CVE-2018-14712

Buffer overflow in appGet.cgi on ASUS RT-AC3200 version 3.0.0.4.382.50010 allows attackers to inject system commands via the "hook" URL parameter...

CVE-2018-14714

System command injection in appGet.cgi on ASUS RT-AC3200 version 3.0.0.4.382.50010 allows attackers to execute system commands via the "loadscript" URL parameter...

Command injection

System command injection in appGet.cgi on ASUS RT-AC3200 version 3.0.0.4.382.50010 allows attackers to execute system commands via the "loadscript" URL parameter...

CVE-2018-14714

CVE-2018-14714 describes a system command injection in ASUS RT-AC3200 (firmware 3.0.0.4.382.50010) via the load_script parameter in appGet.cgi, allowing remote command execution. Multiple connected sources confirm the vulnerability in the ASUS RT-AC3200 and the load_script vector; Red Hat/NTBD ad...

ASUS Zenfone V Live and Asus ZenFone 3 Max security vulnerabilities

The ASUS Zenfone V Live and the Asus ZenFone 3 Max are both Android-based smartphones from Asus Taiwan, China. The ASUS Zenfone V Live build fingerprint is asus/VZWASUSA009/ASUSA009:7.1.1/NMF26F/14.0610.1802.78-20180313:user/release-keys and the Asus ZenFone 3 Max build fingerprint is...

CVE-2019-10040

The D-Link DIR-816 A2 1.11 router only checks the random token when authorizing a goform request. An attacker can get this token from dirlogin.asp and use a hidden API URL /goform/SystemCommand to execute a system command without authentication...

CVE-2019-10040

The D-Link DIR-816 A2 1.11 router only checks the random token when authorizing a goform request. An attacker can get this token from dirlogin.asp and use a hidden API URL /goform/SystemCommand to execute a system command without authentication...

Authentication flaw

The D-Link DIR-816 A2 1.11 router only checks the random token when authorizing a goform request. An attacker can get this token from dirlogin.asp and use a hidden API URL /goform/SystemCommand to execute a system command without authentication...

CVE-2019-10040

The D-Link DIR-816 A2 1.11 router only checks the random token when authorizing a goform request. An attacker can get this token from dirlogin.asp and use a hidden API URL /goform/SystemCommand to execute a system command without authentication...

Jenkins 2.150.2 - Remote Command Execution (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'Jenkins %q This module can run commands on the system using Jenkins users who has JOB creation and BUILD privileges. The...

NEC Aterm W300P OS Command Injection Vulnerability (CNVD-2019-01103)

The NEC Aterm W300P is a wireless router from Nippon Electric NEC. An operating system command injection vulnerability exists in the NEC Aterm W300P using firmware version 1.0.13 and earlier. The vulnerability can be exploited to execute arbitrary operating system commands with the help of the...

NEC Aterm WG1200HP OS Command Injection Vulnerability (CNVD-2019-01099)

The NEC Aterm WG1200HP is a wireless router from Nippon Electric NEC. An operating system command injection vulnerability exists in the NEC Aterm WG1200HP using firmware version 1.0.31 and earlier. The vulnerability can be exploited to execute arbitrary operating system commands with the 'sysCmd ...

CVE-2018-16194

Aterm WF1200CR and Aterm WG1200CR Aterm WF1200CR firmware Ver1.1.1 and earlier, Aterm WG1200CR firmware Ver1.0.1 and earlier allows authenticated attackers to execute arbitrary OS commands via unspecified vectors...

CVE-2018-0630

Aterm W300P Ver1.0.13 and earlier allows attacker with administrator rights to execute arbitrary OS commands via sysCmd parameter...

Mailcleaner Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "Mailcleaner Remote Code Execution", 'Description' = %q This module exploits the command injection vulnerability of MailCleaner Community Edition...

Mailcleaner Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "Mailcleaner Remote Code Execution", 'Description' = %q This module exploits the command injection vulnerability of MailCleaner Community Edition...

CVE-2018-15722

The Logitech Harmony Hub before version 4.15.206 is vulnerable to OS command injection via the time update request. A remote server or man in the middle can inject OS commands with a properly formatted response...

Mailcleaner Remote Code Execution

This module exploits the command injection vulnerability of MailCleaner Community Edition product. An authenticated user can execute an operating system command under the context of the web server user which is root. /admin/managetracing/search/search endpoint takes several user inputs and then...

CVE-2018-19007

In Geutebrueck GmbH E2 Camera Series versions prior to 1.12.0.25 the DDNS configuration in the Network Configuration panel is vulnerable to an OS system command injection as root...

Moxa NPort W2x50A Operating System Command Injection Vulnerability

Moxa NPort W2x50A is a Moxa serial communication server for connecting industrial serial devices to a network. An operating system command injection vulnerability exists in the web server functionality of Moxa NPort W2x50A products with firmware prior to version 2.2 Build18082311. An attacker can...