Command injection

Tellabs Optical Line Terminal OLT 1150 devices allow Remote Command Execution via the -l option to TELNET or SSH. Tellabs has addressed this issue in the SR30.1 and SR31.1 release on February 18, 2020...

CVE-2019-19148

CVE-2019-19148 affects Tellabs Optical Line Terminal (OLT) 1150 devices, where Remote Command Execution is possible via the -l option on TELNET or SSH. The root cause is an exploitable command path enabled by -l that allows execution of commands with the attacker-supplied input. Tellabs addressed...

CVE-2019-19148

Tellabs Optical Line Terminal OLT 1150 devices allow Remote Command Execution via the -l option to TELNET or SSH. Tellabs has addressed this issue in the SR30.1 and SR31.1 release on February 18, 2020...

The vulnerability of the REMOTE_PORT component of the D-Link DIR-859 router’s microprogramming system exists due to the failure to take measures to neutralize specific elements used in the operating system commands. This vulnerability allows a hacker to execute arbitrary commands.

The vulnerability of the REMOTEPORT component of the D-Link DIR-859 router’s microprogramming system exists due to the lack of measures taken to neutralize the special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary...

The vulnerability of the SERVER_ID component in D-Link DIR-859 router microprogramming software exists due to the lack of measures taken to neutralize special elements used in the operating system commands. This vulnerability allows a hacker to execute arbitrary commands.

The vulnerability of the SERVERID component in the D-Link DIR-859 router microprogramming system exists due to the lack of measures taken to neutralize the special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

The vulnerability of the HTTP_ST component in the D-Link DIR-859 router’s microprogramming system arises from the failure to take measures to neutralize specific elements used in the operating system commands. This vulnerability allows a perpetrator to execute arbitrary commands.

The vulnerability of the HTTPST component in the D-Link DIR-859 router’s microprogramming software exists due to the lack of measures taken to neutralize the special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary command...

Dell EMC Data Protection Advisor Code Injection Vulnerability

Dell EMC Data Protection Advisor is a data protection management solution from Dell Dell. The product supports data backup, data recovery and data replication management. A code injection vulnerability exists in the REST API in Dell EMC Data Protection Advisor. A remote attacker could leverage th...

Centreon Poller Authenticated Remote Command Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Centreon Poller Authenticated Remote Command Execution', 'Description' = %q An authenticated user with sufficient administrative rights to manage...

LogicalDoc Virtual Appliance Multiple Vulnerabilities

1. Advisory Information Title: LogicalDoc Virtual Appliance Multiple Vulnerabilities Advisory ID: CORE-2019-004 Advisory URL: Date published: 2020-03-18 Date of last update: 2020-03-17 Vendors contacted: LogicalDoc Release mode: Coordinated release 2. Vulnerability Information Class: Unrestricted...

CVE-2019-19538

In Sangoma FreePBX 13 through 15 and sysadmin aka System Admin 13.0.92 through 15.0.13.6 modules have a Remote Command Execution vulnerability that results in Privilege Escalation...

CVE-2019-19538

In Sangoma FreePBX 13 through 15 and sysadmin aka System Admin 13.0.92 through 15.0.13.6 modules have a Remote Command Execution vulnerability that results in Privilege Escalation...

Design/Logic Flaw

In Sangoma FreePBX 13 through 15 and sysadmin aka System Admin 13.0.92 through 15.0.13.6 modules have a Remote Command Execution vulnerability that results in Privilege Escalation...

CVE-2019-19538

In Sangoma FreePBX 13 through 15 and sysadmin aka System Admin 13.0.92 through 15.0.13.6 modules have a Remote Command Execution vulnerability that results in Privilege Escalation...

CVE-2019-19538

CVE-2019-19538 affects Sangoma FreePBX 13–15 and the System Admin (sysadmin) module 13.0.92–15.0.13.6, where a Remote Command Execution vulnerability allows privilege escalation. Descriptions across connected records consistently state the impact as RCE leading to higher privileges within the aff...

Command Execution Vulnerability in phpok of Shenzhen Kunshuo Technology Co.

PHPOK system hereinafter referred to as OK system is a content management system for website construction developed by Shenzhen Kunshuo Technology Co., Ltd formerly known as PHPOK Studio, written in PHP, using MySQL database storage by default, and based on the LGPL open-source agreement licensed...

GitLab Community and Enterprise Edition Operating System Command Injection Vulnerability

GitLab is a Ruby on Rails developed, self-hosted, Git version control system project repository application from GitLab, Inc. The program can be used to access the project's file contents, commit history, bug list , etc. Git is a free, open source distributed version control system. An issue was...

CVE-2019-12430

Removed by vendor...

Nagios XI Authenticated Remote Command Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Nagios XI Authenticated Remote Command Execution', 'Description' = %q This module exploits a vulnerability in Nagios XI before 5.6.6 in order to...

Nagios XI - Authenticated Remote Command Execution Exploit

This Metasploit module exploits a vulnerability in Nagios XI versions before 5.6.6 in order to execute arbitrary commands as root. The module uploads a malicious plugin to the Nagios XI server and then executes this plugin by issuing an HTTP GET request to download a system profile from the serve...

Sysaid 20.1.11 b26 - Remote Command Execution

Sysaid 20.1.11 b26 - Remote Command Execution Exploit Title: Sysaid 20.1.11 b26 - Remote Command Execution Google Dork: intext:"Help Desk Software by SysAid " Date: 2020-03-09 Exploit Author: Ahmed Sherif Vendor Homepage: https://www.sysaid.com/free-help-desk-software Software Link:...