CVE-2019-1878

A vulnerability in the Cisco Discovery Protocol CDP implementation for the Cisco TelePresence Codec TC and Collaboration Endpoint CE Software could allow an unauthenticated, adjacent attacker to inject arbitrary shell commands that are executed by the device. The vulnerability is due to...

CVE-2019-1878

A vulnerability in the Cisco Discovery Protocol CDP implementation for the Cisco TelePresence Codec TC and Collaboration Endpoint CE Software could allow an unauthenticated, adjacent attacker to inject arbitrary shell commands that are executed by the device. The vulnerability is due to...

Input validation

A vulnerability in the Cisco Discovery Protocol CDP implementation for the Cisco TelePresence Codec TC and Collaboration Endpoint CE Software could allow an unauthenticated, adjacent attacker to inject arbitrary shell commands that are executed by the device. The vulnerability is due to...

CVE-2019-1878

CVE-2019-1878 describes a shell-injection vulnerability in the Cisco TelePresence Codec (TC) and Collaboration Endpoint (CE) software via the Cisco Discovery Protocol (CDP). The root cause is insufficient input validation of CDP packets, enabling an unauthenticated, adjacent attacker to craft CDP...

CVE-2019-1878: Improper Neutralization of Special Elements used in an OS Command

A vulnerability in the Cisco Discovery Protocol CDP implementation for the Cisco TelePresence Codec TC and Collaboration Endpoint CE Software could allow an unauthenticated, adjacent attacker to inject arbitrary shell commands that are executed by the device. The vulnerability is due to...

PT-2019-2438

Name of the Vulnerable Software and Affected Versions Cisco TelePresence Codec TC and Collaboration Endpoint CE Software affected versions not specified Description A vulnerability in the Cisco Discovery Protocol CDP implementation could allow an unauthenticated, adjacent attacker to inject...

Code injection

The Orpak SiteOmat OrCU component is vulnerable to code injection, for all versions prior to 2017-09-25, due to a search query that uses a direct shell command. By tampering with the request, an attacker is able to run shell commands and receive valid output from the device...

CVE-2017-14853

The Orpak SiteOmat OrCU component is vulnerable to code injection, for all versions prior to 2017-09-25, due to a search query that uses a direct shell command. By tampering with the request, an attacker is able to run shell commands and receive valid output from the device...

PT-2019-8012

Name of the Vulnerable Software and Affected Versions Orpak SiteOmat OrCU versions prior to 2017-09-25 Description The issue allows code injection due to a search query that uses a direct shell command. An attacker can tamper with the request to run shell commands and receive valid output from th...

PT-2019-11399

Name of the Vulnerable Software and Affected Versions: Pydio versions through 8.2.2 Description: The issue concerns the ImageMagick plugin in Pydio, which does not properly validate and sanitize user-supplied input in its configuration options. This allows an attacker to execute arbitrary shell...

Command Injection in Xstream

Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON...

CVE-2013-7285

Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON...

CVE-2013-7285

Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON...

CVE-2013-7285: Improper Neutralization of Special Elements used in an OS Command

Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary shell commands by manipulating the processed input stream when unmarshaling XML or any supported format. e.g. JSON...

OS Command Injection

mailx is vulnerable to OS command injection. A syntactically valid email address could allow a local attacker to execute arbitrary shell commands through shell meta-characters and the direct command execution functionality...

Design/Logic Flaw

On D-Link DAP-1530 A1 before firmware version 1.06b01, DAP-1610 A1 before firmware version 1.06b01, DWR-111 A1 before firmware version 1.02v02, DWR-116 A1 before firmware version 1.06b03, DWR-512 B1 before firmware version 2.02b01, DWR-711 A1 through firmware version 1.11, DWR-712 B1 before...

CVE-2018-19300: Improper Input Validation

On D-Link DAP-1530 A1 before firmware version 1.06b01, DAP-1610 A1 before firmware version 1.06b01, DWR-111 A1 before firmware version 1.02v02, DWR-116 A1 before firmware version 1.06b03, DWR-512 B1 before firmware version 2.02b01, DWR-711 A1 through firmware version 1.11, DWR-712 B1 before...

CVE-2019-5424

In Ubiquiti Networks EdgeSwitch X v1.1.0 and prior, a privileged user can execute arbitrary shell commands over the SSH CLI interface. This allows to execute shell commands under the root user...

CVE-2019-5425

In Ubiquiti Networks EdgeSwitch X v1.1.0 and prior, an authenticated user can execute arbitrary shell commands over the SSH interface bypassing the CLI interface, which allow them to escalate privileges to root...

PT-2019-17657

Name of the Vulnerable Software and Affected Versions Ubiquiti Networks EdgeSwitch X versions 1.1.0 and prior Description A privileged user can execute arbitrary shell commands over the SSH CLI interface, allowing the execution of shell commands under the root user. Recommendations For versions...