CVE-2019-13411 A remote command execution vulnerability was discovered in HiNet GPON firmware < I040GWR190731 port 3097

An “invalid command” handler issue was discovered in HiNet GPON firmware I040GWR190731. It allows an attacker to execute arbitrary command through port 3097. CVSS 3.0 Base score 10.0. CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H...

Exploit for OS Command Injection in Webmin

It is an exploit module for CVE-2019-15107, a vulnerability in Webmin. The target product/service is Webmin, a web-based interface for system administration. The vulnerability class/vector is a remote command execution RCE vulnerability. The probable entry point is the "passwordchange.cgi" script...

Unspecified Vulnerability in Compal CH7465LG

The Compal CH7465LG is a wireless router from Compal Computer Industries Compal of Taiwan, China. A security vulnerability exists in the setter.xml component of the Common Gateway Interface in the Compal CH7465LG version 6.12.18.25-2p4, which is caused by the program not properly validating the...

Ajenti Remote Command Execution Vulnerability

Ajenti is a web control panel written in python and angularjs. Ajenti suffers from a remote command execution vulnerability. An attacker can execute commands on a local monitoring server while testing...

Cisco Firepower Management Center RCE (cisco-sa-20191002-fmc-rce)

Remote command execution vulnerabilities exist in the web UI of Cisco Firepower Management Center due to insufficient input validation. An authenticated, remote attacker can exploit this by sending crafted input to the web UI to to bypass authentication and execute arbitrary commands. Please see...

Design/Logic Flaw

D-Link DIR-846 devices with firmware 100A35 allow remote attackers to execute arbitrary OS commands as root by leveraging admin access and sending a /HNAP1/ request for SetMasterWLanSettings with shell metacharacters to /squashfs-root/www/HNAP1/control/SetMasterWLanSettings.php...

CVE-2019-17510

D-Link DIR-846 devices with firmware 100A35 allow remote attackers to execute arbitrary OS commands as root by leveraging admin access and sending a /HNAP1/ request for SetWizardConfig with shell metacharacters to /squashfs-root/www/HNAP1/control/SetWizardConfig.php...

CVE-2019-17059

A shell injection vulnerability on the Sophos Cyberoam firewall appliance with CyberoamOS before 10.6.6 MR-6 allows remote attackers to execute arbitrary commands via the Web Admin and SSL VPN consoles...

Ajenti Remote Command Execution

!/usr/bin/python ajentix.py Ajenti Remote Command Execution Exploit Jeremy Brown jbrown3264/gmail @ Oct 2019 ------- Details ------- Ajenti is a web control panel written in Python and AngularJS. One can locally monitor executed commands on the server while testing $ sudo ./exec-notify google for...

vBulletin Flaw Exploited in Dutch Sex-Work Forum Breach

Hackers have stolen the account details of 250,000 users of Dutch sex-work forum Hookers.nl – including email addresses of both escorts and customers. The website provides a forum for escorts and customers to discuss sex work — including clients discussing their experiences with sex workers. A...

Cisco Firepower Management Center Buffer Overflow Vulnerability (CNVD-2019-34718)

Cisco Firepower Management Center FMC is a new generation of firewall management center software from Cisco. A buffer overflow vulnerability exists in the Web UI in Cisco Firepower Management Center, which arises from a failure to adequately validate input and can be exploited by a remote attacke...

Cisco Firepower Management Center Buffer Overflow Vulnerability

Cisco Firepower Management Center FMC is a new generation of firewall management center software from Cisco. A buffer overflow vulnerability exists in the Web UI in Cisco Firepower Management Center that stems from inadequate input validation. A remote attacker could exploit the vulnerability by...

CVE-2019-9535 iTerm2, up to and including version 3.3.5, with tmux integration is vulnerable to remote command execution

A vulnerability exists in the way that iTerm2 integrates with tmux's control mode, which may allow an attacker to execute arbitrary commands by providing malicious output to the terminal. This affects versions of iTerm2 up to and including 3.3.5. This vulnerability may allow an attacker to execut...

iTerm2 CVE-2019-9535 Remote Command Execution Vulnerability

Description iTerm2 is prone to a remote command-injection vulnerability Attackers can exploit this issue to execute arbitrary commands on the system. iTerm2 version 3.3.5 and prior versions are vulnerable. Technologies Affected iTerm2 iTerm2 3.0.4 iTerm2 iTerm2 3.1.0 iTerm2 iTerm2 3.1.5 iTerm2...

The vulnerability of the Web UI of the software-hardware management solution for Cisco Firepower Management Center allows a perpetrator to execute arbitrary commands on a vulnerable device.

The vulnerability of the Web UI of the Cisco Firepower Management Center’s network security management software exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands on the vulnerable device remotely...

iTerm2 with tmux integration is vulnerable to remote command execution

Overview iTerm2, up to and including version 3.3.5, with tmux integration is vulnerable to remote command execution. Description iTerm2 is a popular terminal emulator for macOS that supports terminal multiplexing using tmux integration and is frequently used by developers and system administrator...

Puppet Enterprise < 2016.4.5 / 2016.5.x / 2017.1.x Multiple Vulnerabilities

According to its self-reported version number, the Puppet install on the remote host is affected by multiple vulnerabilities : - A remote command execution vulnerability exists in the MCollective plugin due to unsafe YAML deserialization. An unauthenticated, remote attacker can exploit this to...

iTerm2 with tmux integration is vulnerable to remote command execution

A vulnerability exists in the way that iTerm2 integrates with tmux’s control mode, which may allow an attacker to execute arbitrary commands by providing malicious output to the terminal. This affects versions of iTerm2 up to and including 3.3.5. This vulnerability may allow an attacker to execut...

CVE-2019-13336

The dbell Wi-Fi Smart Video Doorbell DB01-S Gen 1 allows remote attackers to launch commands with no authentication verification via TCP port 81, because the loginuse and loginpass parameters to openlock.cgi can have arbitrary values. NOTE: the vendor's position is that this product reached end o...

Debian: Security Advisory (DLA-1948-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...