Centreon Poller Authenticated Remote Command Execution

An authenticated user with sufficient administrative rights to manage pollers can use this functionality to execute arbitrary commands remotely. Usually, the miscellaneous commands are used by the additional modules to perform certain actions, by the scheduler for data processing, etc. This modul...

CVE-2019-16005

A vulnerability in the web-based management interface of Cisco Webex Video Mesh could allow an authenticated, remote attacker to execute arbitrary commands on the affected system. The vulnerability is due to improper validation of user-supplied input by the web-based management interface of the...

CVE-2020-7596

Codecov npm module before 3.6.2 allows remote attackers to execute arbitrary commands via the "gcov-args" argument...

CVE-2020-7980

Intellian Aptus Web 1.24 allows remote attackers to execute arbitrary OS commands via the Q field within JSON data to the cgi-bin/libagent.cgi URI. NOTE: a valid sid cookie for a login to the intellian default account might be needed...

PT-2020-19895 · Intellian · Intellian Satellian +1

Name of the Vulnerable Software and Affected Versions: Intellian Aptus Web version 1.24 Intellian Satellian version 1.12 Description: The issue allows remote attackers to execute arbitrary OS commands via the Q field within JSON data to the "cgi-bin/libagent.cgi" URI. A valid sid cookie for a log...

Ansible: vulnerability in solaris_zone module via crafted solaris zone

A flaw was found in the solariszone module from the Ansible Community modules. When setting the name for the zone on the Solaris host, the zone name is checked by listing the process with the 'ps' bare command on the remote machine. An attacker could take advantage of this flaw by crafting the na...

Ansible: vulnerability in solaris_zone module via crafted solaris zone

A flaw was found in the solariszone module from the Ansible Community modules. When setting the name for the zone on the Solaris host, the zone name is checked by listing the process with the 'ps' bare command on the remote machine. An attacker could take advantage of this flaw by crafting the na...

Ansible: vulnerability in solaris_zone module via crafted solaris zone

A flaw was found in the solariszone module from the Ansible Community modules. When setting the name for the zone on the Solaris host, the zone name is checked by listing the process with the 'ps' bare command on the remote machine. An attacker could take advantage of this flaw by crafting the na...

CVE-2019-19839

emfd in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote attackers to execute OS commands via a POST request with the attribute xcmd=import-category to admin/cmdstat.jsp via the uploadFile attribute...

CVE-2019-19838

emfd in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote attackers to execute OS commands via a POST request with the attribute xcmd=get-platform-depends to admin/cmdstat.jsp via the uploadFile attribute...

CVE-2012-4981

Toshiba ConfigFree 8.0.38 has a CF7 File Remote Command Execution Vulnerability...

Design/Logic Flaw

Toshiba ConfigFree 8.0.38 has a CF7 File Remote Command Execution Vulnerability...

CVE-2012-4981

CVE-2012-4981 affects Toshiba ConfigFree 8.0.38 (Windows) and is triggered via the CF7 file format. The CF7 parser contains a vulnerability in the runApp field that allows an attacker to execute arbitrary commands with the privileges of the currently logged-in user by convincing a user to downloa...

D-Link DIR-859 Unauthenticated Remote Command Execution Exploit

D-Link DIR-859 Routers are vulnerable to OS command injection via the UPnP interface. The vulnerability exists in /gena.cgi function genacgimain in /htdocs/cgibin, which is accessible without credentials. This module requires Metasploit: https://metasploit.com/download Current source:...

Huawei EulerOS: Security Advisory for golang (EulerOS-SA-2017-1311)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2019-19841

emfd in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote attackers to execute OS commands via a POST request with the attribute xcmd=packet-capture to admin/cmdstat.jsp via the mac attribute...

CVE-2019-19842

emfd in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote attackers to execute OS commands via a POST request with the attribute xcmd=spectra-analysis to admin/cmdstat.jsp via the mac attribute...

CVE-2019-19842

emfd in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote attackers to execute OS commands via a POST request with the attribute xcmd=spectra-analysis to admin/cmdstat.jsp via the mac attribute...

CVE-2019-19841

CVE-2019-19841 affects Ruckus Wireless Unleashed firmware prior to or up to 200.7.10.102.64, where emfd allows remote command execution via a POST request to admin/_cmdstat.jsp with xcmd=packet-capture and the mac attribute. The connected documents confirm the issue and its description across mul...

D-Link DIR-859 Unauthenticated Remote Command Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'D-Link DIR-859 Unauthenticated Remote Command Execution', 'Description' = %q D-Link DIR-859 Routers are vulnerable to OS command injection via th...