ZOHO ManageEngine Applications Manager SQL Injection Vulnerability (CNVD-2020-60827)

ZOHO ManageEngine Applications Manager is a set of IT operation and maintenance management solutions of the United States ZhuoHao ZOHO company. The product has application performance management, fault management, report generation and SLA management and other functions. A SQL injection...

Exploit for CVE-2020-14882

cve-2020-14882 Bash script t...

CVE-2020-27654

Improper access control vulnerability in lbd in Synology Router Manager SRM before 1.2.4-8081 allows remote attackers to execute arbitrary commands via port 1 7786/tcp or 2 7787/tcp...

PT-2020-4934 · Synology · Synology Router Manager

Name of the Vulnerable Software and Affected Versions: Synology Router Manager SRM versions prior to 1.2.4-8081 Description: The issue is related to improper access control in the lbd service of Synology Router Manager SRM, allowing remote attackers to execute arbitrary commands. This can be done...

CVE-2018-19949

If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on build 20200214; QTS 4.3.4.1190 on build...

CVE-2018-19949

If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on build 20200214; QTS 4.3.4.1190 on build...

Security Bulletin: Embedded WebSphere Application Server is vulnerable to a remote command execution vulnerability affects Content Collector for Email

Summary IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a local authenticated attacker to gain elevated privileges on the system, caused by improper handling of UNC paths. By scheduling a task with a specially-crafted UNC path, an attacker could exploit this vulnerability to...

Aruba Airwave Software Remote Command Execution Vulnerability

Aruba Airwave Software is a network monitoring software that helps users view real-time data and situational reports for every user, device, and segment of the network. A remote command execution vulnerability exists in Aruba Airwave Software versions prior to 1.3.2. An attacker can exploit this...

AntSword cross-site scripting vulnerability (CNVD-2020-59741)

AntSword is an open source, cross-platform web management tool designed to meet the needs of penetration testers as well as security researchers with permissions and/or authorizations, and webmasters. A cross-site scripting vulnerability exists in AntSword 2.0.7. An attacker can exploit this...

Aruba Airwave Software Remote Command Execution Vulnerability (CNVD-2020-59213)

Aruba Airwave Software is a network monitoring software that helps users view real-time data and situational reports for every user, device, and segment of the network. A remote command execution vulnerability exists in Aruba Airwave Software versions prior to 1.3.2. An attacker can exploit this...

The vulnerability of the server management module of ZTE’s R5300G4, R8500G4, and R5500G4 servers allows attackers to execute arbitrary commands.

The vulnerability of the server management module of ZTE’s R5300G4, R8500G4, and R5500G4 servers is related to deficiencies in authentication procedures. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

CVE-2020-26878

Ruckus through 1.5.1.0.21 is affected by remote command injection. An authenticated user can submit a query to the API /service/v1/createUser endpoint, injecting arbitrary commands that will be executed as root user via web.py...

CVE-2020-24632

A remote execution of arbitrary commandss vulnerability was discovered in Aruba Airwave Software versions: Prior to 1.3.2...

CVE-2020-18766

CVE-2020-18766 affects AntSword v2.0.7 and is described as a cross-site scripting (XSS) vulnerability that can remotely execute system commands. The connected records confirm the affected software version and the high-impact consequence (remote command execution) but do not provide a concrete roo...

Command execution vulnerability in the backend of more than 100 systems shipped

Shipping 100 is a virtual goods automatic shipping system / article pay to read system, without human guards, customers can buy online to automatically complete the transaction. A command execution vulnerability exists in the backend of several Shipment 100 systems. Attackers can use the...

The vulnerability of the Tenda AC15 AC1900 router’s microprogramming software lies in the insufficient neutralization of special elements transmitted in URIs, allowing a hacker to execute arbitrary commands on the target system.

The vulnerability of the Tenda AC15 AC1900 router’s microprogramming software is related to the insufficient neutralization of special elements transmitted in URIs. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands on the target system by sending specially craft...

DrayTek Vigor < 1.5.1 Unauthenticated RCE (Direct Check)

Nessus was able to exploit an un-authenticated remote command execution vulnerability on the web adminstration UI on the remote router and was able to retrieve the contents of /etc/passwd. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid141781; scriptversion"1.6";...

Bubble Accelerator (Windows Client) Command Execution Vulnerability

Bubble Accelerator is an acceleration tool for games. Bubble Accelerator Windows client A command execution vulnerability exists. An attacker can exploit the vulnerability to remotely execute commands and gain server privileges...

HiSilicon Video Encoder Malicious Firmware Code Execution

!/usr/bin/env bash Exploit Title: HiSilicon video encoders - RCE via unauthenticated upload of malicious firmware Date: 2020-09-20 Exploit Author: Alexei Kojenov Vendor Homepage: multiple vendors Software Link: N/A Version: vendor-specific Tested on: Linux CVE: CVE-2020-24217 Vendors: URayTech,...

The vulnerability of the device controller in the Cisco Data Center Network Manager system allows a hacker to execute arbitrary operating system commands.

The vulnerability of the DCNM device’s dispatcher exists due to the lack of measures taken to neutralize special elements used in the operating system’s command set. Exploiting this vulnerability allows a malicious actor to execute arbitrary operating system commands remotely...