CVE-2020-14412

CVE-2020-14412 affects NeDi 1.9C. The System-Snapshot.php file fails to properly escape shell metacharacters from POST requests, enabling potential Remote Command Execution via a crafted payload in the psw parameter; CSRF also noted as a possibility. Documents confirm the vulnerability vector and...

e-Tax Reception System Chrome Extension Injection Vulnerability

Chrome Extension is an extension for the e-Tax Reception System, an electronic tax management system of the National Tax Agency of Japan. A security vulnerability exists in Chrome Extension in the e-Tax Reception System Ver1.0.0.0. The vulnerability can be exploited by a remote attacker to execut...

The vulnerability of the exec function in the umount package manager of the NPM allows a hacker to execute arbitrary commands.

The vulnerability of the exec function in the umount package manager of the NPM is related to the lack of security measures for handling web page structures. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

PYSEC-2020-95

In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication spark.authenticate via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application's resources on the Spark cluster, even...

Bitdefender Total Security Input Validation Error Vulnerability

Bitdefender Total Security is a security solution. An input validation error vulnerability exists in the Safepay browser component in versions prior to Bitdefender Total Security 2020 24.0.20.116. A remote attacker can exploit this vulnerability by running commands inside the Safepay Utility...

CVE-2020-13887

documentsadd.php in Kordil EDMS through 2.2.60rc3 allows Remote Command Execution because .php files can be uploaded to the documents folder...

CVE-2020-13887

documentsadd.php in Kordil EDMS through 2.2.60rc3 allows Remote Command Execution because .php files can be uploaded to the documents folder...

CVE-2020-13887

Kordil EDMS is affected by CVE-2020-13887 in versions up to 2.2.60rc3, where documents_add.php allows remote command execution because PHP files can be uploaded to the Documents folder. The vulnerability is described across multiple sources (NVD entry and CNVD/Red Hat/CVE records) as a remote cod...

CVE-2020-13887

documentsadd.php in Kordil EDMS through 2.2.60rc3 allows Remote Command Execution because .php files can be uploaded to the documents folder...

CVE-2020-14950

aaPanel through 6.6.6 allows remote authenticated users to execute arbitrary commands via shell metacharacters in a modified /system?action=ServiceAdmin request start, stop, or restart to the setting menu of Sotfware Store...

Design/Logic Flaw

aaPanel through 6.6.6 allows remote authenticated users to execute arbitrary commands via shell metacharacters in a modified /system?action=ServiceAdmin request start, stop, or restart to the setting menu of Sotfware Store...

Zivif Camera 2.3.4.2103 iptest.cgi Blind Remote Command Execution

This Metasploit module exploits a remote command execution vulnerability in Zivif webcams. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Zivif Camera iptest.cgi Blind Remote Command Execution...

The vulnerability of the dns_query.cgi component of D-Link DIR-825 and TRENDnet TEW-632BRP routers allows a hacker to execute arbitrary commands.

The vulnerability of the dnsquery.cgi component of D-Link DIR-825 and TRENDnet TEW-632BRP routers exists due to the failure to address the special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

The vulnerability of the set_sta_enrollee_pin.cgi component of D-Link’s router microprogramming systems, DIR-825 and TEW-632BRP, allows a hacker to execute arbitrary commands.

The vulnerability of the setstaenrolleepin.cgi component of D-Link’s router microprogramming systems, such as DIR-825 and TEW-632BRP, exists due to the failure to take measures to neutralize special elements used in operating system commands. Exploiting this vulnerability allows a malicious actor...

The vulnerability of the system_time.cgi component of D-Link DIR-825 and TRENDnet TEW-632BRP router microprograms allows a hacker to execute arbitrary commands.

The vulnerability of the systemtime.cgi component in D-Link DIR-825 and TRENDnet TEW-632BRP routers exists due to the failure to address the need to neutralize specific elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary...

Exploit for CVE-2018-11776

PoC exploit for CVE-2018-11776, a Struts2 RCE vulnerability. The target product/service is Apache Struts 2, and the vulnerability class/vector is Remote Command Execution RCE. The probable entry point is the "help.action" URL, which is accessed via a specially crafted OGNL payload. The exploit is...

DEBIAN-CVE-2020-14295

A SQL injection issue in color.php in Cacti 1.2.12 allows an admin to inject SQL via the filter parameter. This can lead to remote command execution because the product accepts stacked queries...

CVE-2020-14295

A SQL injection issue in color.php in Cacti 1.2.12 allows an admin to inject SQL via the filter parameter. This can lead to remote command execution because the product accepts stacked queries...

CVE-2020-14295

A SQL injection issue in color.php in Cacti 1.2.12 allows an admin to inject SQL via the filter parameter. This can lead to remote command execution because the product accepts stacked queries...

Sql injection

A SQL injection issue in color.php in Cacti 1.2.12 allows an admin to inject SQL via the filter parameter. This can lead to remote command execution because the product accepts stacked queries...