4175 matches found
Design/Logic Flaw
Grandstream GXV3370 before 1.0.1.41 and WP820 before 1.0.3.6 devices allow remote authenticated users to execute arbitrary code via shell metacharacters in a /manager?action=getlogcat priority field...
CVE-2019-10660
Grandstream GXV3611IRHD before 1.0.3.23 devices allow remote authenticated users to execute arbitrary code via shell metacharacters in the /goform/systemlog?cmd=set logserver field...
CVE-2019-10662
CVE-2019-10662 affects Grandstream UCM6204 devices running firmware prior to 1.0.19.20. The issue lets remote authenticated users execute arbitrary code via shell metacharacters in the backupUCMConfig file-backup parameter sent to the /cgi? URI. Root cause appears to be a command execution vulner...
CVE-2019-10660
Grandstream GXV3611IRHD before 1.0.3.23 devices allow remote authenticated users to execute arbitrary code via shell metacharacters in the /goform/systemlog?cmd=set logserver field...
CVE-2019-10659
CVE-2019-10659 affects Grandstream GXV3370 (before 1.0.1.41) and WP820 (before 1.0.3.6). A remote authenticated attacker can execute arbitrary code by supplying shell metacharacters in the /manager?action=getlogcat priority parameter. Reported impact indicates remote code execution with at least ...
CVE-2019-10659
Grandstream GXV3370 before 1.0.1.41 and WP820 before 1.0.3.6 devices allow remote authenticated users to execute arbitrary code via shell metacharacters in a /manager?action=getlogcat priority field...
CVE-2019-10658
Grandstream GWN7610 before 1.0.8.18 devices allow remote authenticated users to execute arbitrary code via shell metacharacters in the filename in a /ubus/controller.icc.updatendswebrootfromtmp updatendswebrootfromtmp API call...
CVE-2019-10656
Grandstream GWN7000 before 1.0.6.32 devices allow remote authenticated users to execute arbitrary code via shell metacharacters in the filename in a /ubus/uci.apply updatendswebrootfromtmp API call...
CVE-2019-10656
Summary: CVE-2019-10656 affects Grandstream GWN7000 prior to 1.0.6.32. Affected component is the /ubus/uci.apply update_nds_webroot_from_tmp API call, where remote authenticated users can inject shell metacharacters in a filename to execute arbitrary code on the device. Public references across d...
CVE-2019-10655
CVE-2019-10655: Grandstream remote code execution vulnerability affects Grandstream GAC2500 (1.0.3.35), GXP2200 (1.0.3.27), GVC3202 (1.0.3.51), GXV3275 (before 1.0.3.219 Beta), and GXV3240 (before 1.0.3.219 Beta). The issue enables unauthenticated RCE via shell metacharacters in the /manager?acti...
PT-2019-11975 · Grandstream · Grandstream Ucm6204
Name of the Vulnerable Software and Affected Versions: Grandstream UCM6204 version 1.0.19.20 and earlier Description: The issue allows remote authenticated users to execute arbitrary code via shell metacharacters in the file-backup parameter to the "/cgi" API endpoint. Recommendations: For...
PT-2019-11968 · Grandstream +1 · Grandstream Gac2500 +5
Name of the Vulnerable Software and Affected Versions: Grandstream GAC2500 version 1.0.3.35 Grandstream GXP2200 version 1.0.3.27 Grandstream GVC3202 version 1.0.3.51 Grandstream GXV3275 versions prior to 1.0.3.219 Beta Grandstream GXV3240 versions prior to 1.0.3.219 Beta Description: The issue...
PT-2019-11971 · Grandstream · Grandstream Gwn7610
Name of the Vulnerable Software and Affected Versions: Grandstream GWN7610 versions prior to 1.0.8.18 Description: The issue allows remote authenticated users to execute arbitrary code via shell metacharacters in the filename in a "/ubus/controller.icc.update nds webroot from tmp" API call,...
PT-2019-11972 · Grandstream · Grandstream Wp820 +1
Name of the Vulnerable Software and Affected Versions: Grandstream GXV3370 versions prior to 1.0.1.41 Grandstream WP820 versions prior to 1.0.3.6 Description: The issue allows remote authenticated users to execute arbitrary code via shell metacharacters in a "priority field" of the...
elFinder PHP Connector < 2.1.48 - exiftran Command Injection Exploit
This Metasploit module exploits a command injection vulnerability in elFinder versions prior to 2.1.48. The PHP connector component allows unauthenticated users to upload files and perform file modification operations, such as resizing and rotation of an image. The file name of uploaded files is...
ZoneMinder Command Injection Vulnerability
ZoneMinder is a free and open source CCTV software application for Linux environments that supports IP, USB and analog cameras. A command injection vulnerability exists in ZoneMinder prior to version 1.32.3 in the daemonControl in includes/functions.php, which can be exploited by an attacker via...
CVE-2019-8427
daemonControl in includes/functions.php in ZoneMinder before 1.32.3 allows command injection via shell metacharacters...
UBUNTU-CVE-2019-8427
daemonControl in includes/functions.php in ZoneMinder before 1.32.3 allows command injection via shell metacharacters...
