The vulnerability of NETGEAR’s embedded software exists due to the lack of measures taken to neutralize special elements used in the operating system commands. This allows a hacker to execute arbitrary commands.

The vulnerability in NETGEAR’s embedded software exists because measures are not taken to neutralize the special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

Cisco Smart Software Manager 操作系统命令注入漏洞

Cisco Smart Software Manager Satellite is software designed to provide intelligent management of licenses. A command injection vulnerability exists in the WEB UI of Cisco Smart Software Manager Satellite 5.1.0 and prior versions. The vulnerability stems from the program not properly validating...

Mubu Authorization Issues Vulnerability

Mubu is a platform for online writing from Mubu, a company based in Beijing, China. An authorization issue vulnerability exists in Mubu version 2.2.1, which stems from its failure to strictly limit user privileges and can be exploited by a local attacker to execute system commands...

CVE-2020-35578

An issue was discovered in the Manage Plugins page in Nagios XI before 5.8.0. Because the line-ending conversion feature is mishandled during a plugin upload, a remote, authenticated admin user can execute operating-system commands...

CVE-2020-35578

An issue was discovered in the Manage Plugins page in Nagios XI before 5.8.0. Because the line-ending conversion feature is mishandled during a plugin upload, a remote, authenticated admin user can execute operating-system commands...

Command Execution Vulnerability in IBOS Enterprise Collaboration Management Software Backend

IBOS Enterprise Collaboration Management Software is a PHP-based collaborative office management system. A command execution vulnerability exists in the backend of IBOS Enterprise Collaboration Management Software, which can be exploited by a remote attacker to submit a special request, execute...

CVE-2020-26118

In SmartBear Collaborator Server through 13.3.13302, use of the Google Web Toolkit GWT API introduces a post-authentication Java deserialization vulnerability. The application's UpdateMemento class accepts a serialized Java object directly from the user without properly sanitizing it. A malicious...

UBUNTU-CVE-2020-1946

In Apache SpamAssassin before 3.4.5, malicious rule configuration .cf files can be configured to run system commands without any output or errors. With this, exploits can be injected in a number of scenarios. In addition to upgrading to SA version 3.4.5, users should only use update channels or 3...

CVE-2020-1946

In Apache SpamAssassin before 3.4.5, malicious rule configuration .cf files can be configured to run system commands without any output or errors. With this, exploits can be injected in a number of scenarios. In addition to upgrading to SA version 3.4.5, users should only use update channels or 3...

CVE-2020-24581

An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU2.31V1.1.47ae55. It contains an executecmd.cgi feature that is not reachable via the web user interface that lets an authenticated user execute Operating System commands...

Design/Logic Flaw

An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU2.31V1.1.47ae55. It contains an executecmd.cgi feature that is not reachable via the web user interface that lets an authenticated user execute Operating System commands...

CVE-2020-24581

An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU2.31V1.1.47ae55. It contains an executecmd.cgi feature that is not reachable via the web user interface that lets an authenticated user execute Operating System commands...

The vulnerability of the Rake::FileList class implementation in the Rake tool for automating the compilation of software code allows a attacker to execute arbitrary commands.

The vulnerability of the Rake::FileList class implementation in the Rake tool for automating the compilation of software code is related to the lack of measures taken to eliminate special elements used in operating system commands. Exploiting this vulnerability allows an attacker to execute...

Command Execution Vulnerability in Ocean CMS-v10.9 (SeaCMS) ad***_we***.php File

Ocean CMS, also known as SeaCMS, is developed by php+mysql, completely open source and free of charge, adaptive to computer, cell phone, tablet, APP multi-terminal, no encryption, more secure. Sea CMS-v10.9 SeaCMS adwe.php file has a command execution vulnerability, attackers can use this...

Aerospike Database UDF Lua Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Aerospike Database UDF Lua Code Execution', 'Description' = %q Aerospike Database versions before 5.1.0.3 permitted user-defined functions UDF to...

CVE-2020-26838

SAP Business Warehouse, versions - 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 782, and SAP BW4HANA, versions - 100, 200 allows an attacker authenticated with high developer privileges to submit a crafted request to generate and execute code without requiring any user interaction. It i...

CVE-2020-26838

SAP Business Warehouse, versions - 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 782, and SAP BW4HANA, versions - 100, 200 allows an attacker authenticated with high developer privileges to submit a crafted request to generate and execute code without requiring any user interaction. It i...

TotoLink A3002RU 命令注入漏洞

Totolink TOTOLINK A3002RU is a wireless router product from Totolink Taiwan, China. A command injection vulnerability exists in the TOTOLINK A3002RU-V2.0.0 B20190814.1034, which could allow a remote, authenticated user to modify the system's "run command". An attacker can use this vulnerability t...

PT-2020-16101

Name of the Vulnerable Software and Affected Versions TOTOLINK A3002RU version 2.0.0 B20190814.1034 Description The issue allows authenticated remote users to modify the system's 'Run Command'. An attacker can use this functionality to execute arbitrary OS commands on the router. Recommendations...

The vulnerability in the subscription subsystem of Cisco AsyncOS allows a hacker to increase their privileges.

The vulnerability of the subscription subsystem for Cisco AsyncOS relates to the lack of measures to neutralize special elements used in the operating system command. Exploiting this vulnerability can allow attackers to enhance their privileges...