CVE-2020-3403

A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker to inject a command to the underlying operating system that will execute with root privileges upon the next reboot of the device. The authenticated user must have privileged EXEC permissions on the...

CVE-2020-2038

An OS Command Injection vulnerability in the PAN-OS management interface that allows authenticated administrators to execute arbitrary OS commands with root privileges. This issue impacts: PAN-OS 9.0 versions earlier than 9.0.10; PAN-OS 9.1 versions earlier than 9.1.4; PAN-OS 10.0 versions earlie...

CVE-2020-14510

GateManager versions prior to 9.2c, The affected product contains a hard-coded credential for telnet, allowing an unprivileged attacker to execute commands as root...

DEBIAN-CVE-2020-15862

Net-SNMP through 5.8 has Improper Privilege Management because SNMP WRITE access to the EXTEND MIB provides the ability to run arbitrary commands as root...

Security Bulletin: IBM Elastic Storage Server is affected by a vulnerability where an unprivileged user could execute commands as root ( CVE-2020-4273)

Summary A security vulnerability has been identified in all levels of IBM Elastic Storage Server that could allow an unprivileged user to execute commands as root. A fix for this vulnerability is available Vulnerability Details CVEID: CVE-2020-4273 DESCRIPTION: IBM Spectrum Scale 4.2 and 5.0 coul...

The vulnerability in the web interface of the operating system PAN-OS allows a perpetrator to execute arbitrary commands on the operating system with root privileges.

The vulnerability in the web interface of the operating system PAN-OS exists due to the lack of measures taken to neutralize special elements used in the operating system’s commands. Exploiting this vulnerability allows a malicious actor, operating remotely, to execute arbitrary operating system...

Grandstream UCM6200 Series OS Command Injection Vulnerability (CNVD-2020-44351)

The Grandstream UCM6200 is an enterprise-class switch for IP telephony communications from Grandstream. An OS command injection vulnerability exists in the Grandstream UCM6200 series versions 1.0.20.23 and earlier. A remote authenticated attacker can exploit this vulnerability by sending a...

CVE-2020-5535

OpenBlocks IoT VX2 prior to Ver.4.0.0 Ver.3 Series allows an attacker on the same network segment to execute arbitrary OS commands with root privileges via unspecified vectors...

CVE-2019-12511

In NETGEAR Nighthawk X10-R9000 prior to 1.0.4.26, an attacker may execute arbitrary system commands as root by sending a specially-crafted MAC address to the "NETGEAR Genie" SOAP endpoint at AdvancedQoS:GetCurrentBandwidthByMAC. Although this requires QoS being enabled, advanced QoS being enabled...

CVE-2020-5525

Aterm series Aterm WF1200C firmware Ver1.2.1 and earlier, Aterm WG1200CR firmware Ver1.2.1 and earlier, Aterm WG2600HS firmware Ver1.3.2 and earlier allows an authenticated attacker on the same network segment to execute arbitrary OS commands with root privileges via management screen...

The vulnerability of the Junos Dynamic Host Configuration Protocol Daemon (JDHCPD) in the operating system allows a attacker to execute arbitrary commands with root privileges.

The vulnerability of the Junos Dynamic Host Configuration Protocol Daemon JDHCPD operating system is related to the failure to eliminate special elements used in the operating system’s commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands with root...

Netis WF2419 Remote Code Execution Vulnerability

The Netis WF2419 is a 300Mbps wireless router. A remote code execution vulnerability exists in Netis WF2419 1.2.31805, 2.2.36123. The vulnerability stems from a lack of validation of user input. An authenticated attacker can exploit this vulnerability to execute system commands as root via a web...

CVE-2020-8655

An issue was discovered in EyesOfNetwork 5.3. The sudoers configuration is prone to a privilege escalation vulnerability, allowing the apache user to run arbitrary commands as root via a crafted NSE script for nmap 7...

CVE-2019-19681

Pandora FMS 7.x suffers from remote code execution vulnerability. With an authenticated user who can modify the alert system, it is possible to define and execute commands as root/Administrator. NOTE: The product vendor states that the vulnerability as it is described is not in fact an actual...

The vulnerability of the Apache Hadoop distributed development and execution platform, related to insecure privilege management, allows a attacker to execute arbitrary commands with root privileges.

The vulnerability of the Apache Hadoop distributed development and execution platform is related to insecure privilege management. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands with root privileges remotely...

CVE-2019-16733

processCommandSetUid in libcommon.so in Petwant PF-103 firmware 4.22.2.42 and Petalk AI 3.2.2.30 allows remote attackers to execute arbitrary system commands as the root user...

Command injection

An issue was discovered in TitanHQ WebTitan before 5.18. It has a sudoers file that enables low-privilege users to execute a vast number of commands as root, including mv, chown, and chmod. This can be trivially exploited to gain root privileges by an attacker with access...

[SECURITY] Fedora 29 Update: sudo-1.8.28-1.fc29

Sudo superuser do allows a system administrator to give certain users or groups of users the ability to run some or all commands as root while logging all commands and arguments. Sudo operates on a per-command basis. It is not a replacement for the shell. Features include: the ability to restrict...

CVE-2019-17499

The setter.xml component of the Common Gateway Interface on Compal CH7465LG 6.12.18.25-2p4 devices does not properly validate ping command arguments, which allows remote authenticated users to execute OS commands as root via shell metacharacters in the TargetIP parameter...

The vulnerability of the multi-connection mode of the Microprogrammable Network Interface Device Firepower Threat Defense (FTD) allows a attacker to exit the container for their own instance of FTD and execute arbitrary commands with root privileges.

The vulnerability of the multi-connection mode of the Firepower Threat Defense FTD software relates to security configuration errors. Exploiting this vulnerability allows an attacker to execute arbitrary commands with root privileges from within the FTD instance...