15765 matches found
CVE-2020-5739
Grandstream GXP1600 series firmware 1.0.4.152 and below is vulnerable to authenticated remote command execution when an attacker adds an OpenVPN up script to the phone's VPN settings via the "Additional Settings" field in the web interface. When the VPN's connection is established, the user defin...
CVE-2020-5738
Grandstream GXP1600 series firmware 1.0.4.152 and below is vulnerable to authenticated remote command execution when an attacker uploads a specially crafted tar file to the HTTP /cgi-bin/uploadvpntar interface...
CVE-2020-5738
The CVE-2020-5738 entry concerns Grandstream GXP1600 series firmware 1.0.4.152 and earlier. Affects the device via the HTTP endpoint /cgi-bin/upload_vpntar, where an attacker must be authenticated to upload a specially crafted tar file, leading to remote command execution on the affected system. ...
CVE-2020-6765
D-Link DSL-GS225 J1 AU1.0.4 devices allow an admin to execute OS commands by placing shell metacharacters after a supported CLI command, as demonstrated by ping -c1 127.0.0.1; cat/etc/passwd. The CLI is reachable by TELNET...
NagiosXI 5.6.11 Remote Command Execution
%PDF-1.5 %µµµµ 1 0 obj endobj 2 0 obj endobj 3 0 obj /ExtGState/XObject/ProcSet/PDF/Text/ImageB/ImageC/ImageI /Annots 8 0 R 9 0 R /MediaBox 0 0 595.32 841.92 /Contents 4 0 R/Group/Tabs/S/StructParents 0 endobj 4 0 obj stream xµXëoHÿnÉÿÃ|J^Ø'lUUÊ£TרݻÒ...
ExpressionEngine: Low privileges (auth) Remote Command Execution - PHP file upload bypass.
The ExpressionEngine software was vulnerable to a remote command execution flaw due to a bypass in the file upload extension check, which allowed a low-privileged user to execute arbitrary commands...
IBM strong-nginx-controller injection vulnerability
IBM strong-nginx-controller is a Nginx server controller from IBM, USA. An injection vulnerability exists in IBM strong-nginx-controller version 1.0.2 and earlier. A remote attacker can exploit the vulnerability to execute arbitrary commands with the first parameter of the 'nginxCmd' function...
[SECURITY] [DSA 4650-1] qbittorrent security update
------------------------------------------------------------------------- Debian Security Advisory DSA-4650-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso April 02, 2020 https://www.debian.org/security/faq -...
[SECURITY] [DSA 4650-1] qbittorrent security update
------------------------------------------------------------------------- Debian Security Advisory DSA-4650-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso April 02, 2020 https://www.debian.org/security/faq -...
CVE-2019-14868
In ksh version 20120801, a flaw was found in the way it evaluates certain environment variables. An attacker could use this flaw to override or bypass environment restrictions to execute shell commands. Services and applications that allow remote unauthenticated attackers to provide one of those...
CVE-2020-10948
Jon Hedley AlienForm2 typically installed as af.cgi or alienform.cgi 2.0.2 is vulnerable to Remote Command Execution via eval injection, a different issue than CVE-2002-0934. An unauthenticated, remote attacker can exploit this via a series of crafted requests...
CVE-2020-10948
Jon Hedley AlienForm2 typically installed as af.cgi or alienform.cgi 2.0.2 is vulnerable to Remote Command Execution via eval injection, a different issue than CVE-2002-0934. An unauthenticated, remote attacker can exploit this via a series of crafted requests...
Design/Logic Flaw
Jon Hedley AlienForm2 typically installed as af.cgi or alienform.cgi 2.0.2 is vulnerable to Remote Command Execution via eval injection, a different issue than CVE-2002-0934. An unauthenticated, remote attacker can exploit this via a series of crafted requests...
CVE-2020-10948
Jon Hedley AlienForm2 typically installed as af.cgi or alienform.cgi 2.0.2 is vulnerable to Remote Command Execution via eval injection, a different issue than CVE-2002-0934. An unauthenticated, remote attacker can exploit this via a series of crafted requests...
CVE-2020-10948
The CVE-2020-10948 entry concerns Jon Hedley’s AlienForm2 (AlienForm CGI, typically af.cgi or alienform.cgi) v2.0.2, which is vulnerable to Remote Command Execution via eval injection. The vulnerability is unauthenticated and exploitable by remote attackers through crafted requests; this is descr...
IBM Spectrum Protect Plus Command Execution Vulnerability (CNVD-2020-20698)
IBM Spectrum Protect Plus is a suite of data protection platforms from IBM USA. The platform provides organizations with a single point of control and management and supports backup and recovery for virtual, physical and cloud environments of all sizes. A security vulnerability exists in IBM...
Buffer Overflow Vulnerability in Multiple IBM Products (CNVD-2020-22192)
IBM Aspera is a set of fast file transfer and streaming solutions built on the IBM FASP protocol from IBM in the United States. A buffer overflow vulnerability exists in multiple IBM products. An attacker could exploit the vulnerability to execute commands in a restricted shell...
IBM Spectrum Protect Plus Command Execution Vulnerability (CNVD-2020-20699)
IBM Spectrum Protect Plus is a suite of data protection platforms from IBM USA. The platform provides organizations with a single point of control and management and supports backup and recovery for virtual, physical and cloud environments of all sizes. A security vulnerability exists in IBM...
CVE-2020-4241
IBM Spectrum Scale and IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary commands on the system. IBM...
EUVD-2020-25488
IBM Spectrum Scale and IBM Spectrum Protect Plus 10.1.0 through 10.1.5 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary commands on the system. IBM...