Input validation

FruityWifi aka PatatasFritas/PatataWifi 2.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the iomode, apmode, ioaction, ioiniface, ioinset, ioinip, ioinmask, ioingw, iooutiface, iooutset, iooutmask, iooutgw, iface, or domain parameter to...

CVE-2018-17317

CVE-2018-17317: FruityWifi is affected by remote command execution via shell metacharacters in numerous parameters (io_mode, ap_mode, io_action, io_in_, iface, domain, newSSID, hostapd_ and supplicant_ssid) sent to /www/script/config_iface.php or /www/page_config.php. This enables an attacker to ...

CVE-2018-14643

An authentication bypass flaw was found in the smartproxydynflow component used by Foreman. A malicious attacker can use this flaw to remotely execute arbitrary commands on machines managed by vulnerable Foreman instances, in a highly privileged context...

CVE-2018-14643

Summary : CVE-2018-14643 describes an authentication bypass flaw in the smart_proxy_dynflow component (Ruby gem) used by Foreman, enabling a remote attacker to execute arbitrary commands on managed machines in a highly privileged context. Affected software : Foreman ecosystem with the smart_proxy...

CVE-2018-14643

An authentication bypass flaw was found in the smartproxydynflow component used by Foreman. A malicious attacker can use this flaw to remotely execute arbitrary commands on machines managed by vulnerable Foreman instances, in a highly privileged context...

Webmin <= 1.590 Multiple Vulnerabilities

According to its self-reported version, the Webmin install hosted on the remote host is 1.590 or lower. It is, therefore, affected by multiple vulnerabilities. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid117602; scriptversion"1.8"; scriptcvsdate"Date: 2019/11/05";...

CA Release Automation NiMi 6.5 Remote Command Execution

Exploit Title: CA Release Automation NiMi 6.5 - Remote Command Execution Date: 2016-06-23 Exploit Authors: Jakub Palaczynski, Maciej Grabiec Vendor Homepage: http://www.ca.com/ Software Link: https://docops.ca.com/ca-release-automation/5-5-2/en/installation/deploy-agents/ Version: CA Release...

CA Release Automation NiMi 6.5 - Remote Command Execution Exploit

Exploit Title: CA Release Automation NiMi 6.5 - Remote Command Execution Exploit Authors: Jakub Palaczynski, Maciej Grabiec Vendor Homepage: http://www.ca.com/ Software Link: https://docops.ca.com/ca-release-automation/5-5-2/en/installation/deploy-agents/ Version: CA Release Automation NiMi 5.X,...

CVE-2018-17139

UltimatePOS 2.5 allows users to upload arbitrary files, which leads to remote command execution by posting to a /products URI with PHP code in a .php file with the image/jpeg content type...

Command injection

UltimatePOS 2.5 allows users to upload arbitrary files, which leads to remote command execution by posting to a /products URI with PHP code in a .php file with the image/jpeg content type...

CVE-2018-17139

UltimatePOS 2.5 allows users to upload arbitrary files, which leads to remote command execution by posting to a /products URI with PHP code in a .php file with the image/jpeg content type...

CVE-2018-17139

CVE-2018-17139 affects UltimatePOS 2.5. An arbitrary file upload vulnerability allows an attacker to upload files via the /products endpoint (content-type: image/jpeg) containing PHP code, enabling remote command execution. Evidence across CNVD-2018-19402 and NVD/NVD-derived entries confirms the ...

CVE-2018-17139

UltimatePOS 2.5 allows users to upload arbitrary files, which leads to remote command execution by posting to a /products URI with PHP code in a .php file with the image/jpeg content type...

CA Release Automation NiMi 6.5 - Remote Command Execution

Exploit Title: CA Release Automation NiMi 6.5 - Remote Command Execution Date: 2016-06-23 Exploit Authors: Jakub Palaczynski, Maciej Grabiec Vendor Homepage: http://www.ca.com/ Software Link: https://docops.ca.com/ca-release-automation/5-5-2/en/installation/deploy-agents/ Version: CA Release...

Xiaomi Router 4Q suffers from command execution vulnerability

The Xiaomi Router 4Q is a router. A command execution vulnerability exists in Xiaomi Router 4Q. An attacker can exploit the vulnerability to remotely execute arbitrary code...

CA Release Automation NiMi 6.5 - Remote Command Execution

CA Release Automation NiMi 6.5 - Remote Command Execution Exploit Title: CA Release Automation NiMi 6.5 - Remote Command Execution Date: 2016-06-23 Exploit Authors: Jakub Palaczynski, Maciej Grabiec Vendor Homepage: http://www.ca.com/ Software Link:...

Micronet INplc-RT Authorization Issue Vulnerability (CNVD-2019-40825)

Micronet INplc-RT is a software-defined PLC Programmable Logic Controller from Micronet Japan. An authorization issue vulnerability exists in Micronet INplc-RT version 3.08 and earlier. A remote attacker could exploit this vulnerability to execute arbitrary commands...

FreeBSD : Plex Media Server -- Information Disclosure Vulnerability (337960ec-b5dc-11e8-ac58-a4badb2f4699)

Chris reports : The XML parsing engine for Plex Media Server's SSDP/UPNP functionality is vulnerable to an XML External Entity Processing XXE attack. Unauthenticated attackers on the same LAN can use this vulnerability to : - Access arbitrary files from the filesystem with the same permission as...

Micronet INplc-RT License Issue Vulnerability

Micronet INplc-RT is a software-defined PLC Programmable Logic Controller from Micronet Japan. An authorization issue vulnerability exists in Micronet INplc-RT version 3.08 and earlier. A remote attacker could exploit this vulnerability to execute arbitrary commands...

CVE-2018-1571

IBM QRadar SIEM is affected by CVE-2018-1571. A remote authenticated attacker could execute arbitrary commands by sending a specially crafted request, due to OS command injection where user-supplied data reaches the system shell. Affected: QRadar SIEM 7.2.x up to 7.2.8 Patch 13 (and interim fixes...