MVPower DVR TV-7104HE 1.8.4 115215B9 Shell Unauthenticated Command Execution Exploit

This Metasploit module exploits an unauthenticated remote command execution vulnerability in MVPower digital video recorders. The 'shell' file on the web interface executes arbitrary operating system commands in the query string. This Metasploit module was tested successfully on a MVPower model...

AlienVault OSSIM/USM Remote Code Execution Exploit

This Metasploit module exploits object injection, authentication bypass and ip spoofing vulnerabilities all together. Unauthenticated users can execute arbitrary commands under the context of the root user. By abusing authentication bypass issue on gauge.php lead adversaries to exploit object...

Sophos Web Appliance Remote Command Injection Vulnerability

Sophos Web Appliance is a web security gateway solution. An input validation vulnerability in the MgrDiagnosticTools.php /controllers/MgrDiagnosticTools.php file in the web management interface of the Sophos Web Appliance could be exploited by an attacker to submit a special request for injection...

Command injection

An issue was discovered on SendQuick Entera and Avera devices before 2HF16. Multiple Command Injection vulnerabilities allow attackers to execute arbitrary system commands...

AlienVault OSSIM/USM < 5.3.1 - Remote Code Execution (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule "AlienVault OSSIM/USM Remote Code Execution", 'Description' = %q This module exploits object injection, authentication bypass an...

CVE-2016-9553

The Sophos Web Appliance version 4.2.1.3 is vulnerable to two Remote Command Injection vulnerabilities affecting its web administrative interface. These vulnerabilities occur in the MgrReport.php /controllers/MgrReport.php component responsible for blocking and unblocking IP addresses from...

Arbitrary Command Injection Vulnerability in a Variety of Netgear Netgear Routers

The Netgear R7000 and R6400 are wireless router products from Netgear, Inc. An arbitrary command injection vulnerability exists in several Netgear routers. An attacker can exploit the vulnerability to execute arbitrary system commands in the context of an affected application...

Cisco ATA 187 Analog Telephone Adapter Unauthorized Access Security Bypass Vulnerability (cisco-sa-20130206-ata187)

Cisco ATA-187 is prone to a security bypass vulnerability because it allows attackers to gain unauthorized access to the device. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

CVE-2016-0325

IBM Rational Collaborative Lifecycle Management 3.0.1.6 before iFix8, 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Quality Manager 3.0.1.6 before iFix8, 4.0 before 4.0.7 iFix11, 5.0 before 5.0.2 iFix18, and 6.0 before 6.0.2 iFix5; Rational Team Concert...

Arbitrary Command Execution Vulnerability in Crowe Security Certification Gateway

Crowe Security Authentication Gateway is a user authentication, access and access control device, which can guarantee the information security of network and application resources. There is an arbitrary command execution vulnerability in the hot.php page of Crowe Security Gateway. An attacker can...

FOG Server < 1.3.0 Multiple Vulnerabilities - Active Check

FOG Server is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:fogproject:fog"; if description...

Sophos Web Appliance v4. 2. 1. 3 remote code execution vulnerability

Multiple parameters to the web interface are unsafely handled and can be used to run operating system commands, such as: POST /index.php?c=logs HTTP/1.1 Host: redacted User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10.10; rv:46.0 Gecko/20100101 Firefox/46.0 Accept: text/javascript, text/html,...

Moxa OnCell Series Products OS Command Execution Vulnerability

MOXA OnCell is an industrial grade IP gateway product. An OS command execution vulnerability exists in Moxa OnCell Series products, which can be exploited by an attacker to execute arbitrary OS commands...

GE SNMP/Web Interface Vulnerabilities

OVERVIEW Independent researcher Karn Ganeshen has identified two vulnerabilities in the GE SNMP/Web Interface adapter. GE has produced a new firmware version to mitigate the identified vulnerabilities in later model devices. Earlier model SNMP/Web Interface adapters may need to be upgraded to...

Cisco Cloud Services Platform 2.x < 2.1.0 Multiple Vulnerabilities

According to its self-reported version number, the remote Cisco Cloud Services Platform CSP device is 2.x prior to 2.1.0. It is, therefore, affected by the following vulnerabilities : - A command injection vulnerability exists in the web-based GUI due to improper sanitization of user-supplied...

Command Execution Vulnerability in UFIDA UFO System

UFIDA UFO system is UFIDA software comes with tabular data processing software. A command execution vulnerability exists in UFIDA UFO System. The vulnerability allows attackers to execute operating system commands...

Multiple Command Injection Vulnerabilities in SAP Netweaver

SAP NetWeaver is an integrated application platform based on professional standards that significantly reduces the complexity of system integration. 1 Command injection exists in SCTCREFRESHCHECKENV in SAP Netweaver version 7.40 SP 12. When this SCTCREFRESHCHECKENV function fails to perform clean...

NetMan 204 Backdoor Account Vulnerability

NetMan is an integrated development of UPS for medium and large networks, providing a high level of reliability in the communication between UPS and related management systems. A backdoor account vulnerability exists in NetMan 204. An attacker can exploit this vulnerability to execute system...

WordPress InfiniteWP Admin Panel 2.8.0 Command Injection

------------------------------------------------------------------------ Command injection in InfiniteWP Admin Panel ------------------------------------------------------------------------ Sipke Mellema, July 2016 ------------------------------------------------------------------------ Abstract...

AKABEi SOFT2 Games Operating System Command Injection Vulnerability

AKABEi SOFT2 G-senjou no Maou - The Devil on G-String and other games developed by AKABEi SOFT2 in Japan. An operating system command injection vulnerability exists in AKABEi SOFT2 Games. An attacker could exploit this vulnerability to execute arbitrary operating system commands in the context of...