CVE-2018-0628

CVE-2018-0628 concerns NEC Aterm WG1200HP router. Connected sources confirm multiple OS command injection vulnerabilities (CWE-78) in WG1200HP firmware Ver1.0.31 and earlier, allowing an administrator to execute arbitrary OS commands via HTTP requests/responses. Impact: arbitrary command executio...

CVE-2018-0628

Aterm WG1200HP firmware Ver1.0.31 and earlier allows attacker with administrator rights to execute arbitrary OS commands via HTTP request and response...

CVE-2018-0630

Aterm W300P Ver1.0.13 and earlier allows attacker with administrator rights to execute arbitrary OS commands via sysCmd parameter...

CVE-2018-16194

Aterm WF1200CR and Aterm WG1200CR Aterm WF1200CR firmware Ver1.1.1 and earlier, Aterm WG1200CR firmware Ver1.0.1 and earlier allows authenticated attackers to execute arbitrary OS commands via unspecified vectors...

CVE-2018-0627

Aterm WG1200HP firmware Ver1.0.31 and earlier allows attacker with administrator rights to execute arbitrary OS commands via targetAPSsid parameter...

CVE-2018-0626

Aterm WG1200HP firmware Ver1.0.31 and earlier allows attacker with administrator rights to execute arbitrary OS commands via sysCmd in formWsc parameter...

CVE-2018-16201

The CVE-2018-16201 issue affects Toshiba Home gateway models HEM-GW16A and HEM-GW26A (firmware 1.2.9 and earlier). It stems from hard-coded credentials, potentially allowing an attacker on the same network segment to log into the administrator settings screen and, from there, change configuration...

CVE-2018-16167

LogonTracer 1.2.0 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors...

CVE-2018-0636

The affected product is NEC Aterm HC100RC (firmware version 1.0.1 and earlier). The vulnerability is an OS command injection that can be exploited by an attacker with administrator rights via the FactoryPassword parameter in a specific URL (distinct from CVE-2018-0634). Publicly reported CNVD ent...

CVE-2018-16194

CVE-2018-16194 affects NEC Aterm WF1200CR and Aterm WG1200CR routers. Affected firmware versions are WF1200CR 1.1.1 and earlier and WG1200CR 1.0.1 and earlier. The vulnerability is an OS command injection that can be exploited by an authenticated attacker to execute arbitrary operating system com...

Unsafe Function Usage

jinjava does not disallow the use of unsafe functions and is potentially vulnerable to remote code execution. The getClass method is not blocked in com/hubspot/jinjava/el/ext/JinjavaBeanELResolver.java, which could potentially allow an attacker to execute arbitrary Java or OS commands using...

Debian DLA-1608-1 : php5 security update

Vulnerabilities have been discovered in php5, a server-side, HTML-embedded scripting language. Note that this update includes a change to the default behavior for IMAP connections. See below for details. CVE-2018-19518 An argument injection vulnerability in imapopen may allow a remote attacker to...

CVE-2018-20057

An issue was discovered in /bin/boa on D-Link DIR-619L Rev.B 2.06B1 and DIR-605L Rev.B 2.12B1 devices. goform/formSysCmd allows remote authenticated users to execute arbitrary OS commands via the sysCmd POST parameter...

Sql injection

An issue was discovered in /bin/boa on D-Link DIR-619L Rev.B 2.06B1 and DIR-605L Rev.B 2.12B1 devices. goform/formSysCmd allows remote authenticated users to execute arbitrary OS commands via the sysCmd POST parameter...

CVE-2018-20057

An issue was discovered in /bin/boa on D-Link DIR-619L Rev.B 2.06B1 and DIR-605L Rev.B 2.12B1 devices. goform/formSysCmd allows remote authenticated users to execute arbitrary OS commands via the sysCmd POST parameter...

CVE-2018-20057

An issue was discovered in /bin/boa on D-Link DIR-619L Rev.B 2.06B1 and DIR-605L Rev.B 2.12B1 devices. goform/formSysCmd allows remote authenticated users to execute arbitrary OS commands via the sysCmd POST parameter. Recent assessments: Assessed Attacker Value: 0 Assessed Attacker Value:...

CVE-2018-19660

An exploitable authenticated command-injection vulnerability exists in the web server functionality of Moxa NPort W2x50A products with firmware before 2.2 Build18082311. A specially crafted HTTP POST request to /goform/webSettingProfileSecurity can result in running OS commands as the root user...

Command injection

An exploitable authenticated command-injection vulnerability exists in the web server functionality of Moxa NPort W2x50A products with firmware before 2.2 Build18082311. A specially crafted HTTP POST request to /goform/webSettingProfileSecurity can result in running OS commands as the root user...

Command injection

An exploitable authenticated command-injection vulnerability exists in the web server functionality of Moxa NPort W2x50A products with firmware before 2.2 Build18082311. A specially crafted HTTP POST request to /goform/netWebPingGetValue can result in running OS commands as the root user. This is...

CVE-2018-19660

CVE-2018-19660 affects Moxa NPort W2x50A devices with firmware prior to 2.2 Build_18082311. The vulnerability resides in the web server functionality and stems from an authenticated OS command injection via a specially crafted HTTP POST to /goform/webSettingProfileSecurity, potentially allowing r...