CVE-2019-18655

File Sharing Wizard version 1.5.0 build 2008 is affected by a Structured Exception Handler based buffer overflow vulnerability. An unauthenticated attacker is able to perform remote command execution and obtain a command shell by sending a HTTP GET request including the malicious payload in the...

Design/Logic Flaw

File Sharing Wizard version 1.5.0 build 2008 is affected by a Structured Exception Handler based buffer overflow vulnerability. An unauthenticated attacker is able to perform remote command execution and obtain a command shell by sending a HTTP GET request including the malicious payload in the...

CVE-2019-18655

CVE-2019-18655 affects File Sharing Wizard 1.5.0 (build 2008) and is an SEH-based buffer overflow that enables remote code execution via crafted HTTP requests (GET/DELETE reported in sources). Public exploit/ PoC evidence exists (e.g., Metasploit module file_sharing_wizard_seh.rb). No remediation...

PT-2019-15557 · Upredsun · File Sharing Wizard

File Sharing Wizard version 1.5.0 build 2008 is affected by a Structured Exception Handler based buffer overflow vulnerability. An unauthenticated attacker is able to perform remote command execution and obtain a command shell by sending a HTTP GET request including the malicious payload in the...

McAfee Advanced Threat Defense SB10304 Multiple Security Vulnerabilities

Description McAfee Advanced Threat Defense is prone to the following security vulnerabilities: 1. Multiple information disclosure vulnerabilities. 2. A remote command execution vulnerability 3. Directory-traversal vulnerability. 4. An SQL-injection vulnerability. 5. A security vulnerability...

PT-2019-4524 · Rconfig · Rconfig

Name of the Vulnerable Software and Affected Versions: rConfig version 3.9.3 Description: The issue is related to errors in handling HTTP requests in the ajaxArchiveFiles.php component of the rConfig utility for managing network device configurations. Exploitation of this issue may allow a remote...

Arbitrary Command Execution Vulnerability in Multiple Cisco Products

Cisco RV016 Multi-WAN VPN Router and so on are a VPN virtual private network router from Cisco. An arbitrary command execution vulnerability exists in the Web management interface of several Cisco products, which stems from the program's failure to validate the input of HTTP payloads, and can be...

Exploit for OS Command Injection in Webmin

CVE-2019-12840POC PoC for Webmin Package Update Au...

Remote Command Execution Vulnerability in Zendo PMS

Zendo PMS is a set of project management software developed by Easoft Tianchuang in order to solve the chaotic and disorganized phenomenon that occurs in the management process of many enterprises. Zendo PMS has a remote command execution vulnerability that can be exploited by attackers to obtain...

Nostromo 1.9.6 Directory Traversal / Remote Command Execution Exploit

This Metasploit module exploits a remote command execution vulnerability in Nostromo versions 1.9.6 and below. This issue is caused by a directory traversal in the function httpverify in nostromo nhttpd allowing an attacker to achieve remote code execution via a crafted HTTP request. This module...

Apache Solr Remote Command Execution Vulnerability Based on Velocity Templates

Apache Solr is the United States Apache Apache Software Foundation of a Lucene a full-text search engine based on the search server . The product supports level search , vertical search , highlighting search results and so on. A remote command execution vulnerability exists in Apache Solr based o...

Nostromo 1.9.6 Directory Traversal / Remote Command Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Nostromo Directory Traversal Remote Command Execution', 'Description' = %q This module exploits a remote command execution vulnerability in...

CVE-2019-16662

An issue was discovered in rConfig 3.9.2. An attacker can directly execute system commands by sending a GET request to ajaxServerSettingsChk.php because the rootUname parameter is passed to the exec function without filtering, which can lead to command execution...

CVE-2019-16662

CVE-2019-16662 affects rConfig 3.9.2 and earlier. The flaw enables remote command execution via unauthenticated requests to ajaxServerSettingsChk.php where the rootUname parameter is passed to exec without filtering, enabling commands to run as the web server user. Related evidence shows Metasplo...

TP-Link M7350 triggerPort OS Command Injection Vulnerability (CNVD-2019-40069)

The TP-Link M7350 is a 4G LTE mobile Wi-Fi router. A portMappingProtocol OS command injection vulnerability exists in TP-Link M7350 1.0.16 and earlier versions. An attacker can exploit this vulnerability to execute illegal OS commands...

The vulnerability of Moxa EDS-810 microcontroller-based web consoles arises from insufficient checking of input data, allowing attackers to execute arbitrary commands.

The vulnerability of Moxa EDS-810 microcontroller-based web consoles exists due to insufficient checking of input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

EOL D-Link Routers Vulnerable to Remote Command Execution

The CERT Coordination Center CERT/CC has released information on a vulnerability CVE-2019-16920 affecting multiple D-Link routers. A remote attacker could exploit this vulnerability to take control of an affected device. D-Link no longer provides support to the affected end-of-life EOL devices, a...

Multiple D-Link routers vulnerable to remote command execution

Overview Multiple D-Link routers are vulnerable to unauthenticated remote command execution. Description Several D-Link routers contain CGI capability that is exposed to users as /applysec.cgi, and dispatched on the device by the binary /www/cgi/ssi. This CGI code contains two flaws: 1. The...

Nostromo Directory Traversal Remote Command Execution

This module exploits a remote command execution vulnerability in Nostromo use exploit/multi/http/nostromo/codeexec msf undefinedcodeexec show actions ...actions... msf undefinedcodeexec set ACTION msf undefinedcodeexec show options ...show and set options... msf undefinedcodeexec run This module...

CVE-2019-15066 A remote command execution vulnerability was discovered in HiNet GPON firmware < I040GWR190731 port 6998

An “invalid command” handler issue was discovered in HiNet GPON firmware I040GWR190731. It allows an attacker to execute arbitrary command through port 6998. CVSS 3.0 Base score 10.0. CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H...