5227 matches found
CVE-2018-18322
CVE-2018-18322 affects CentOS Web Panel version 0.9.8.480. The issue is a Command Injection in admin/index.php via shell metacharacters in the API parameters service_start, service_restart, service_fullstatus, or service_stop. Root cause: unsafely handling of those parameters enables injection th...
PT-2018-14405 · Centos · Centos Web Panel
Name of the Vulnerable Software and Affected Versions: CentOS Web Panel version 0.9.8.480 Description: The issue concerns Command Injection via shell metacharacters in the admin/index.php API endpoint, specifically in the service start, service restart, service fullstatus, or service stop...
CVE-2018-18322: Improper Neutralization of Special Elements used in an OS Command
CentOS-WebPanel.com aka CWP CentOS Web Panel 0.9.8.480 has Command Injection via shell metacharacters in the admin/index.php servicestart, servicerestart, servicefullstatus, or servicestop parameter...
SUSE SLED12 / SLES12 Security Update : mgetty (SUSE-SU-2018:2979-1)
This update for mgetty fixes the following security issues : CVE-2018-16741: The function doactivate did not properly sanitize shell metacharacters to prevent command injection bsc1108752 CVE-2018-16745: The mailto parameter was not sanitized, leading to a buffer overflow if long untrusted input...
Command injection
On D-Link DIR-823G devices, the GoAhead configuration allows /HNAP1 Command Injection via shell metacharacters in the POST data, because this data is sent directly to the "system" library function...
CVE-2018-17787: Improper Neutralization of Special Elements used in an OS Command
On D-Link DIR-823G devices, the GoAhead configuration allows /HNAP1 Command Injection via shell metacharacters in the POST data, because this data is sent directly to the "system" library function...
Design/Logic Flaw
The Port Forwarding functionality on DASAN H660GW devices allows remote attackers to execute arbitrary code via shell metacharacters in the cgi-bin/advnatvirsvr.asp Addr parameter aka the Local IP Address field...
CVE-2018-17867: Improper Neutralization of Special Elements used in an OS Command
The Port Forwarding functionality on DASAN H660GW devices allows remote attackers to execute arbitrary code via shell metacharacters in the cgi-bin/advnatvirsvr.asp Addr parameter aka the Local IP Address field...
Security update for mgetty (important)
This update for mgetty fixes the following issues: - CVE-2018-16741: The function doactivate did not properly sanitize shell metacharacters to prevent command injection bsc1108752. - CVE-2018-16745: The mailto parameter was not sanitized, leading to a buffer overflow if long untrusted input reach...
Input validation
FruityWifi aka PatatasFritas/PatataWifi 2.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the iomode, apmode, ioaction, ioiniface, ioinset, ioinip, ioinmask, ioingw, iooutiface, iooutset, iooutmask, iooutgw, iface, or domain parameter to...
CVE-2018-17317
FruityWifi aka PatatasFritas/PatataWifi 2.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the iomode, apmode, ioaction, ioiniface, ioinset, ioinip, ioinmask, ioingw, iooutiface, iooutset, iooutmask, iooutgw, iface, or domain parameter to...
CVE-2018-17317
CVE-2018-17317: FruityWifi is affected by remote command execution via shell metacharacters in numerous parameters (io_mode, ap_mode, io_action, io_in_, iface, domain, newSSID, hostapd_ and supplicant_ssid) sent to /www/script/config_iface.php or /www/page_config.php. This enables an attacker to ...
CVE-2018-17317: Improper Neutralization of Special Elements used in an OS Command
FruityWifi aka PatatasFritas/PatataWifi 2.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the iomode, apmode, ioaction, ioiniface, ioinset, ioinip, ioinmask, ioingw, iooutiface, iooutset, iooutmask, iooutgw, iface, or domain parameter to...
CVE-2018-16752
LINK-NET LW-N605R devices with firmware 12.20.2.1486 allow Remote Code Execution via shell metacharacters in the HOST field of the ping feature at adm/systools.asp. Authentication is needed but the default password of admin for the admin account may be used in some cases...
CVE-2018-16752
The LINK-NET LW-N605R device, running firmware 12.20.2.1486 , is vulnerable to Remote Code Execution (RCE) . The flaw exists in the ping feature located at adm/systools.asp, where shell metacharacters in the HOST field are not properly neutralized, allowing for command injection. While authentica...
CVE-2018-16752
LINK-NET LW-N605R devices with firmware 12.20.2.1486 allow Remote Code Execution via shell metacharacters in the HOST field of the ping feature at adm/systools.asp. Authentication is needed but the default password of admin for the admin account may be used in some cases...
nmap4j Arbitrary Command Execution Vulnerability
nmap4j is an Nmap scanner written in the Java language, which is mainly used to execute, scan and persist Nmap output information. A security vulnerability exists in nmap4j version 1.1.0. An attacker can exploit the vulnerability to execute arbitrary commands with the help of shell metacharacters...
CVE-2018-16752: Improper Neutralization of Special Elements used in an OS Command
LINK-NET LW-N605R devices with firmware 12.20.2.1486 allow Remote Code Execution via shell metacharacters in the HOST field of the ping feature at adm/systools.asp. Authentication is needed but the default password of admin for the admin account may be used in some cases...
