Code injection

Serendipity before 2.3.4 on Windows allows remote attackers to execute arbitrary code because the filename of a renamed file may end with a dot. This file may then be renamed to have a .php filename...

Design/Logic Flaw

This vulnerability allows remote attackers to execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of DNS responses. The issue results...

Design/Logic Flaw

Shihonkanri Plus GOOUT Ver1.5.8 and Ver2.2.10 allows remote attackers to execute arbitrary OS commands via unspecified vectors...

CVE-2020-5556

Shihonkanri Plus GOOUT Ver1.5.8 and Ver2.2.10 allows remote attackers to execute arbitrary OS commands via unspecified vectors...

The vulnerability of the CommandLineService component of the Foglight Evolve platform, which stems from the use of hard-coded user credentials “__service__ user”, allows attackers to execute arbitrary code.

The vulnerability of the CommandLineService component of the Foglight Evolve platform is related to the use of hard-coded user credentials “service user”. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

keitai-site.net mailform code injection vulnerability

keitai-site.net mailform is a mail form plugin written in PHP. A code injection vulnerability exists in keitai-site.net mailform version 1.04. A remote attacker can exploit this vulnerability to execute arbitrary PHP code...

Keijiban Tsumiki vulnerable to OS command injection

Overview Keijiban Tsumiki provided by Mash room - Free CGI - is a CGI to provide Bulletin Board System BBS functions. Keijiban Tsumiki contains an OS command injection vulnerability CWE-78. During the meeting of Committee for authorizing the disclosure of unresolved vulnerabilities held on Januar...

CVE-2020-8868

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight Evolve 9.0.0. Authentication is not required to exploit this vulnerability. The specific flaw exists within the service user account. The product contains a hard-coded password for thi...

Design/Logic Flaw

This vulnerability allows remote attackers to execute local PHP files on affected installations of Horde Groupware Webmail Edition 5.2.22. Authentication is required to exploit this vulnerability. The specific flaw exists within edit.php. When parsing the paramstemplate parameter, the process doe...

CVE-2020-7935

Artica Pandora FMS through 7.42 is vulnerable to remote PHP code execution because of an Unrestricted Upload Of A File With A Dangerous Type issue in the File Manager. An attacker can create a or use an existing directory that is externally accessible to store PHP files. The filename and the exac...

CVE-2020-7935

Artica Pandora FMS through 7.42 is vulnerable to remote PHP code execution because of an Unrestricted Upload Of A File With A Dangerous Type issue in the File Manager. An attacker can create a or use an existing directory that is externally accessible to store PHP files. The filename and the exac...

Vesta Control Panel Operating System Command Injection Vulnerability

Vesta Control Panel VestaCP is an open source web hosting control panel. An operating system command injection vulnerability exists in Vesta Control Panel VestaCP versions 0.9.8-26 and earlier, which can be exploited by an attacker to inject commands and execute code with the help of specially...

CVE-2013-7487

On Swann DVR04B, DVR08B, DVR-16CIF, and DVR16B devices, raysharpdvr application has a vulnerable call to “system”, which allows remote attackers to execute arbitrary code via TCP port 9000...

CVE-2020-7961

Deserialization of Untrusted Data in Liferay Portal prior to 7.2.1 CE GA2 allows remote attackers to execute arbitrary code via JSON web services JSONWS...

ONAP Service Design and Creation Code Injection Vulnerability

ONAP Service Design and Creation SDC is a set of visual modeling and design tools for the ONAP project. A code injection vulnerability exists in ONAP SDC Dublin and prior versions that stems from faulty access control. A remote attacker can exploit this vulnerability by accessing port 7000 of the...

ONAP Service Design and Creation Code Injection Vulnerability (CNVD-2020-24671)

ONAP Service Design and Creation SDC is a set of visual modeling and design tools for the ONAP project. A code injection vulnerability exists in ONAP SDC Dublin and prior versions, which stems from faulty access control. A remote attacker can exploit this vulnerability by accessing port 6000 of t...

PT-2020-2125 · Cisco · Cisco Sd-Wan Solution Vmanage

Name of the Vulnerable Software and Affected Versions: Cisco SD-WAN Solution vManage software affected versions not specified Description: The issue is related to a lack of protection against SQL query structure attacks in the vManage web interface of Cisco SD-WAN. This could allow a remote...

Lexmark Markvision Enterprise Code Issue Vulnerability

Lexmark Markvision Enterprise is the United States Lexmark Lexmark company's set of Web-based network device management software. The software is mainly used to manage network devices such as printers. A security vulnerability exists in the Apache Commons Collections inventory in Lexmark Markvisi...

Cacti: Multiple vulnerabilities

Background Cacti is a complete frontend to rrdtool. Description Multiple vulnerabilities have been discovered in Cacti. Please review the CVE identifiers referenced below for details. Impact Remote attackers could execute arbitrary code or bypass intended access restrictions. Workaround There is ...

Vesta Control Panel Authenticated Remote Code Execution

This module exploits an authenticated command injection vulnerability in the v-list-user-backups bash script file in Vesta Control Panel to gain remote code execution as the root user. Module Options msf use exploit/linux/http/vestacp/exec msf undefinedexec show actions ...actions... msf...