The vulnerability of the ePolicy Orchestrator extension of the McAfee Data Loss protection software allows a hacker to execute arbitrary SQL code.

The vulnerability of the ePolicy Orchestrator extension of the McAfee Data Loss Prevention software lies in the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows an attacker to execute arbitrary SQL code remotely, using the user management section...

Croogo 3.0.2 Remote Code Execution

Exploit Title: Croogo 3.0.2 - Remote Code Execution Authenticated Date: 05/12/2021 Exploit Author: Deha Berkin Bir Vendor Homepage: https://croogo.org/ Software Link: https://downloads.croogo.org/v3.0.2.zip Version: 3.0.2 Tested on: Windows 10 Home Single Language 20H2 & WampServer 3.2.3 ==...

USN-5168-2 thunderbird vulnerability

Tavis Ormandy discovered that NSS, included with Thunderbird, incorrectly handled verifying DSA/RSA-PSS signatures. A remote attacker could use this issue to cause Thunderbird to crash, resulting in a denial of service, or possibly execute arbitrary code...

PT-2021-6481 · NetGear · Netgear Rax50 +20

Name of the Vulnerable Software and Affected Versions: NETGEAR R6400 version not specified NETGEAR R6400v2 version not specified NETGEAR R6700v3 version 1.0.4.120 10.0.91 NETGEAR R6900P version not specified NETGEAR R7000 version not specified NETGEAR R7000P version not specified NETGEAR R8500...

The vulnerability of the ping and tracert commands implemented in the web interface for managing Netis WF2419 router microprogramming software allows a perpetrator to execute arbitrary commands and gain unauthorized access to protected information.

The vulnerability of the ping and tracert commands in the web interface for managing Netis WF2419 microprogramming devices relates to the lack of measures taken to neutralize specific elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands and gain...

The vulnerability of the FilePath API implementation in the Jenkins automation server allows a hacker to execute arbitrary code.

The vulnerability of the FilePath API implementation in the Jenkins automation server relates to unlimited access to the libs/ directory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Anker Eufy Homebase 2 OS Command Injection Vulnerability

The Anker Eufy Homebase 2 is a wireless home security camera system from Eufy USA. The Anker Eufy Homebase 2 suffers from an operating system command injection vulnerability that can be exploited by an attacker to execute arbitrary commands via specially crafted network packets...

CVE-2020-7879

This issue was discovered when the ipTIME C200 IP Camera was synchronized with the ipTIME NAS. It is necessary to extract value for ipTIME IP camera because the ipTIME NAS send ans setCookie'COOKIE' . The value is transferred to the --header option in wget binary, and there is no validation check...

CVE-2021-26612

An improper input validation leading to arbitrary file creation was discovered in copy method of Nexacro platform. Remote attackers use copy method to execute arbitrary command after the file creation included malicious code...

CVE-2021-44077

Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution. This is related to /RestAPI URLs in a servlet, and ImportTechnicians in the Struts configuration...

CVE-2021-38685

A command injection vulnerability has been reported to affect QNAP device, VioStor. If exploited, this vulnerability allows remote attackers to run arbitrary commands. We have already fixed this vulnerability in the following versions of QVR: QVR FW 5.1.6 build 20211109 and later...

The vulnerability of the debug_fcgid component in the D-Link DWR-932C E1 router microprogramming software allows a hacker to execute arbitrary commands.

The vulnerability of the debugfcgid component in the D-Link DWR-932C E1 router microprogramming software is related to the failure to take measures to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary...

The vulnerability of the CMA module in the FusionCompute virtualization software allows a hacker to execute arbitrary commands.

The vulnerability of the CMA module in FusionCompute virtualization software exists due to the lack of measures taken to neutralize the special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

PowerCMS XMLRPC API vulnerable to OS command injection

Overview PowerCMS XMLRPC API provided by Alfasado Inc. contains an OS command injection vulnerability CWE-78. Alfasado Inc. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/CC and Alfasado Inc. coordinated under the Information Security Early Warning...

JVN#17645965: PowerCMS XMLRPC API vulnerable to OS command injection

PowerCMS XMLRPC API provided by Alfasado Inc. contains an OS command injection vulnerability CWE-78. Impact An arbitrary OS command may be executed by a remote attacker. Solution In the case that not using XMLRPC API: If using as CGI/FCGI Delete mt-xmlrpc.cgi or remove execute permission to...

CVE-2021-42784

OS Command Injection vulnerability in debugfcgi of D-Link DWR-932C E1 firmware allows a remote attacker to perform command injection via a crafted HTTP request...

CVE-2021-42784

OS Command Injection vulnerability in debugfcgi of D-Link DWR-932C E1 firmware allows a remote attacker to perform command injection via a crafted HTTP request...

CVE-2021-42785

Buffer Overflow in tvnviewer.exe of TightVNC Viewer allows a remote attacker to execute arbitrary instructions via a crafted FramebufferUpdate packet from a VNC server. Affected component: TightVNC Viewer (tvnviewer.exe); referenced version in the CVE context includes TightVNC Viewer 2.8.59. Root...

CVE-2021-38873

IBM Planning Analytics 2.0 is potentially vulnerable to CSV Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 208396...

GNU gdbserver 9.2 Remote Command Execution

Exploit Title: GNU gdbserver 9.2 - Remote Command Execution RCE Date: 2021-11-21 Exploit Author: Roberto Gesteira Miñarro 7Rocky Vendor Homepage: https://www.gnu.org/software/gdb/ Software Link: https://www.gnu.org/software/gdb/download/ Version: GNU gdbserver Ubuntu 9.2-0ubuntu120.04 9.2 Tested...