CVE-2004-2776

go.cgi in GoScript 2.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the 1 query string or 2 artarchive parameter...

CVE-2019-17621

The UPnP endpoint URL /gena.cgi in the D-Link DIR-859 Wi-Fi router 1.05 and 1.06B01 Beta01 allows an Unauthenticated remote attacker to execute system commands as root, by sending a specially crafted HTTP SUBSCRIBE request to the UPnP service when connecting to the local network...

Apple iOS and Apple watchOS Mail Message Framework Component Resource Management Error Vulnerability

Apple iOS and Apple watchOS are both products of Apple Inc. Apple iOS is an operating system developed for mobile devices. apple watchOS is an operating system for smartwatches. mail Message Framework is one of the email messaging frameworks. A resource management error vulnerability exists in th...

CVE-2019-19681

Pandora FMS 7.x suffers from remote code execution vulnerability. With an authenticated user who can modify the alert system, it is possible to define and execute commands as root/Administrator. NOTE: The product vendor states that the vulnerability as it is described is not in fact an actual...

D-Link Devices Unauthenticated Remote Command Execution in ssdpcgi

D-Link Devices Unauthenticated Remote Command Execution in ssdpcgi. Module Options msf use exploit/linux/upnp/dlink/dir859execssdpcgi msf undefineddir859execssdpcgi show actions ...actions... msf undefineddir859execssdpcgi set ACTION msf undefineddir859execssdpcgi show options ...show and set...

The vulnerability of the Webmin control panel in hosting services, related to deficiencies in access control, allows attackers to execute arbitrary code.

The vulnerability of the Webmin control panel is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by loading a specially created .cgi file through the URI /updown/upload.cgi from a remote location...

The vulnerability of the xpack.security.audit.enabled component of the Kibana data visualization service allows a perpetrator to execute arbitrary commands.

The vulnerability of the xpack.security.audit.enabled component of the Kibana data visualization service is related to insufficient validation of arguments passed to commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

CVE-2019-15599

A Code Injection exists in tree-kill on Windows which allows a remote code execution when an attacker is able to control the input into the command...

CVE-2019-15598

A Code Injection exists in treekill on Windows which allows a remote code execution when an attacker is able to control the input into the command...

[SECURITY] Fedora 31 Update: libssh-0.9.3-1.fc31

The ssh library was designed to be used by programmers needing a working SSH implementation by the mean of a library. The complete control of the client is made by the programmer. With libssh, you can remotely execute programs, tra nsfer files, use a secure and transparent tunnel for your remote...

Security Bulletin: Apache Commons FileUpload Vulnerabilities in IBM Control Center (CVE-2016-1000031)

Summary The DiskFileItem class in Apache Commons Fileupload before 1.3.3, as used in Control Center, could allow remote attackers to execute arbitrary code under current context of the current process causing an undefined behavior. Vulnerability Details CVEID: CVE-2016-1000031 Description: Apache...

The vulnerability of the implementation of diagnostic functions for ping and tracert in the microprogramming software of TP-Link TL-R600VPN allows a intruder to execute arbitrary code.

The vulnerability of the ping and tracert diagnostic functions in the microprogramming software for TP-Link TL-R600VPN implementations lies in the fact that the operation’s results are stored outside of the buffer in memory. Exploiting this vulnerability allows a remote attacker to execute...

The vulnerabilities of the functions cmd_sys_traceroute_exec(), cmd_sys_arp_clear(), and cmd_sys_ping_exec() in the libclicmd.so library of the Zyxel GS1900 router microsystem software allow a attacker to execute arbitrary commands.

The vulnerabilities of the functions cmdsystracerouteexec, cmdsysarpclear, and cmdsyspingexec in the libclicmd.so library of the Zyxel GS1900 router microsystem software exist due to insufficient checking of input data. Exploiting these vulnerabilities can allow an attacker to execute arbitrary...

Revive Adserver deserialization vulnerability

Added: 12/16/2019 CVE: CVE-2019-5434 Background Revive Adserver is a free, open source ad serving system. Problem A deserialization vulnerability in Revive Adserver allows remote attackers to execute arbitrary commands injected into the what parameter of the openads.spc RPC method of adxmlrpc.php...

CVE-2019-16730

This CVE (CVE-2019-16730) affects Petwant PF-103 firmware 4.22.2.42 and Petalk AI 3.2.2.30. The vulnerability resides in processCommandUpgrade() inside libcommon.so, which allows remote attackers to execute arbitrary system commands as root. The issue is network-exploitable, with high impact on c...

Amazon Blink XT2 Sync Module OS Command Injection Vulnerability (CNVD-2020-09706)

Blink XT2 Sync Module is a camera synchronization device. Amazon Blink XT2 Sync Module suffers from an operating system command injection vulnerability. The vulnerability arises from a network system or product not properly filtering special characters, commands, etc. from external input data...

Siemens SPPA-T3000 Application Server Improper Authentication Vulnerability (CNVD-2019-45373)

SPPA-T3000 is a distributed control system mainly used in thermal power plants and large-scale renewable energy power plants.Application Server is the application server in it, which provides the main system services including access control, distribution of data to thin clients and archiving. A...

Mozilla Thunderbird < 68.3

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 68.3. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2019-38 advisory. - Mozilla developers Christoph Diehl, Nathan Froyd, Jason Kratzer, Christian Holler, Karl Tomlinson, Tyson...

CVE-2019-3987

Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitized input when configuring the devices wifi configuration via the key parameter...

Command injection

Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitized input when configuring the devices wifi configuration via the encryption parameter...