value to /...
EulerOS 2.0 SP5 : git (EulerOS-SA-2019-2153)
According to the versions of the git packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - GIT version 2.15.1 and earlier contains a Input Validation Error vulnerability in Client that can result in problems including messing up terminal...
Ubuntu: Security Advisory (USN-4175-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Ubuntu 16.04 LTS / 18.04 LTS : Nokogiri vulnerability (USN-4175-1)
The remote Ubuntu 16.04 LTS / 18.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-4175-1 advisory. It was discovered that Nokogiri incorrectly handled inputs. A remote attacker could possibly use this issue to execute arbitrary OS commands. Tenable...
USN-4175-1: Nokogiri vulnerability
It was discovered that Nokogiri incorrectly handled inputs. A remote attacker could possibly use this issue to execute arbitrary OS commands...
CVE-2019-19824
On certain TOTOLINK Realtek SDK based routers, an authenticated attacker may execute arbitrary OS commands via the sysCmd parameter to the boafrm/formSysCmd URI, even if the GUI syscmd.htm is not available. This allows for full control over the device’s internals. This affects A3002RU through...
CVE-2019-18396
An issue was discovered in certain Oi third-party firmware that may be installed on Technicolor TD5130v2 devices. A Command Injection in the Ping module in the Web Interface in OIFwV20 allows remote attackers to execute arbitrary OS commands in the pingAddr parameter to mntping.cgi. NOTE: This ma...
Command injection
An issue was discovered in certain Oi third-party firmware that may be installed on Technicolor TD5130v2 devices. A Command Injection in the Ping module in the Web Interface in OIFwV20 allows remote attackers to execute arbitrary OS commands in the pingAddr parameter to mntping.cgi. NOTE: This ma...
CVE-2019-18396
An issue was discovered in certain Oi third-party firmware that may be installed on Technicolor TD5130v2 devices. A Command Injection in the Ping module in the Web Interface in OIFwV20 allows remote attackers to execute arbitrary OS commands in the pingAddr parameter to mntping.cgi. NOTE: This ma...
CVE-2019-18396
CVE-2019-18396 affects Technicolor TD5130v2 devices running OI_Fw_V20. A command injection exists in the Ping module of the Web Interface via the pingAddr parameter to mnt_ping.cgi, enabling remote attackers to execute arbitrary OS commands. Public details show an example payload in POST /mnt_pin...
Ubuntu: Security Advisory (USN-4160-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...