CVE-2017-17888

cgi-bin/write.cgi in Anti-Web through 3.8.7, as used on NetBiter / HMS, Ouman EH-net, Alliance System WS100 -- AWU 500, Sauter ERW100F001, Carlo Gavazzi SIU-DLG, AEDILIS SMART-1, SYXTHSENSE WebBiter, ABB SREA, and ASCON DY WebServer devices, allows remote authenticated users to execute arbitrary ...

CVE-2017-17888

cgi-bin/write.cgi in Anti-Web through 3.8.7, as used on NetBiter / HMS, Ouman EH-net, Alliance System WS100 -- AWU 500, Sauter ERW100F001, Carlo Gavazzi SIU-DLG, AEDILIS SMART-1, SYXTHSENSE WebBiter, ABB SREA, and ASCON DY WebServer devices, allows remote authenticated users to execute arbitrary ...

CVE-2017-17888

cgi-bin/write.cgi in Anti-Web through 3.8.7, as used on NetBiter / HMS, Ouman EH-net, Alliance System WS100 -- AWU 500, Sauter ERW100F001, Carlo Gavazzi SIU-DLG, AEDILIS SMART-1, SYXTHSENSE WebBiter, ABB SREA, and ASCON DY WebServer devices, allows remote authenticated users to execute arbitrary ...

CVE-2017-10904

Qt for Android prior to 5.9.0 allows remote attackers to execute arbitrary OS commands via unspecified vectors...

CVE-2017-10904

Qt for Android prior to 5.9.0 allows remote attackers to execute arbitrary OS commands via unspecified vectors...

CVE-2017-10904

Qt for Android prior to 5.9.0 allows remote attackers to execute arbitrary OS commands via unspecified vectors...

CVE-2017-10904

Qt for Android prior to 5.9.0 allows remote attackers to execute arbitrary OS commands via unspecified vectors...

Zabbix Server 'active checks' Command Injection

The Zabbix server running on the remote host is affected by a remote command injection vulnerability due to the failure to sanitize the input data involving an IP address that would go into the 'ip' field of the 'interface' table in the 'zabbix' database. An unauthenticated, remote attacker can...

CVE-2017-10902

PTW-WMS1 firmware version 2.000.012 allows remote attackers to execute arbitrary OS commands via unspecified vectors...

CVE-2017-10902

PTW-WMS1 firmware version 2.000.012 allows remote attackers to execute arbitrary OS commands via unspecified vectors...

CVE-2017-10902

The CVE-2017-10902 issue affects PTW-WMS1 firmware version 2.000.012, with an OS command injection vulnerability that allows a remote attacker to execute arbitrary OS commands. The root cause is an improper handling of input that enables command execution on the device, as described in multiple s...

Artica Web Proxy 3.06 - Remote Code Execution

Artica Web Proxy 3.06 - Remote Code Execution + Credits: John Page aka Hyp3rlinX + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/ARTICA-WEB-PROXY-v3.06-REMOTE-CODE-EXECUTION-CVE-2017-17055.txt + ISR: ApparitionSec Vendor: ======= www.articatech.com Product...

Artica Web Proxy 3.06 - Remote Code Execution

Credits: John Page aka Hyp3rlinX + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/ARTICA-WEB-PROXY-v3.06-REMOTE-CODE-EXECUTION-CVE-2017-17055.txt + ISR: ApparitionSec Vendor: ======= www.articatech.com Product: ========= Artica Web Proxy v.3.06.112216...

CVE-2017-16934

The web server on DBL DBLTek devices allows remote attackers to execute arbitrary OS commands by obtaining the admin password via a frame.html?content=/dev/mtdblock/5 request, and then using this password for the HTTP Basic Authentication needed for a changepassword.csp request, which supports a...

CVE-2017-16934

The web server on DBL DBLTek devices allows remote attackers to execute arbitrary OS commands by obtaining the admin password via a frame.html?content=/dev/mtdblock/5 request, and then using this password for the HTTP Basic Authentication needed for a changepassword.csp request, which supports a...

CVE-2017-16934

CVE-2017-16934 affects the web server in DBL DBLTek devices. An attacker can obtain the admin password via a frame.html?content=/dev/mtdblock/5 request and use it for HTTP Basic Auth to reach change_password.csp, where the passwd parameter supports a

CVE-2017-16923

Command Injection vulnerability in appdatacenter on Shenzhen Tenda Ac9 USAC9V1.0BRV15.03.05.14multiTD01, Ac9 ac9kfV15.03.05.196318cn, Ac15 USAC15V1.0BRV15.03.05.18multiTD01, Ac15 USAC15V1.0BRV15.03.05.19multiTD01, Ac18 USAC18V1.0BRV15.03.05.05multiTD01, and Ac18 ac18kfV15.03.05.196318cn devices...

CVE-2017-16923

Command Injection vulnerability in appdatacenter on Shenzhen Tenda Ac9 USAC9V1.0BRV15.03.05.14multiTD01, Ac9 ac9kfV15.03.05.196318cn, Ac15 USAC15V1.0BRV15.03.05.18multiTD01, Ac15 USAC15V1.0BRV15.03.05.19multiTD01, Ac18 USAC18V1.0BRV15.03.05.05multiTD01, and Ac18 ac18kfV15.03.05.196318cn devices...

CVE-2017-16923

The CVE-2017-16923 entry describes a Command Injection vulnerability in the app_data_center component of several Shenzhen Tenda router models (e.g., Ac9, Ac15, Ac18 variants). The underlying issue is that the function sub_A6E8 usbeject_process_entry executes a system function using untrusted inpu...

Mako Server 2.5 Command Injection

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Mako Server v2.5 OS Command Injection RCE', 'Description' = %q This module exploits a vulnerability found in Mako Server v2.5. It's possible to...