Hardcoded credentials

An issue was discovered on Wifi-soft UniBox controller 3.x devices. The tools/controller/diagnostictoolscontroller Diagnostic Tools Controller is vulnerable to Remote Command Execution, allowing an attacker to execute arbitrary system commands on the server with root user privileges. Authenticati...

CVE-2018-20323

www/soap/application/MCSoap/Logs.php in MailCleaner Community Edition 2018.08 allows remote attackers to execute arbitrary OS commands...

CVE-2019-3497

The CVE-2019-3497 issue affects Wifi-soft UniBox controller 0.x–2.x. The Diagnostic Tools’ tools/ping feature is vulnerable to Remote Command Execution, enabling an attacker to run arbitrary system commands as root. Authentication for this component can be bypassed using hard-coded credentials. T...

CVE-2019-3497

An issue was discovered on Wifi-soft UniBox controller 0.x through 2.x devices. The tools/ping Ping feature of the Diagnostic Tools component is vulnerable to Remote Command Execution, allowing an attacker to execute arbitrary system commands on the server with root user privileges. Authenticatio...

CVE-2019-3496

The CVE-2019-3496 entry describes a Remote Command Execution vulnerability in Wifi-soft UniBox controller 3.x, specifically affecting the Diagnostic Tools Controller at tools/controller/diagnostic_tools_controller. The flaw allows an attacker to execute arbitrary system commands with root privile...

CVE-2019-3496

An issue was discovered on Wifi-soft UniBox controller 3.x devices. The tools/controller/diagnostictoolscontroller Diagnostic Tools Controller is vulnerable to Remote Command Execution, allowing an attacker to execute arbitrary system commands on the server with root user privileges. Authenticati...

BMC Patrol Agent - Privilege Escalation Cmd Execution Exploit

This Metasploit module leverages the remote command execution feature provided by the BMC Patrol Agent software. It can also be used to escalate privileges on Windows hosts as the software runs as SYSTEM but only verifies that the password of the provided user is correct. This also means if the...

Webmin 1.900 Upload Authenticated Remote Command Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Webmin Upload Authenticated RCE', 'Description' = %q This module exploits an arbitrary command execution vulnerability in Webmin 1.900 and lower...

WordPress 5.1 CSRF lead to remote command execution vulnerability alerts-a vulnerability alert-the black bar safety net

Report number: B6-2019-031301 Report source: 360-CERT The authors of the report: a 360-CERT Update date: 2019-03-13 0x00 vulnerability background 2019 03 May 13, 360 CERT monitoring to RIPSTECH released WordPress 5.1 CSRF vulnerability leads to remote code execution the contents of the details...

Apache Tika-server 1.18 - Command Injection

Apache Tika-server 1.18 - Command Injection Description: This is a PoC for remote command execution in Apache Tika-server. Versions Affected: Tika-server versions " print "Example: python CVE-2018-1335.py localhost 9998 calc.exe" else: host = sys.argv1 port = sys.argv2 cmd = sys.argv3 url =...

Microsoft VBScript Engine Remote Command Execution Vulnerability

Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation.Microsoft Windows is an operating system for personal devices.Microsoft Windows Server is a server operating system.VBScript Engine is one of the VBScript scripting language engines. Microsoft Windows Server...

The vulnerability of the Cluster Service Manager component in Cisco HyperFlex hyperconverged infrastructure allows a attacker to execute arbitrary commands.

The vulnerability of the Cluster Service Manager component in the Cisco HyperFlex hyperconverged infrastructure is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

Apache Tika Server Command Injection

Description: This is a PoC for remote command execution in Apache Tika-server. Versions Affected: Tika-server versions " print "Example: python CVE-2018-1335.py localhost 9998 calc.exe" else: host = sys.argv1 port = sys.argv2 cmd = sys.argv3 url = host+":"+strport+"/meta" headers =...

Apache Tika-server < 1.18 - Command Injection

Description: This is a PoC for remote command execution in Apache Tika-server. Versions Affected: Tika-server versions " print "Example: python CVE-2018-1335.py localhost 9998 calc.exe" else: host = sys.argv1 port = sys.argv2 cmd = sys.argv3 url = host+":"+strport+"/meta" headers =...

Microsoft Windows Remote Command Execution Vulnerability

Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation.Microsoft Windows is an operating system for personal devices.Microsoft Windows Server is a server operating system. A remote command execution vulnerability exists in Microsoft Windows. An attacker could...

Apache Tika-server < 1.18 - Command Injection Exploit

Description: This is a PoC for remote command execution in Apache Tika-server. Versions Affected: Tika-server versions " print "Example: python CVE-2018-1335.py localhost 9998 calc.exe" else: host = sys.argv1 port = sys.argv2 cmd = sys.argv3 url = host+":"+strport+"/meta" headers =...

The vulnerability of D-Link DIR-823G router’s microprogramming software arises from the lack of measures taken to neutralize the special elements used in the operating system command set. This allows a hacker to execute arbitrary operating system commands.

The vulnerability of D-Link DIR-823G router microprogramming software exists due to the lack of measures taken to neutralize the special elements used in the operating system’s command set. Exploiting this vulnerability allows a malicious actor to execute arbitrary operating system commands...

The vulnerability of D-Link router microprogramming software, related to the lack of measures for cleaning input data, allows a hacker to execute arbitrary commands.

The vulnerability of D-Link router microprogramming software is related to the lack of measures for cleaning incoming data. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

Severe Flaw Disclosed In StackStorm DevOps Automation Software

A security researcher has discovered a severe vulnerability in the popular, open source event-driven platform StackStorm that could allow remote attackers to trick developers into unknowingly execute arbitrary commands on targeted services. StackStorm, aka "IFTTT for Ops," is a powerful...

OpenKM 6.3.2 6.3.7 - Remote Command Execution (Metasploit)

OpenKM 6.3.2 6.3.7 - Remote Command Execution Metasploit This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'OpenKM Document Management %q Versions of the OpenKM Document Management 'AkkuS ' ,...