Microsoft OMI Management Interface Authentication Bypass

By removing the authentication exchange, an attacker can issue requests to the local OMI management socket that will cause it to execute an operating system command as the root user. This vulnerability was patched in OMI version 1.6.8-1 released September 8th 2021. Module Options msf use...

Fortinet FortiClient operating system command injection vulnerability

Fortinet FortiClient is a structured agent from Fortinet, Inc. It is used to provide protection, compliance, and secure access in a single modular lightweight client. Fortinet FortiClient suffers from an operating system command injection vulnerability that can be exploited by an unauthenticated,...

PT-2021-4465

Name of the Vulnerable Software and Affected Versions Polycom CX5100, CX5500 affected versions not specified Description The issue exists due to the lack of measures to neutralize special elements used in the operating system command. This could allow an attacker to elevate their privileges...

Aruba Networks Aruba Operating System Command Injection Vulnerability

Aruba Operating System is the operating system for Aruba Controller-managed wireless LANs and Aruba Mobility Controllers from Aruba Networks, Inc. A command injection vulnerability exists in the Aruba Operating System that can be exploited by an attacker to trigger remote command execution via th...

CVE-2021-34066

An issue was discovered in EdgeGallery/developer before v1.0. There is a "Deserialization of yaml file" vulnerability that can allow attackers to execute system command through uploading the malicious constructed YAML file...

CVE-2021-34066

An issue was discovered in EdgeGallery/developer before v1.0. There is a "Deserialization of yaml file" vulnerability that can allow attackers to execute system command through uploading the malicious constructed YAML file...

Deserialization of untrusted data

An issue was discovered in EdgeGallery/developer before v1.0. There is a "Deserialization of yaml file" vulnerability that can allow attackers to execute system command through uploading the malicious constructed YAML file...

CVE-2021-34066

An issue was discovered in EdgeGallery/developer before v1.0. There is a "Deserialization of yaml file" vulnerability that can allow attackers to execute system command through uploading the malicious constructed YAML file...

PT-2021-20375

Name of the Vulnerable Software and Affected Versions: EdgeGallery/developer versions prior to 1.0 Description: The issue is related to the deserialization of a yaml file, which can allow attackers to execute system commands by uploading a maliciously constructed YAML file. Recommendations: For...

DRK Odenwaldkreis Testerfassung: Operating System Command Injection Vulnerability

DRK Odenwaldkreis Testerfassung is an open source solution for obtaining and documenting corona antigen rapid test results. DRK Odenwaldkreis Testerfassung March-2021 An operating system command injection vulnerability, which originates in the application's results.php Shell metacharacter injecti...

PT-2021-20352

Name of the Vulnerable Software and Affected Versions: B. Braun SpaceCom2 versions prior to 012U000062 Description: The issue is related to insufficient verification of data authenticity, allowing a remote unauthenticated attacker to send malicious data to the device. This malicious data is then...

CVE-2021-28634

Acrobat Reader DC versions 2021.005.20054 and earlier, 2020.004.30005 and earlier and 2017.011.30197 and earlier are affected by an Improper Neutralization of Special Elements used in an OS Command. An authenticated attacker could leverage this vulnerability to achieve arbitrary code execution on...

ProLink PRC2402M Command Injection Vulnerability (CNVD-2021-68447)

ProLink PRC2402M is a router from ProLink Singapore. A command injection vulnerability exists in the setsyscmd function in the adm.cgi binary file of ProLink PRC2402M 1.0.18 and prior versions. An attacker could exploit this vulnerability to cause command injection by passing the command paramete...

PYSEC-2021-116

This affects the package bikeshed before 3.0.0. This can occur when an untrusted source file containing Inline Tag Command metadata is processed. When an arbitrary OS command is executed, the command output would be included in the HTML output...

CVE-2021-36982

AIMANAGER before B115 on MONITORAPP Application Insight Web Application Firewall AIWAF devices with Manager 2.1.0 allows OS Command Injection because of missing input validation on one of the parameters of an HTTP request...

COVID19 Testing Management System 1.0 - (searchdata) SQL Injection Vulnerability

Exploit Title: COVID19 Testing Management System 1.0 - 'searchdata' SQL Injection Google Dork: intitle: "COVID19 Testing Management System" Exploit Author: Ashish Upsham Vendor Homepage: https://phpgurukul.com Software Link:...

CVE-2021-36706

In ProLink PRC2402M V1.0.18 and older, the setsyscmd function in the adm.cgi binary, accessible with a page parameter value of sysCMD contains a trivial command injection where the value of the command parameter is passed directly to system...

PT-2021-21316

Name of the Vulnerable Software and Affected Versions ProLink PRC2402M versions 1.0.18 and older Description The issue concerns a command injection in the set TR069 function within the adm.cgi binary. This function is accessible when the page parameter is set to TR069. Specifically, the value of...

GHSA-H86X-MV66-GR5Q OS Command Injection in Locutus

php/exec/escapeshellarg in Locutus PHP through 2.0.11 allows an attacker to achieve code execution...

CVE-2020-25206

The web console for Mimosa B5, B5c, and C5x devices running firmware through 2.8.0.2 is vulnerable to authenticated command injection . The flaw exists in the Throughput, WANStats, PhyStats, and QosStats API classes , where an attacker with a web console account can execute operating system comma...