2287 matches found
CVE-2017-11467
OrientDB through 2.2.22 does not enforce privilege requirements during "where" or "fetchplan" or "order by" use, which allows remote attackers to execute arbitrary OS commands via a crafted request...
OrientDB 2.2.x Remote Code Execution
This module leverages a privilege escalation on OrientDB to execute unsandboxed OS commands. All versions from 2.2.2 up to 2.2.22 should be vulnerable. Module Options msf use exploit/multi/http/orientdb/exec msf undefinedexec show actions ...actions... msf undefinedexec set ACTION msf undefinedex...
Format string
NfSen before 1.3.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the customfmt parameter aka the "Custom output format" field...
CVE-2017-7175
CVE-2017-7175 affects NfSen versions before 1.3.8. A remote attacker can execute arbitrary OS commands via shell metacharacters in the customfmt parameter (the Custom output format field). Exploit details indicate a remote command-injection affecting NfSen 1.3.6/1.3.7 and related AlienVault OSSIM...
CVE-2017-7175
NfSen before 1.3.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the customfmt parameter aka the "Custom output format" field...
CVE-2017-2185
HOME SPOT CUBE2 firmware V101 and earlier allows authenticated attackers to execute arbitrary OS commands via WebUI...
Design/Logic Flaw
Toshiba Home gateway HEM-GW16A firmware HEM-GW16A-FW-V1.2.0 and earlier. Toshiba Home gateway HEM-GW26A firmware HEM-GW26A-FW-V1.2.0 and earlier allows an attacker to execute arbitrary OS commands via unspecified vectors...
CVE-2017-2183
HOME SPOT CUBE2 firmware V101 and earlier allows authenticated attackers to execute arbitrary OS commands via Clock Settings...
CVE-2017-2183
The CVE-2017-2183 issue affects KDDI HOME SPOT CUBE2 firmware versions V101 and earlier, where an OS command injection vulnerability exists in Clock Settings. Exploitation requires access to the management/clock settings UI, enabling an authenticated attacker to execute arbitrary OS commands on t...
CVE-2017-2183
HOME SPOT CUBE2 firmware V101 and earlier allows authenticated attackers to execute arbitrary OS commands via Clock Settings...
CVE-2017-2237
Toshiba Home gateway HEM-GW16A firmware HEM-GW16A-FW-V1.2.0 and earlier. Toshiba Home gateway HEM-GW26A firmware HEM-GW26A-FW-V1.2.0 and earlier allows an attacker to execute arbitrary OS commands via unspecified vectors...
CVE-2017-9807
An issue was discovered in the OpenWebif plugin through 1.2.4 for E2 open devices. The saveConfig function of "plugin/controllers/models/config.py" performs an eval call on the contents of the "key" HTTP GET parameter. This allows an unauthenticated remote attacker to execute arbitrary Python cod...
Code injection
An issue was discovered in the OpenWebif plugin through 1.2.4 for E2 open devices. The saveConfig function of "plugin/controllers/models/config.py" performs an eval call on the contents of the "key" HTTP GET parameter. This allows an unauthenticated remote attacker to execute arbitrary Python cod...
CVE-2017-9807
An issue was discovered in the OpenWebif plugin through 1.2.4 for E2 open devices. The saveConfig function of "plugin/controllers/models/config.py" performs an eval call on the contents of the "key" HTTP GET parameter. This allows an unauthenticated remote attacker to execute arbitrary Python cod...
HPE Intelligent Management Center dbman Opcode 10008 Command Injection
Binary data hpimcdbmancve-2017-5816.nbin...
CVE-2016-7819
I-O DATA DEVICE TS-WRLP firmware version 1.01.02 and earlier and TS-WRLA firmware version 1.01.02 and earlier allows an attacker with administrator rights to execute arbitrary OS commands via unspecified vectors...
Design/Logic Flaw
I-O DATA DEVICE WFS-SR01 firmware version 1.10 and earlier allow remote attackers to execute arbitrary OS commands via unspecified vectors...
Design/Logic Flaw
I-O DATA DEVICE TS-WRLP firmware version 1.01.02 and earlier and TS-WRLA firmware version 1.01.02 and earlier allows an attacker with administrator rights to execute arbitrary OS commands via unspecified vectors...