Foxit Reader 9.7.1 Remote Command Execution

Exploit Title: Foxit Reader 9.7.1 - Remote Command Execution Javascript API Exploit Author: Nassim Asrir CVE: CVE-2020-14425. Vendor Homepage: https://www.foxitsoftware.com/ Description: Foxit Reader before 10.0 allows Remote Command Execution via the unsafe app.opencPDFWebPage JavaScript AP whic...

CVE-2020-7373

vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widgettabbedcontainertabpanel request. NOTE: this issue exists because of an incomplete fix for CVE-2019-16759. ALSO NOTE: CVE-2020-7373 is a duplicate of CVE-2020-17496. CVE-2020-17496 is...

Design/Logic Flaw

vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widgettabbedcontainertabpanel request. NOTE: this issue exists because of an incomplete fix for CVE-2019-16759. ALSO NOTE: CVE-2020-7373 is a duplicate of CVE-2020-17496. CVE-2020-17496 is...

CVE-2020-7373

vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widgettabbedcontainertabpanel request. NOTE: this issue exists because of an incomplete fix for CVE-2019-16759. ALSO NOTE: CVE-2020-7373 is a duplicate of CVE-2020-17496. CVE-2020-17496 is...

CVE-2020-7373

Summary (CVE-2020-17496 / CVE-2020-7373): vBulletin 5.5.4–5.6.2 is vulnerable to remote code execution via crafted subWidgets data in an ajax/render/widget_tabbedcontainer_tab_panel request. This issue stems from an incomplete fix of CVE-2019-16759, and CVE-2020-7373 is a duplicate of CVE-2020-17...

CVE-2020-7373

vBulletin 5.5.4 through 5.6.2 allows remote command execution via crafted subWidgets data in an ajax/render/widgettabbedcontainertabpanel request. NOTE: this issue exists because of an incomplete fix for CVE-2019-16759. ALSO NOTE: CVE-2020-7373 is a duplicate of CVE-2020-17496. CVE-2020-17496 is...

ZOHO ManageEngine Applications Manager SQL Injection Vulnerability (CNVD-2020-60827)

ZOHO ManageEngine Applications Manager is a set of IT operation and maintenance management solutions of the United States ZhuoHao ZOHO company. The product has application performance management, fault management, report generation and SLA management and other functions. A SQL injection...

Exploit for CVE-2020-14882

cve-2020-14882 Bash script t...

CVE-2020-27654

Improper access control vulnerability in lbd in Synology Router Manager SRM before 1.2.4-8081 allows remote attackers to execute arbitrary commands via port 1 7786/tcp or 2 7787/tcp...

PT-2020-4934 · Synology · Synology Router Manager

Name of the Vulnerable Software and Affected Versions: Synology Router Manager SRM versions prior to 1.2.4-8081 Description: The issue is related to improper access control in the lbd service of Synology Router Manager SRM, allowing remote attackers to execute arbitrary commands. This can be done...

CVE-2018-19949

If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on build 20200214; QTS 4.3.4.1190 on build...

CVE-2018-19949

If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on build 20200214; QTS 4.3.4.1190 on build...

Security Bulletin: Embedded WebSphere Application Server is vulnerable to a remote command execution vulnerability affects Content Collector for Email

Summary IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a local authenticated attacker to gain elevated privileges on the system, caused by improper handling of UNC paths. By scheduling a task with a specially-crafted UNC path, an attacker could exploit this vulnerability to...

AntSword cross-site scripting vulnerability (CNVD-2020-59741)

AntSword is an open source, cross-platform web management tool designed to meet the needs of penetration testers as well as security researchers with permissions and/or authorizations, and webmasters. A cross-site scripting vulnerability exists in AntSword 2.0.7. An attacker can exploit this...

Aruba Airwave Software Remote Command Execution Vulnerability

Aruba Airwave Software is a network monitoring software that helps users view real-time data and situational reports for every user, device, and segment of the network. A remote command execution vulnerability exists in Aruba Airwave Software versions prior to 1.3.2. An attacker can exploit this...

Aruba Airwave Software Remote Command Execution Vulnerability (CNVD-2020-59213)

Aruba Airwave Software is a network monitoring software that helps users view real-time data and situational reports for every user, device, and segment of the network. A remote command execution vulnerability exists in Aruba Airwave Software versions prior to 1.3.2. An attacker can exploit this...

The vulnerability of the server management module of ZTE’s R5300G4, R8500G4, and R5500G4 servers allows attackers to execute arbitrary commands.

The vulnerability of the server management module of ZTE’s R5300G4, R8500G4, and R5500G4 servers is related to deficiencies in authentication procedures. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

CVE-2020-26878

Ruckus through 1.5.1.0.21 is affected by remote command injection. An authenticated user can submit a query to the API /service/v1/createUser endpoint, injecting arbitrary commands that will be executed as root user via web.py...

CVE-2020-24632

A remote execution of arbitrary commandss vulnerability was discovered in Aruba Airwave Software versions: Prior to 1.3.2...

CVE-2020-18766

CVE-2020-18766 affects AntSword v2.0.7 and is described as a cross-site scripting (XSS) vulnerability that can remotely execute system commands. The connected records confirm the affected software version and the high-impact consequence (remote command execution) but do not provide a concrete roo...