CVE-2015-6370

The CVE-2015-6370 entry describes a local command-injection vulnerability in the Management I/O (MIO) CLI of Cisco Firepower Extensible Operating System 1.1(1.160) on Firepower 9000 devices. The root cause is insufficient sanitization of user-supplied input in the CLI, allowing an authenticated l...

CF Image Host 1.6.6 Command Injection Vulnerability

CF Image Host version 1.6.6 suffers from a remote command injection vulnerability. CF Image Host 1.6.6 Command Injection Vulnerability Vendor: ==================================== codefuture.co.uk/projects/imagehost Product: =================================== CF Image Host 1.65 - 1.6.6 Archive...

Design/Logic Flaw

PC-EGG pWebManager before 3.3.10, and before 2.2.2 for PHP 4.x, allows remote authenticated users to execute arbitrary OS commands by leveraging the editor role...

CVE-2015-7774

PC-EGG pWebManager is affected by OS command injection (CWE-78) that can be triggered by a user with editor permissions. Vulnerable versions include pWebManager before 3.3.10 and pWebManager for PHP4 before 2.2.2. A remote authenticated editor can execute arbitrary OS commands on the server. Conn...

Design/Logic Flaw

Symantec Endpoint Protection Manager SEPM 12.1 before 12.1-RU6-MP3 allows remote attackers to execute arbitrary OS commands via crafted data...

CVE-2015-6554

The CVE-2015-6554 issue affects Symantec Endpoint Protection Manager (SEPM) 12.1 prior to 12.1-RU6-MP3, allowing remote execution of arbitrary OS commands via crafted data sent to SEPM. Affected vector is remote, with evidence across multiple sources describing an RCE through untrusted data handl...

CVE-2015-5672

TYPE-MOON Fate/stay night, Fate/hollow ataraxia, Witch on the Holy Night, and Fate/stay night + hollow ataraxia set allow remote attackers to execute arbitrary OS commands via crafted saved data...

CVE-2015-7253

The Web Console in Commvault Edge Server 10 R2 allows remote attackers to execute arbitrary OS commands via crafted serialized data in a cookie...

CVE-2015-7901

Infinite Automation Mango Automation 2.5.x and 2.6.x through 2.6.0 build 430 allows remote authenticated users to execute arbitrary OS commands via unspecified vectors...

Design/Logic Flaw

Infinite Automation Mango Automation 2.5.x and 2.6.x through 2.6.0 build 430 allows remote authenticated users to execute arbitrary OS commands via unspecified vectors...

Design/Logic Flaw

McAfee Enterprise Security Manager ESM, Enterprise Security Manager/Log Manager ESMLM, and Enterprise Security Manager/Receiver ESMREC before 9.3.2MR18, 9.4.x before 9.4.2MR8, and 9.5.x before 9.5.0MR7 allow remote authenticated users to execute arbitrary OS commands via a crafted filename, which...

Cogent DataHub Gamma Command Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Cogent DataHub. Authentication is not required to exploit this vulnerability. The specific flaw exists within the EvalExpresssion method, which is available remotely through the AJAX facility. Usin...

CVE-2015-4329

The administrator web interface in Cisco TelePresence Video Communication Server VCS X8.5.2 allows remote authenticated users to execute arbitrary OS commands via crafted HTTP requests, aka Bug ID CSCuv11796...

CVE-2015-4329

The administrator web interface in Cisco TelePresence Video Communication Server VCS X8.5.2 allows remote authenticated users to execute arbitrary OS commands via crafted HTTP requests, aka Bug ID CSCuv11796...

CVE-2015-4329

The Cisco TelePresence Video Communication Server (Expressway) admin web interface (VCS X8.5.2) is affected by CVE-2015-4329 due to insufficient input validation. An authenticated, remote attacker can craft HTTP requests to execute arbitrary OS commands on the underlying device, with potential pr...

JVN#70465405: Yodobashi App for Android vulnerable to arbitrary Java method execution

Yodobashi App for Android provided by Yodobashi Camera Co.,Ltd. contains a vulnerability where an arbitrary Java method may be executed. Impact When opening a specially crafted website, an attacker may be able to execute an arbitrary Java method. As a result, information stored in Android devices...

CVE-2015-2979

Webservice-DIC yoyakuv41 allows remote attackers to execute arbitrary OS commands via unspecified vectors...

CVE-2015-2979

Webservice-DIC yoyakuv41 allows remote attackers to execute arbitrary OS commands via unspecified vectors...

CVE-2015-2979

CVE-2015-2979 affects Webservice-DIC yoyaku_v41 (conference room reservation software). Concrete details from connected sources show an OS command injection (CWE-78) vulnerability that allows remote execution of arbitrary OS commands on the web server. Root cause described as improper input handl...

Belkin N300 Dual-Band Wi-Fi Range Extender formWlanSetupWPS wps_enrolee_pin Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Belkin N300 Dual-Band Wi-Fi Range Extender. Authentication is required to exploit this vulnerability. The specific flaw exists within the handling of formWlanSetupWPS requests. It is possible to...