4046 matches found
CVE-2019-10655
CVE-2019-10655: Grandstream remote code execution vulnerability affects Grandstream GAC2500 (1.0.3.35), GXP2200 (1.0.3.27), GVC3202 (1.0.3.51), GXV3275 (before 1.0.3.219 Beta), and GXV3240 (before 1.0.3.219 Beta). The issue enables unauthenticated RCE via shell metacharacters in the /manager?acti...
PT-2019-11971 · Grandstream · Grandstream Gwn7610
Name of the Vulnerable Software and Affected Versions: Grandstream GWN7610 versions prior to 1.0.8.18 Description: The issue allows remote authenticated users to execute arbitrary code via shell metacharacters in the filename in a "/ubus/controller.icc.update nds webroot from tmp" API call,...
PT-2019-11972 · Grandstream · Grandstream Wp820 +1
Name of the Vulnerable Software and Affected Versions: Grandstream GXV3370 versions prior to 1.0.1.41 Grandstream WP820 versions prior to 1.0.3.6 Description: The issue allows remote authenticated users to execute arbitrary code via shell metacharacters in a "priority field" of the...
PT-2019-11968 · Grandstream +1 · Grandstream Gac2500 +5
Name of the Vulnerable Software and Affected Versions: Grandstream GAC2500 version 1.0.3.35 Grandstream GXP2200 version 1.0.3.27 Grandstream GVC3202 version 1.0.3.51 Grandstream GXV3275 versions prior to 1.0.3.219 Beta Grandstream GXV3240 versions prior to 1.0.3.219 Beta Description: The issue...
PT-2019-11975 · Grandstream · Grandstream Ucm6204
Name of the Vulnerable Software and Affected Versions: Grandstream UCM6204 version 1.0.19.20 and earlier Description: The issue allows remote authenticated users to execute arbitrary code via shell metacharacters in the file-backup parameter to the "/cgi" API endpoint. Recommendations: For...
elFinder PHP Connector < 2.1.48 - exiftran Command Injection Exploit
This Metasploit module exploits a command injection vulnerability in elFinder versions prior to 2.1.48. The PHP connector component allows unauthenticated users to upload files and perform file modification operations, such as resizing and rotation of an image. The file name of uploaded files is...
ZoneMinder Command Injection Vulnerability
ZoneMinder is a free and open source CCTV software application for Linux environments that supports IP, USB and analog cameras. A command injection vulnerability exists in ZoneMinder prior to version 1.32.3 in the daemonControl in includes/functions.php, which can be exploited by an attacker via...
CVE-2019-8427
daemonControl in includes/functions.php in ZoneMinder before 1.32.3 allows command injection via shell metacharacters...
CVE-2019-8427
daemonControl in includes/functions.php in ZoneMinder before 1.32.3 allows command injection via shell metacharacters...
Command injection
daemonControl in includes/functions.php in ZoneMinder before 1.32.3 allows command injection via shell metacharacters...
CVE-2019-8427
daemonControl in includes/functions.php in ZoneMinder before 1.32.3 allows command injection via shell metacharacters...
DEBIAN-CVE-2019-8427
daemonControl in includes/functions.php in ZoneMinder before 1.32.3 allows command injection via shell metacharacters...
UBUNTU-CVE-2019-8427
daemonControl in includes/functions.php in ZoneMinder before 1.32.3 allows command injection via shell metacharacters...
CVE-2019-8427
daemonControl in includes/functions.php in ZoneMinder before 1.32.3 allows command injection via shell metacharacters...
CVE-2019-8427
daemonControl in includes/functions.php in ZoneMinder before 1.32.3 allows command injection via shell metacharacters...
CVE-2019-8314
An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST...
Command injection
An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST...
Command injection
An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code, and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST...
CVE-2019-7301
Zen Load Balancer 3.10.1 allows remote authenticated admin users to execute arbitrary commands as root via shell metacharacters in the index.cgi?action=ViewCert certname parameter...
Command injection
TP-Link WDR Series devices through firmware v3 such as TL-WDR5620 V3.0 are affected by command injection after login leading to remote code execution, because shell metacharacters can be included in the weather getweatherobserve citycode field...