Certain

NETGEAR

devices

are

affected

by

command

injection

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

command

injection

by

an

unauthenticated

attacker.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

command

injection

by

an

unauthenticated

attacker.

This

affects

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

command

injection

by

an

authenticated

user.

This

affects

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

command

injection

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

before

before

before

before

and

before


Certain NETGEAR devices are affected by command injection by an authenticated user. This affects CBR750 before 4.6.3.6 RBK852 before 3.2.17.12 RBR850 before 3.2.17.12 and RBS850 before 3.2.17.12.


Certain

NETGEAR

devices

are

affected

by

command

injection

by

an

unauthenticated

attacker.

This

affects

before

before

before

before

before

before

before

and

before


Certain NETGEAR devices are affected by command injection by an authenticated user. This affects CBR40 before 2.5.0.24 CBR750 before 4.6.3.6 RBK852 before 3.2.17.12 RBR850 before 3.2.17.12 and RBS850 before 3.2.17.12.


Certain

NETGEAR

devices

are

affected

by

command

injection

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

command

injection

by

an

unauthenticated

attacker.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

command

injection

by

an

unauthenticated

attacker.

This

affects

before

before

before

before

before

before

before

before

before

and

before


NETGEAR R8000 devices before 1.0.4.76 are affected by command injection by an authenticated user.


Apache kylin checks the legitimacy of the project before executing some commands with the project name passed in by the user. There is a mismatch between what is being checked and what is being used as the shell command argument in DiagnosisService. This may cause an illegal project name to pass the check and perform the following steps resulting in a command injection vulnerability. This issue affects Apache Kylin 4.0.0.


Certain

NETGEAR

devices

are

affected

by

command

injection

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

command

injection

by

an

unauthenticated

attacker.

This

affects

before

before

before

before

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

command

injection

by

an

unauthenticated

attacker.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

command

injection

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

command

injection

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

command

injection

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

command

injection

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

command

injection

by

an

authenticated

user.

This

affects

before

before

before

before

before

and

before


There is a command injection vulnerability in S12700 V200R019C00SPC500 S2700 V200R019C00SPC500 S5700 V200R019C00SPC500 S6700 V200R019C00SPC500 and S7700 V200R019C00SPC500. A module does not verify specific input sufficiently. Attackers can exploit this vulnerability by sending malicious parameters to inject command. This can compromise normal service.


Netgear RAX43 version 1.0.3.96 contains a command injection vulnerability. The readycloud cgi application is vulnerable to command injection in the name parameter.


In Fibaro Home Center 2 and Lite devices with firmware version 4.540 and older an authenticated user can run commands as root user using a command injection vulnerability.


A post-authenticated command injection vulnerability in SonicWall SMA100 allows an authenticated attacker to execute OS commands as a 'nobody' user. This vulnerability impacts SMA100 version 10.2.0.5 and earlier.


Netgear Nighthawk R6700 version 1.0.4.120 contains a command injection vulnerability in update functionality of the device. By triggering a system update check via the SOAP interface the device is susceptible to command injection via preconfigured values.


An unauthenticated command injection vulnerability exists in the parameters of operation 41 in the controller_server service on Gryphon Tower routers. An unauthenticated remote attacker on the same network can execute commands as root on the device by sending a specially crafted malicious packet to the controller_server service on port 9999.


A post-authentication remote command injection vulnerability in SonicWall SMA100 allows a remote authenticated attacker to execute OS system commands in the appliance. This vulnerability affected SMA 200 210 400 410 and 500v appliances.


An unauthenticated command injection vulnerability exists in the parameters of operation 3 in the controller_server service on Gryphon Tower routers. An unauthenticated remote attacker on the same network can execute commands as root on the device by sending a specially crafted malicious packet to the controller_server service on port 9999.


An unauthenticated command injection vulnerability exists in the parameters of operation 48 in the controller_server service on Gryphon Tower routers. An unauthenticated remote attacker on the same network can execute commands as root on the device by sending a specially crafted malicious packet to the controller_server service on port 9999.


OS command injection vulnerability in ELECOM routers (WRC-1167GST2 firmware v1.25 and prior WRC-1167GST2A firmware v1.25 and prior WRC-1167GST2H firmware v1.25 and prior WRC-2533GS2-B firmware v1.52 and prior WRC-2533GS2-W firmware v1.52 and prior WRC-1750GS firmware v1.03 and prior WRC-1750GSV firmware v2.11 and prior WRC-1900GST firmware v1.03 and prior WRC-2533GST firmware v1.03 and prior WRC-2533GSTA firmware v1.03 and prior WRC-2533GST2 firmware v1.25 and prior WRC-2533GST2SP firmware v1.25 and prior WRC-2533GST2-G firmware v1.25 and prior and EDWRC-2533GST2 firmware v1.25 and prior) allows a network-adjacent authenticated attackers to execute an arbitrary OS command with the root privilege via unspecified vectors.


An unauthenticated command injection vulnerability exists in the parameters of operation 32 in the controller_server service on Gryphon Tower routers. An unauthenticated remote attacker on the same network can execute commands as root on the device by sending a specially crafted malicious packet to the controller_server service on port 9999.


An unauthenticated command injection vulnerability exists in the parameters of operation 49 in the controller_server service on Gryphon Tower routers. An unauthenticated remote attacker on the same network can execute commands as root on the device by sending a specially crafted malicious packet to the controller_server service on port 9999.


An unauthenticated command injection vulnerability exists in the parameters of operation 10 in the controller_server service on Gryphon Tower routers. An unauthenticated remote attacker on the same network can execute commands as root on the device by sending a specially crafted malicious packet to the controller_server service on port 9999.


There is a command injection vulnerability in the HG8045Q product. When the command-line interface is enabled which is disabled by default attackers with administrator privilege could execute part of commands.


There is a command injection vulnerability in CMA service module of FusionCompute 6.3.0 6.3.1 6.5.0 and 8.0.0 when processing the default certificate file. The software constructs part of a command using external special input from users but the software does not sufficiently validate the user input. Successful exploit could allow the attacker to inject certain commands to the system.


There is a command injection vulnerability in CMA service module of FusionCompute product when processing the default certificate file. The software constructs part of a command using external special input from users but the software does not sufficiently validate the user input. Successful exploit could allow the attacker to inject certain commands to the system. Affected product versions include: FusionCompute 6.0.0 6.3.0 6.3.1 6.5.0 6.5.1 8.0.0.


Shopware is an open source eCommerce platform. Versions prior to 6.4.3.1 contain a command injection vulnerability in mail agent settings. Version 6.4.3.1 contains a patch. As workarounds for older versions of 6.1 6.2 and 6.3 corresponding security measures are also available via a plugin.


The firmware on Moxa TN-5900 devices through 3.1 allows command injection that could lead to device damage.


totolink a3100r V5.9c.4577 is vulnerable to os command injection. The backend of a page is executing the \ping\ command and the input field does not adequately filter special symbols. This can lead to command injection attacks.


Telesquare SDT-CW3B1 1.1.0 is affected by an OS command injection vulnerability that allows a remote attacker to execute OS commands without any authentication.


A

Remote

Command

Execution

(RCE)

vulnerability

exists

in

of

D-Link

Router

and

because

backticks

can

be

used

for

command

injection

when

judging

whether

it

is

a

reasonable

domain

name.


A Improper neutralization of special elements used in a command ('Command Injection') in Fortinet FortiWeb version 6.3.13 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests


In ProLink PRC2402M V1.0.18 and older the set_TR069 function in the adm.cgi binary accessible with a page parameter value of TR069 contains a trivial command injection where the value of the TR069_local_port parameter is passed directly to system.


In ProLink PRC2402M V1.0.18 and older the set_ledonoff function in the adm.cgi binary accessible with a page parameter value of ledonoff contains a trivial command injection where the value of the led_cmd parameter is passed directly to do_system.


AIMANAGER before B115 on MONITORAPP Application Insight Web Application Firewall (AIWAF) devices with Manager 2.1.0 allows OS Command Injection because of missing input validation on one of the parameters of an HTTP request.


Adobe Illustrator version 25.2.3 (and earlier) is affected by a potential Command injection vulnerability when chained with a development and debugging tool for JavaScript scripts. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


Dell EMC CloudLink 7.1 and all prior versions contain an OS command injection Vulnerability. A remote high privileged attacker may potentially exploit this vulnerability leading to the execution of arbitrary OS commands on the application's underlying OS with the privileges of the vulnerable application. Exploitation may lead to a system take over by an attacker. This vulnerability is considered critical as it may be leveraged to completely compromise the vulnerable application as well as the underlying operating system. Dell recommends customers to upgrade at the earliest opportunity.


Sunhillo SureLine before 8.7.0.1.1 allows Unauthenticated OS Command Injection via shell metacharacters in ipAddr or dnsAddr /cgi/networkDiag.cgi.


In ProLink PRC2402M V1.0.18 and older the set_sys_cmd function in the adm.cgi binary accessible with a page parameter value of sysCMD contains a trivial command injection where the value of the command parameter is passed directly to system.


Combodo iTop is an open source web based IT Service Management tool. In versions prior to 2.7.4 there is a command injection vulnerability in the Setup Wizard when providing Graphviz executable path. The vulnerability is patched in version 2.7.4 and 3.0.0.


The System Information Library for Node.JS (npm package \systeminformation\) is an open source collection of functions to retrieve detailed hardware system and OS information. In systeminformation before version 5.3.1 there is a command injection vulnerability. Problem was fixed in version 5.3.1. As a workaround instead of upgrading be sure to check or sanitize service parameters that are passed to si.inetLatency() si.inetChecksite() si.services() si.processLoad() ... do only allow strings reject any arrays. String sanitation works as expected.


An OS command injection vulnerability exists in the Web Manager Diagnostics: Ping functionality of Lantronix PremierWave 2050 8.9.0.0R4. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.


An OS command injection vulnerability exists in the Web Manager Diagnostics: Traceroute functionality of Lantronix PremierWave 2050 8.9.0.0R4. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.


An OS command injection vulnerability exists in the Web Manager FsUnmount functionality of Lantronix PremierWave 2050 8.9.0.0R4. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.


Mechanize is an open-source ruby library that makes automated web interaction easy. In Mechanize from version 2.0.0 and before version 2.7.7 there is a command injection vulnerability. Affected versions of mechanize allow for OS commands to be injected using several classes' methods which implicitly use Ruby's Kernel.open method. Exploitation is possible only if untrusted input is used as a local filename and passed to any of these calls: Mechanize::CookieJar#load Mechanize::CookieJar#save_as Mechanize#download Mechanize::Download#save Mechanize::File#save and Mechanize::FileResponse#read_body. This is fixed in version 2.7.7.


An OS Command Injection vulnerability exists in the ping.php script functionality of Advantech R-SeeNet v 2.4.12 (20.10.2020). A specially crafted HTTP request can lead to arbitrary OS command execution. An attacker can send a crafted HTTP request to trigger this vulnerability.


An OS command injection vulnerability exists in the Web Manager SslGenerateCSR functionality of Lantronix PremierWave 2050 8.9.0.0R4. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.


Magento versions 2.4.1 (and earlier) 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to OS command injection via the scheduled operation module. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation.


An OS command injection vulnerability exists in the Web Manager SslGenerateCertificate functionality of Lantronix PremierWave 2050 8.9.0.0R4 (in QEMU). A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.


A privilege escalation vulnerability exists in the Remote Server functionality of Dream Report ODS Remote Connector 20.2.16900.0. A specially-crafted command injection can lead to elevated capabilities. An attacker can provide a malicious file to trigger this vulnerability.


Magento versions 2.4.1 (and earlier) 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an OS command injection via the customer attribute save controller. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation.


systeminformation is an open source system and OS information library for node.js. A command injection vulnerability has been discovered in versions of systeminformation prior to 5.6.4. The issue has been fixed with a parameter check on user input. Please upgrade to version >= 5.6.4. If you cannot upgrade be sure to check or sanitize service parameters that are passed to si.inetLatency() si.inetChecksite() si.services() si.processLoad() and other commands. Only allow strings reject any arrays. String sanitation works as expected.


Dell OpenManage Enterprise versions prior to 3.6.1 contain an OS command injection vulnerability in RACADM and IPMI tools. A remote authenticated malicious user with high privileges may potentially exploit this vulnerability to execute arbitrary OS commands.


Dell EMC PowerScale OneFS versions 8.2.x - 9.2.1.x contain an OS command injection vulnerability. This may allow a user with ISI_PRIV_LOGIN_SSH or ISI_PRIV_LOGIN_CONSOLE to escalate privileges and escape the compliance guarantees. This only impacts Smartlock WORM compliance mode clusters as a critical vulnerability and Dell recommends to update/upgrade at the earliest opportunity.


An OS command injection vulnerability exists in the Web Manager Wireless Network Scanner functionality of Lantronix PremierWave 2050 8.9.0.0R4. A specially-crafted HTTP request can lead to command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.


FiberHome ONU GPON AN5506-04-F RP2617 is affected by an OS command injection vulnerability. This vulnerability allows the attacker once logged in to send commands to the operating system as the root user via the ping diagnostic tool bypassing the IP address field and concatenating OS commands with a semicolon.


An issue was discovered in Zammad before 4.1.1. Command Injection can occur via custom Packages.


Certain Anaconda3 2021.05 are affected by OS command injection. When a user installs Anaconda an attacker can create a new file and write something in usercustomize.py. When the user opens the terminal or activates Anaconda the command will be executed.


A shell command injection in the HW Events SNMP community in XoruX LPAR2RRD and STOR2RRD before 7.30 allows authenticated remote attackers to execute arbitrary shell commands as the user running the service.


The shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the output of this package is passed to a real shell as a quoted argument to a command with exec() an attacker can inject arbitrary commands. This is because the Windows drive letter regex character class is {A-z instead of the correct {A-Za-z. Several shell metacharacters exist in the space between capital letter Z and lower case letter a such as the backtick character.


A command Injection vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform arbitrary command execution.


Nagios

XI

version

is

affected

by

OS

command

injection.

The

vulnerability

exists

in

the

file

due

to

improper

sanitization

of

authenticated

user-controlled

input

by

a

single

HTTP

request

which

can

lead

to

OS

command

injection

on

the

Nagios

XI

server.


The WordPress PDF Light Viewer Plugin WordPress plugin before 1.4.12 allows users with Author roles to execute arbitrary OS command on the server via OS Command Injection when invoking Ghostscript.


react-dev-utils prior to v11.0.4 exposes a function getProcessForPort where an input argument is concatenated into a command string to be executed. This function is typically used from react-scripts (in Create React App projects) where the usage is safe. Only when this function is manually invoked with user-provided values (ie: by custom code) is there the potential for command injection. If you're consuming it from react-scripts then this issue does not affect you.


totolink EX300_v2 V4.0.3c.140_B20210429 was discovered to contain a command injection vulnerability via the component process forceugpo.


A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.2 and below version 8.5.2 and below version 8.4.2 and below version 8.3.2 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests to the alarm dashboard and controller config handlers.


Zoho ManageEngine Network Configuration Manager before 125488 is vulnerable to command injection due to improper validation in the Ping functionality.


The downloadFlile.cgi binary file in TOTOLINK EX200 V4.0.3c.7646_B20201211 has a command injection vulnerability when receiving GET parameters. The parameter name can be constructed for unauthenticated command execution.


`Bundler` is a package for managing application dependencies in Ruby. In `bundler` versions before 2.2.33 when working with untrusted and apparently harmless `Gemfile`'s it is not expected that they lead to execution of external code unless that's explicit in the ruby code inside the `Gemfile` itself. However if the `Gemfile` includes `gem` entries that use the `git` option with invalid but seemingly harmless values with a leading dash this can be false. To handle dependencies that come from a Git repository instead of a registry Bundler uses various commands such as `git clone`. These commands are being constructed using user input (e.g. the repository URL). When building the commands Bundler versions before 2.2.33 correctly avoid Command Injection vulnerabilities by passing an array of arguments instead of a command string. However there is the possibility that a user input starts with a dash (`-`) and is therefore treated as an optional argument instead of a positional one. This can lead to Code Execution because some of the commands have options that can be leveraged to run arbitrary executables. Since this value comes from the `Gemfile` file it can contain any character including a leading dash. To exploit this vulnerability an attacker has to craft a directory containing a `Gemfile` file that declares a dependency that is located in a Git repository. This dependency has to have a Git URL in the form of `-u./payload`. This URL will be used to construct a Git clone command but will be interpreted as the upload-pack argument. Then this directory needs to be shared with the victim who then needs to run a command that evaluates the Gemfile such as `bundle lock` inside. This vulnerability can lead to Arbitrary Code Execution which could potentially lead to the takeover of the system. However the exploitability is very low because it requires a lot of user interaction. Bundler 2.2.33 has patched this problem by inserting `--` as an argument before any positional arguments to those Git commands that were affected by this issue. Regardless of whether users can upgrade or not they should review any untrustred `Gemfile`'s before running any `bundler` commands that may read them since they can contain arbitrary ruby code.


An issue was discovered on Victure WR1200 devices through 1.0.3. A command injection vulnerability was found within the web interface of the device allowing an attacker with valid credentials to inject arbitrary shell commands to be executed by the device with root privileges. This occurs in the ping and traceroute features. An attacker would thus be able to use this vulnerability to open a reverse shell on the device with root privileges.


totolink EX300_v2 V4.0.3c.140_B20210429 was discovered to contain a command injection vulnerability via the component cloudupdate_check.


Dell EMC Unity Dell EMC UnityVSA and Dell EMC Unity XT versions prior to 5.1.2.0.5.007 contain an operating system (OS) command injection Vulnerability. A locally authenticated user with high privileges may potentially exploit this vulnerability leading to the execution of arbitrary OS commands on the Unity underlying OS with the privileges of the vulnerable application. Exploitation may lead to an elevation of privilege.


iTextPDF in iText 7 and up to 7.1.17 allows command injection via a CompareTool filename that is mishandled on the gs (aka Ghostscript) command line in GhostscriptHelper.java.


A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWeb version 6.4.1 and 6.4.0 version 6.3.15 and below version 6.2.6 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests.


Certain

NETGEAR

devices

are

affected

by

command

injection

by

an

unauthenticated

attacker

via

the

vulnerable

library

used

by

a

CGI

application

as

demonstrated

by

with

an

OS

command

in

the

User-Agent

field.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


China Mobile An Lianbao WF-1 V1.0.1 router provides a web interface /api/ZRRuleFilter/set_firewall_level which receives parameters by POST request and the parameter firewall_level has a command injection vulnerability. An attacker can use the vulnerability to execute remote commands.


China Mobile An Lianbao WF-1 V1.0.1 router provides a web interface /api/ZRMesh/set_ZRMesh which receives parameters by POST request and the parameter mesh_enable and mesh_device have a command injection vulnerability. An attacker can use the vulnerability to execute remote commands.


In Weidmueller Industrial WLAN devices in multiple versions an exploitable command injection vulnerability exists in encrypted diagnostic script functionality of the devices. A specially crafted diagnostic script file can cause arbitrary busybox commands to be executed resulting in remote control over the device. An attacker can send diagnostic while authenticated as a low privilege user to trigger this vulnerability.


In Weidmueller Industrial WLAN devices in multiple versions an exploitable command injection vulnerability exists in the hostname functionality. A specially crafted entry to network configuration information can cause execution of arbitrary system commands resulting in full control of the device. An attacker can send various requests while authenticated as a high privilege user to trigger this vulnerability.


The submission service in Dovecot before 2.3.15 allows STARTTLS command injection in lib-smtp. Sensitive information can be redirected to an attacker-controlled address.


In Weidmueller Industrial WLAN devices in multiple versions an exploitable command injection vulnerability exists in the iw_webs functionality. A specially crafted diagnostic script file name can cause user input to be reflected in a subsequent iw_system call resulting in remote control over the device. An attacker can send commands while authenticated as a low privilege user to trigger this vulnerability.


China Mobile An Lianbao WF-1 v1.0.1 router web interface through /api/ZRMacClone/mac_addr_clone receives parameters by POST request and the parameter macType has a command injection vulnerability. An attacker can use the vulnerability to execute remote commands.


The files_antivirus component before 1.0.0 for ownCloud allows OS Command Injection via the administration settings.


In Weidmueller Industrial WLAN devices in multiple versions an exploitable command injection vulnerability exists in the iw_webs functionality. A specially crafted iw_serverip parameter can cause user input to be reflected in a subsequent iw_system call resulting in remote control over the device. An attacker can send commands while authenticated as a low privilege user to trigger this vulnerability.


China Mobile An Lianbao WF-1 router v1.0.1 is affected by an OS command injection vulnerability in the web interface /api/ZRUsb/pop_usb_device component.


A improper neutralization of special elements used in a command ('command injection') in Fortinet FortiExtender version 7.0.1 and below 4.2.3 and below 4.1.7 and below allows an authenticated attacker to execute privileged shell commands via CLI commands including special characters


CommScope SURFboard SBG6950AC2 9.1.103AA23 devices allow Command Injection.


A OS Command Injection vulnerability was discovered in Artica Proxy 4.30.000000. Attackers can execute OS commands in cyrus.events.php with GET param logs and POST param rp.


Sharetribe Go is a source available marketplace software. In affected versions operating system command injection is possible on installations of Sharetribe Go that do not have a secret AWS Simple Notification Service (SNS) notification token configured via the `sns_notification_token` configuration parameter. This configuration parameter is unset by default. The vulnerability has been patched in version 10.2.1. Users who are unable to upgrade should set the`sns_notification_token` configuration parameter to a secret value.


Multiple unauthenticated command injection vulnerabilities were discovered in the AOS-CX API interface in Aruba CX 6200F Switch Series Aruba 6300 Switch Series Aruba 6400 Switch Series Aruba 8320 Switch Series Aruba 8325 Switch Series Aruba 8400 Switch Series Aruba CX 8360 Switch Series version(s): AOS-CX 10.06.xxxx: 10.06.0170 and below AOS-CX 10.07.xxxx: 10.07.0050 and below AOS-CX 10.08.xxxx: 10.08.1030 and below AOS-CX 10.09.xxxx: 10.09.0002 and below. Aruba has released upgrades for Aruba AOS-CX devices that address these security vulnerabilities.


diag_routes.php in pfSense 2.5.2 allows sed data injection. Authenticated users are intended to be able to view data about the routes set in the firewall. The data is retrieved by executing the netstat utility and then its output is parsed via the sed utility. Although the common protection mechanisms against command injection (i.e. the usage of the escapeshellarg function for the arguments) are used it is still possible to inject sed-specific code and write an arbitrary file in an arbitrary location.


All versions of yongyou PLM are affected by a command injection issue. UFIDA PLM (Product Life Cycle Management) is a strategic management method. It applies a series of enterprise application systems to support the entire process from conceptual design to the end of product life and the collaborative creation distribution application and management of product information across organizations. Yonyou PLM uses jboss by default and you can access the management control background without authorization An attacker can use this vulnerability to gain server permissions.


Composer is an open source dependency manager for the PHP language. In affected versions windows users running Composer to install untrusted dependencies are subject to command injection and should upgrade their composer version. Other OSs and WSL are not affected. The issue has been resolved in composer versions 1.10.23 and 2.1.9. There are no workarounds for this issue.


A command injection vulnerability in sftp command processing on Juniper Networks Junos OS Evolved allows an attacker with authenticated CLI access to be able to bypass configured access protections to execute arbitrary shell commands within the context of the current user. The vulnerability allows an attacker to bypass command authorization restrictions assigned to their specific user account and execute commands that are available to the privilege level for which the user is assigned. For example a user that is in the super-user login class but restricted to executing specific CLI commands could exploit the vulnerability to execute any other command available to an unrestricted admin user. This vulnerability does not increase the privilege level of the user but rather bypasses any CLI command restrictions by allowing full access to the shell. This issue affects Juniper Networks Junos OS Evolved: All versions prior to 20.4R2-S2-EVO; 21.1 versions prior to 21.1R2-EVO; 21.2 versions prior to 21.2R1-S1-EVO 21.2R2-EVO.


furlongm openvpn-monitor through 1.1.3 allows %0a command injection via the OpenVPN management interface socket. This can shut down the server via signal%20SIGTERM.


Akuvox C315 115.116.2613 allows remote command Injection via the cfgd_server service. The attack vector is sending a payload to port 189 (default root 0.0.0.0).


A command Injection Vulnerability in McAfee Agent (MA) for Windows prior to 5.7.5 allows local users to inject arbitrary shell code into the file cleanup.exe. The malicious clean.exe file is placed into the relevant folder and executed by running the McAfee Agent deployment feature located in the System Tree. An attacker may exploit the vulnerability to obtain a reverse shell which can lead to privilege escalation to obtain root privileges.


In SaltStack Salt 2016.9 through 3002.6 a command injection vulnerability exists in the snapper module that allows for local privilege escalation on a minion. The attack requires that a file is created with a pathname that is backed up by snapper and that the master calls the snapper.diff function (which executes popen unsafely).


A command injection vulnerability in tcpdump command processing on Juniper Networks Junos OS Evolved allows an attacker with authenticated CLI access to be able to bypass configured access protections to execute arbitrary shell commands within the context of the current user. The vulnerability allows an attacker to bypass command authorization restrictions assigned to their specific user account and execute commands that are available to the privilege level for which the user is assigned. For example a user that is in the super-user login class but restricted to executing specific CLI commands could exploit the vulnerability to execute any other command available to an unrestricted admin user. This vulnerability does not increase the privilege level of the user but rather bypasses any CLI command restrictions by allowing full access to the shell. This issue affects Juniper Networks Junos OS Evolved: All versions prior to 20.3R2-S1-EVO; 20.4 versions prior to 20.4R2-S2-EVO; 21.1 versions prior to 21.1R2-EVO; 21.2 versions prior to 21.2R1-S1-EVO 21.2R2-EVO.


A command injection vulnerability in command processing on Juniper Networks Junos OS Evolved allows an attacker with authenticated CLI access to be able to bypass configured access protections to execute arbitrary shell commands within the context of the current user. The vulnerability allows an attacker to bypass command authorization restrictions assigned to their specific user account and execute commands that are available to the privilege level for which the user is assigned. For example a user that is in the super-user login class but restricted to executing specific CLI commands could exploit the vulnerability to execute any other command available to an unrestricted admin user. This vulnerability does not increase the privilege level of the user but rather bypasses any CLI command restrictions by allowing full access to the shell. This issue affects Juniper Networks Junos OS Evolved: All versions prior to 20.4R3-S1-EVO; All versions of 21.1-EVO and 21.2-EVO.


Multiple OS command injection (CWE-78) vulnerabilities in the command line interface of FortiManager 6.2.7 and below 6.4.5 and below and all versions of 6.2.x 6.0.x and 5.6.x FortiAnalyzer 6.2.7 and below 6.4.5 and below and all versions of 6.2.x 6.0.x and 5.6.x and FortiPortal 5.2.5 and below 5.3.5 and below and 6.0.4 and below may allow a local authenticated and unprivileged user to execute arbitrary shell commands as root via specifically crafted CLI command parameters.


The \gitDiff\ function in Wayfair git-parse <=1.0.4 has a command injection vulnerability. Clients of the git-parse library are unlikely to be aware of this so they might unwittingly write code that contains a vulnerability. The issue has been resolved in version 1.0.5.


** UNSUPPORTED WHEN ASSIGNED ** The eslint-fixer package through 0.1.5 for Node.js allows command injection via shell metacharacters to the fix function. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. The ozum/eslint-fixer GitHub repository has been intentionally deleted.


An OS command injection was found in SecuwaySSL when special characters injection on execute command with runCommand arguments.


The gitlog function in src/index.ts in gitlog before 4.0.4 has a command injection vulnerability.


An issue was discovered in D-Link DIR-816 A2 1.10 B05 devices. An HTTP request parameter is used in command string construction within the handler function of the /goform/addRouting route. This could lead to Command Injection via Shell Metacharacters.


Yealink Device Management (DM) 3.6.0.20 allows command injection as root via the /sm/api/v1/firewall/zone/services URI without authentication.


The samba-client package before 4.0.0 for Node.js allows command injection because of the use of process.exec.


rakibtg Docker Dashboard before 2021-02-28 allows command injection in backend/utilities/terminal.js via shell metacharacters in the command parameter of an API request. NOTE: this is NOT a Docker Inc. product.


Command Injection in TOTOLINK X5000R router with firmware v9.1.0u.6118_B20201102 and TOTOLINK A720R router with firmware v4.1.5cu.470_B20200911 allows remote attackers to execute arbitrary OS commands by sending a modified HTTP request. This occurs because the function executes glibc's system function with untrusted input. In the function \ip\ parameter is directly passed to the attacker allowing them to control the \ip\ field to attack the OS.


Command Injection in TOTOLINK X5000R router with firmware v9.1.0u.6118_B20201102 and TOTOLINK A720R router with firmware v4.1.5cu.470_B20200911 allows remote attackers to execute arbitrary OS commands by sending a modified HTTP request. This occurs because the function executes glibc's system function with untrusted input. In the function \command\ parameter is directly passed to the attacker allowing them to control the \command\ field to attack the OS.


Mesa Labs AmegaView Versions 3.0 and prior has a command injection vulnerability that can be exploited to execute commands in the web server.


Command Injection in Tenda G0 routers with firmware versions v15.11.0.6(9039)_CN and v15.11.0.5(5876)_CN and Tenda G1 and G3 routers with firmware versions v15.11.0.17(9502)_CN or v15.11.0.16(9024)_CN allows remote attackers to execute arbitrary OS commands via a crafted action/setDebugCfg request. This occurs because the \formSetDebugCfg\ function executes glibc's system function with untrusted input.


An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At 1 or 2 based on DDNS type the ddns->domain variable that has the value of the domain parameter provided through the SetDdns API is not validated properly. This would lead to an OS command injection. An attacker can send an HTTP request to trigger this vulnerability.


An OScommand injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At 8 the devname variable that has the value of the name parameter provided through the SetDevName API is not validated properly. This would lead to an OS command injection.


Multiple vulnerabilities in the web-based management interface of the Cisco Catalyst Passive Optical Network (PON) Series Switches Optical Network Terminal (ONT) could allow an unauthenticated remote attacker to perform the following actions: Log in with a default credential if the Telnet protocol is enabled Perform command injection Modify the configuration For more information about these vulnerabilities see the Details section of this advisory.


An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At 4 the dns_data->dns1 variable that has the value of the dns1 parameter provided through the SetLocal API is not validated properly. This would lead to an OS command injection.


An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At 1 or 2 based on DDNS type the ddns->username variable that has the value of the userName parameter provided through the SetDdns API is not validated properly. This would lead to an OS command injection.


An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At 6 the dns_data->dns2 variable that has the value of the dns2 parameter provided through the SetLocalLink API is not validated properly. This would lead to an OS command injection.


An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. At 1 or 2 based on DDNS type the ddns->password variable that has the value of the password parameter provided through the SetDdns API is not validated properly. This would lead to an OS command injection.


An issue was discovered in Nagios XI 5.8.5. In the Manage Dashlets section of the Admin panel an administrator can upload ZIP files. A command injection (within the name of the first file in the archive) allows an attacker to execute system commands.


The laser command injection vulnerability exists on AIS-BW80H-00 versions earlier than AIS-BW80H-00 9.0.3.4(H100SP13C00). The devices cannot effectively defend against external malicious interference. Attackers need the device to be visually exploitable and successful triggering of this vulnerability could execute voice commands on the device.


The karo gem 2.3.8 for Ruby allows Remote command injection via the host field.


admin.php?page=projects in Lexiglot through 2014-11-20 allows command injection via username and password fields.


Synacor Zimbra Collaboration before 8.0.9 allows plaintext command injection during STARTTLS.


The STARTTLS implementation in MailMarshal before 7.2 allows plaintext command injection.


Unify OpenStage / OpenScape Desk Phone IP before V3 R3.11.0 SIP has an OS command injection vulnerability in the web based management interface


Openshift has shell command injection flaws due to unsanitized data being passed into shell commands.


FarLinX

Gateway

through

allows

command

injection

via

shell

metacharacters

to

sysSaveMonitorData.php

syseditdate.php

iframeupload.php

or


On certain Ubiquiti devices Command Injection exists via a GET request to stainfo.cgi (aka Show AP info) because the ifname variable is not sanitized as demonstrated by shell metacharacters. The fixed version is v4.0.1 for 802.11 ISP products v5.3.5 for AirMax ISP products and v5.4.5 for AirSync firmware. For example Nanostation5 (Air OS) is affected.


The VMware Tools update functionality in VMware Workstation 6.5.x before 6.5.5 build 328052 and 7.x before 7.1.2 build 301548; VMware Player 2.5.x before 2.5.5 build 328052 and 3.1.x before 3.1.2 build 301548; VMware Server 2.0.2; VMware Fusion 2.x before 2.0.8 build 328035 and 3.1.x before 3.1.2 build 332101; VMware ESXi 3.5 4.0 and 4.1; and VMware ESX 3.0.3 3.5 4.0 and 4.1 allows host OS users to gain privileges on the guest OS via unspecified vectors related to a \command injection\ issue.


IonizeCMS v1.0.8.1 was discovered to contain a command injection vulnerability via the function copy_lang_content in application/models/lang_model.php.


SolarView Compact ver.6.00 was discovered to contain a command injection vulnerability via conf_mail.php.


The npm-dependency-versions package through 0.3.0 for Node.js allows command injection if an attacker is able to call dependencyVersions with a JSON object in which pkgs is a key and there are shell metacharacters in a value.


resi-calltrace in RESI Gemini-Net 4.2 is affected by OS Command Injection. It does not properly check the parameters sent as input before they are processed on the server. Due to the lack of validation of user input an unauthenticated attacker can bypass the syntax intended by the software (e.g. concatenate `&|;\\r\\ commands) and inject arbitrary system commands with the privileges of the application user.


Formula Injection/CSV Injection due to Improper Neutralization of Formula Elements in CSV File in GitHub repository luyadev/yii-helpers prior to 1.2.1. Successful exploitation can lead to impacts such as client-sided command injection code execution or remote ex-filtration of contained confidential data.


Okta Advanced Server Access Client for Linux and macOS prior to version 1.58.0 was found to be vulnerable to command injection via a specially crafted URL. An attacker who has knowledge of a valid team name for the victim and also knows a valid target host where the user has access can execute commands on the local system.


Command Injection vulnerability in git-interface@2.1.1 in GitHub repository yarkeev/git-interface prior to 2.1.2. If both are provided by user input then the use of a `--upload-pack` command-line argument feature of git is also supported for `git clone` which would then allow for any operating system command to be spawned by the attacker.


Fusionpbx v4.4 and below contains a command injection vulnerability via the download email logs function.


There

is

a

command

injection

vulnerability

at

the

interface

of

Tenda

US_AC15V1.0BR_V15.03.05.20_multi_TDE01.bin

device

web

which

can

also

cooperate

with

to

cause

unconditional

arbitrary

command

execution


D-link 882 DIR882A1_FW130B06 was discovered to contain a command injection vulnerability in`/usr/bin/cli.


The package cocoapods-downloader before 1.6.0 from 1.6.2 and before 1.6.3 are vulnerable to Command Injection via git argument injection. When calling the Pod::Downloader.preprocess_options function and using git both the git and branch parameters are passed to the git ls-remote subcommand in a way that additional flags can be set. The additional flags can be used to perform a command injection.


CasaOS before v0.2.7 was discovered to contain a command injection vulnerability.


Nextcloud Calendar is a calendar application for the nextcloud framework. SMTP Command Injection in Appointment Emails via Newlines: as newlines and special characters are not sanitized in the email value in the JSON request a malicious attacker can inject newlines to break out of the `RCPT TO:<BOOKING USER'S EMAIL> ` SMTP command and begin injecting arbitrary SMTP commands. It is recommended that Calendar is upgraded to 3.2.2. There are no workaround available.


Okta Advanced Server Access Client for Windows prior to version 1.57.0 was found to be vulnerable to command injection via a specially crafted URL.


The package simple-git before 3.3.0 are vulnerable to Command Injection via argument injection. When calling the .fetch(remote branch handlerFn) function both the remote and branch parameters are passed to the git fetch subcommand. By injecting some git options it was possible to get arbitrary command execution.


The package git-pull-or-clone before 2.0.2 are vulnerable to Command Injection due to the use of the --upload-pack feature of git which is also supported for git clone. The source includes the use of the secure child process API spawn(). However the outpath parameter passed to it may be a command-line argument to the git clone command and result in arbitrary command injection.


The

package

simple-git

before

are

vulnerable

to

Command

Injection

due

to

an

incomplete

fix

of

which

only

patches

against

the

git

fetch

attack

vector.

A

similar

use

of

the

--upload-pack

feature

of

git

is

also

supported

for

git

clone

which

the

prior

fix

didn't

cover.


The package git before 1.11.0 are vulnerable to Command Injection via git argument injection. When calling the fetch(remote = 'origin' opts = {}) function the remote parameter is passed to the git fetch subcommand in a way that additional flags can be set. The additional flags can be used to perform a command injection.


The package czproject/git-php before 4.0.3 are vulnerable to Command Injection via git argument injection. When calling the isRemoteUrlReadable($url array $refs = NULL) function both the url and refs parameters are passed to the git ls-remote subcommand in a way that additional flags can be set. The additional flags can be used to perform a command injection.


Hitron CHITA 7.2.2.0.3b6-CD devices contain a command injection vulnerability via the Device/DDNS ddnsUsername field.


JetBrains TeamCity before 2021.2.3 was vulnerable to OS command injection in the Agent Push feature configuration.


Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in ping tool of Profelis IT Consultancy SambaBox allows AUTHENTICATED user to cause run arbitrary code. This issue affects: Profelis IT Consultancy SambaBox 4.0 version 4.0 and prior versions on x86.


The package workspace-tools before 0.18.4 are vulnerable to Command Injection via git argument injection. When calling the fetchRemoteBranch(remote: string remoteBranch: string cwd: string) function both the remote and remoteBranch parameters are passed to the git fetch subcommand in a way that additional flags can be set. The additional flags can be used to perform a command injection.


GNOME OCRFeeder before 0.8.4 allows OS command injection via shell metacharacters in a PDF or image filename.


An OS Command Injection vulnerability in the configuration parser of Eve-NG Professional through 4.0.1-65 and Eve-NG Community through 2.0.3-112 allows a remote authenticated attacker to execute commands as root by editing virtualization command parameters of imported UNL files.


On all versions of 16.1.x 15.1.x 14.1.x 13.1.x 12.1.x and 11.6.x of F5 BIG-IP Advanced WAF ASM and ASM and F5 BIG-IP Guided Configuration (GC) all versions prior to 9.0 when running in Appliance mode an authenticated attacker assigned the Administrator role may be able to bypass Appliance mode restrictions utilizing command injection vulnerabilities in undisclosed URIs in F5 BIG-IP Guided Configuration. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated


An issue was discovered in Galleon NTS-6002-GPS 4.14.103-Galleon-NTS-6002.V12 4. An authenticated attacker can perform command injection as root via shell metacharacters within the Network Tools section of the web-management interface. All three networking tools are affected (Ping Traceroute and DNS Lookup) and their respective input fields (ping_address trace_address nslookup_address).


OS command injection vulnerability exists in CENTUM VP R4.01.00 to R4.03.00 CENTUM VP Small R4.01.00 to R4.03.00 CENTUM VP Basic R4.01.00 to R4.03.00 and B/M9000 VP R6.01.01 to R6.03.02 which may allow an attacker who can access the computer where the affected product is installed to execute an arbitrary OS command by altering a file generated using Graphic Builder.


TOTOLINK N600R v5.3c.5507_B20171031 was discovered to contain a command injection vulnerability via the QUERY_STRING parameter in the \Main\ function.


A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Patch 1 USG FLEX 200 firmware versions 5.00 through 5.21 Patch 1 USG FLEX 500 firmware versions 5.00 through 5.21 Patch 1 USG FLEX 700 firmware versions 5.00 through 5.21 Patch 1 USG FLEX 50(W) firmware versions 5.10 through 5.21 Patch 1 USG20(W)-VPN firmware versions 5.10 through 5.21 Patch 1 ATP series firmware versions 5.10 through 5.21 Patch 1 VPN series firmware versions 4.60 through 5.21 Patch 1 which could allow an attacker to modify specific files and then execute some OS commands on a vulnerable device.


An OS command injection vulnerability exists in the daretools binary functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted network request can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger this vulnerability.


Citrix

XenMobile

Server

through

through

and

through

allows

Command

Injection.


An OS command injection vulnerability exists in the httpd wlscan_ASP functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.


An OS command injection vulnerability exists in the console factory functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted network request can lead to command execution. An attacker can send a sequence of requests to trigger this vulnerability.


D-Link DIR-878 has inadequate filtering for special characters in the webpage input field. An unauthenticated LAN attacker can perform command injection attack to execute arbitrary system commands to control the system or disrupt service.


A malicious user on the same LAN could use DNS spoofing followed by a command injection attack to trick a NAS device into loading through an unsecured HTTP call. Addressed this vulnerability by disabling checks for internet connectivity using HTTP.


** UNSUPPORTED WHEN ASSIGNED ** Improper neutralization of Special Elements leading to OS Command Injection vulnerability impacting end-of-life Secure Remote Access (SRA) products and older firmware versions of Secure Mobile Access (SMA) 100 series products specifically the SRA appliances running all 8.x 9.0.0.5-19sv and earlier versions and Secure Mobile Access (SMA) 100 series products running older firmware 9.0.0.9-26sv and earlier versions.


A authenticated remote command injection vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below 6.9.9 and below 6.8.9-HF2 and below 6.7.x and below. Aruba has released updates to ClearPass Policy Manager that address this security vulnerability.


iTunesRPC-Remastered is a Discord Rich Presence for iTunes on Windows utility. In affected versions iTunesRPC-Remastered did not properly sanitize image file paths leading to OS level command injection. This issue has been patched in commit cdcd48b. Users are advised to upgrade.


lib/Image/ExifTool.pm in ExifTool before 12.38 mishandles a $file =~ /\\|$/ check leading to command injection.


The package libvcs before 0.11.1 are vulnerable to Command Injection via argument injection. When calling the update_repo function (when using hg) the url parameter is passed to the hg clone command. By injecting some hg options it was possible to get arbitrary command execution.


The package cocoapods-downloader before 1.6.2 are vulnerable to Command Injection via hg argument injection. When calling the download function (when using hg) the url (and/or revision tag branch) is passed to the hg clone command in a way that additional flags can be set. The additional flags can be used to perform a command injection.


The package github.com/masterminds/vcs before 1.13.3 are vulnerable to Command Injection via argument injection. When hg is executed argument strings are passed to hg in a way that additional flags can be set. The additional flags can be used to perform a command injection.


An issue was discovered on ASMAX AR-804gu 66.34.1 devices. There is Command Injection via the cgi-bin/script query string.


On Linksys WAG54G2 1.00.10 devices there is authenticated command injection via shell metacharacters in the setup.cgi c4_ping_ipaddr variable.


A vulnerability in the Cisco Unified Computing System (UCS) Manager Cisco Firepower 4100 Series Next-Generation Firewall (NGFW) and Cisco Firepower 9300 Security Appliance could allow an authenticated local attacker to obtain root shell privileges on the device aka Command Injection. The vulnerability is due to improper validation of string input in the shell application. An attacker could exploit this vulnerability through the use of malicious commands. A successful exploit could allow the attacker to obtain root shell privileges on the device. Cisco Bug IDs: CSCvf20741 CSCvf60078.


An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP POST can cause a privilege escalation resulting in a root shell. An attacker can inject OS commands into the ip= parm in the \/goform/net_WebPingGetValue\ URI to trigger this vulnerability.


An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP POST can cause a privilege escalation resulting in root shell. An attacker can inject OS commands into the CN= parm in the \/goform/net_WebCSRGen\ uri to trigger this vulnerability.


An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP POST can cause a privilege escalation resulting in root shell. An attacker can inject OS commands into the rsakey\\_name= parm in the \/goform/WebRSAKEYGen\ uri to trigger this vulnerability.


QNAP discovered a number of command injection vulnerabilities found in Music Station versions 4.8.6 (for QTS 4.2.x) 5.0.7 (for QTS 4.3.x) and earlier. If exploited these vulnerabilities may allow a remote attacker to run arbitrary commands on the NAS.


AppUse 4.0 allows shell command injection via a proxy field.


The D-Link EyeOn Baby Monitor (DCS-825L) 1.08.1 has multiple command injection vulnerabilities in the web service framework. An attacker can forge malicious HTTP requests to execute commands; authentication is required before executing the attack.


The Keyguard application in ALE-L02C635B140 and earlier versions ALE-L02C636B140 and earlier versions ALE-L21C10B150 and earlier versions ALE-L21C185B200 and earlier versions ALE-L21C432B214 and earlier versions ALE-L21C464B150 and earlier versions ALE-L21C636B200 and earlier versions ALE-L23C605B190 and earlier versions ALE-TL00C01B250 and earlier versions ALE-UL00C00B250 and earlier versions MT7-L09C605B325 and earlier versions MT7-L09C900B339 and earlier versions MT7-TL10C900B339 and earlier versions CRR-CL00C92B172 and earlier versions CRR-L09C432B180 and earlier versions CRR-TL00C01B172 and earlier versions CRR-UL00C00B172 and earlier versions CRR-UL20C432B171 and earlier versions GRA-CL00C92B230 and earlier versions GRA-L09C432B222 and earlier versions GRA-TL00C01B230SP01 and earlier versions GRA-UL00C00B230 and earlier versions GRA-UL00C10B201 and earlier versions GRA-UL00C432B220 and earlier versions H60-L04C10B523 and earlier versions H60-L04C185B523 and earlier versions H60-L04C636B527 and earlier versions H60-L04C900B530 and earlier versions PLK-AL10C00B220 and earlier versions PLK-AL10C92B220 and earlier versions PLK-CL00C92B220 and earlier versions PLK-L01C10B140 and earlier versions PLK-L01C185B130 and earlier versions PLK-L01C432B187 and earlier versions PLK-L01C432B190 and earlier versions PLK-L01C432B190 and earlier versions PLK-L01C636B130 and earlier versions PLK-TL00C01B220 and earlier versions PLK-TL01HC01B220 and earlier versions PLK-UL00C17B220 and earlier versions ATH-AL00C00B210 and earlier versions ATH-AL00C92B200 and earlier versions ATH-CL00C92B210 and earlier versions ATH-TL00C01B210 and earlier versions ATH-TL00HC01B210 and earlier versions ATH-UL00C00B210 and earlier versions RIO-AL00C00B220 and earlier versions RIO-CL00C92B220 and earlier versions RIO-TL00C01B220 and earlier versions RIO-UL00C00B220 and earlier versions have a privilege elevation vulnerability. An attacker may exploit it to launch command injection in order to gain elevated privileges.


VCM5010 with software versions earlier before V100R002C50SPC100 has a command injection vulnerability. This is due to insufficient validation of user's input. An authenticated attacker could launch a command injection attack.


An exploitable vulnerability exists in the /api/CONFIG/restore functionality of Circle with Disney running firmware 2.0.1. Specially crafted network packets can cause an OS command injection. An attacker can send an HTTP request trigger this vulnerability.


An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary shell characters during a password change resulting in command injection. An attacker can simply send an HTTP request to the device to trigger this vulnerability.


In the web management interface in Foscam C1 Indoor HD cameras with application firmware 2.52.2.37 a specially crafted HTTP request can allow for a user to inject arbitrary shell characters during manual network configuration resulting in command injection. An attacker can simply send an HTTP request to the device to trigger this vulnerability.


A command injection vulnerability in the IDP feature of Juniper Networks Junos OS on SRX series devices potentially allows a user with login access to the device to execute shell commands and elevate privileges. Affected releases are Juniper Networks Junos OS 12.1X44 prior to 12.1X44-D60; 12.1X46 prior to 12.1X46-D50; 12.1X47 prior to 12.1X47-D30 12.1X47-D35; 12.3X48 prior to 12.3X48-D20 12.3X48-D30; 15.1X49 prior to 15.1X49-D20 15.1X49-D30.


An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary shell characters resulting in command injection during the boot process. To trigger this vulnerability an attacker needs to send an HTTP request and reboot the device.


In the web management interface in Foscam C1 Indoor HD cameras with application firmware 2.52.2.37 a specially crafted HTTP request can allow for a user to inject arbitrary shell characters during NTP server configuration resulting in command injection. An attacker can simply send an HTTP request to the device to trigger this vulnerability.


An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary shell characters during account creation resulting in command injection. An attacker can simply send an HTTP request to the device to trigger this vulnerability.


An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary shell characters during the SMTP configuration tests resulting in command execution


An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37. A specially crafted HTTP request can allow for a user to inject arbitrary data in the \msmtprc\ configuration file resulting in command execution. An attacker can simply send an HTTP request to the device to trigger this vulnerability.


An exploitable vulnerability exists in the /api/CONFIG/backup functionality of Circle with Disney. Specially crafted network packets can cause an OS command injection. An attacker can send an HTTP request to trigger this vulnerability.


An exploitable vulnerability exists in the notifications functionality of Circle with Disney running firmware 2.0.1. Specially crafted network packets can cause an OS command injection. An attacker can send an HTTP request to trigger this vulnerability.


An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.43. A specially crafted HTTP request can allow for a user to inject arbitrary shell characters during the SoftAP configuration resulting in command injection. An attacker can simply send an HTTP request to the device to trigger this vulnerability.


OS Command Injection vulnerability in McAfee ePolicy Orchestrator (ePO) 5.9.0 5.3.2 5.3.1 5.1.3 5.1.2 5.1.1 and 5.1.0 allows attackers to run arbitrary OS commands with limited privileges via not sanitizing the user input data before exporting it into a CSV format output.


trixbox 2.8.0.4 has OS command injection via shell metacharacters in the lang parameter to /maint/modules/home/index.php.


An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP POST can cause a privilege escalation resulting in root shell. An attacker can inject OS commands into the remoteNetwork0= parameter in the \/goform/net\\_Web\\_get_value\ uri to trigger this vulnerability.


In the MMM::Agent::Helpers::Network::clear_ip function in MySQL Multi-Master Replication Manager (MMM) mmm_agentd 2.2.1 (for Linux) a specially crafted MMM protocol message can cause a shell command injection resulting in arbitrary command execution with the privileges of the mmm\\_agentd process. An attacker that can initiate a TCP session with mmm\\_agentd can trigger this vulnerability.


Sourcetree for Windows had several argument and command injection bugs in Mercurial and Git repository handling. An attacker with permission to commit to a repository linked in Sourcetree for Windows is able to exploit this issue to gain code execution on the system. From version 0.8.4b of Sourcetree for Windows this vulnerability can be triggered from a webpage through the use of the Sourcetree URI handler. Versions of Sourcetree for Windows starting with 0.5.1.0 before version 2.4.7.0 are affected by this vulnerability


An exploitable OS Command Injection vulnerability exists in the Telnet SSH and console login functionality of Moxa AWK-3131A Industrial IEEE 802.11a/b/g/n wireless AP/bridge/client in firmware versions 1.4 to 1.7 (current). An attacker can inject commands via the username parameter of several services (SSH Telnet console) resulting in remote unauthenticated root-level operating system command execution.


In the MMM::Agent::Helpers::Network::send_arp function in MySQL Multi-Master Replication Manager (MMM) mmm_agentd 2.2.1 (for Solaris) a specially crafted MMM protocol message can cause a shell command injection resulting in arbitrary command execution with the privileges of the mmm\\_agentd process. An attacker that can initiate a TCP session with mmm\\_agentd can trigger this vulnerability.


In the MMM::Agent::Helpers::_execute function in MySQL Multi-Master Replication Manager (MMM) mmm_agentd 2.2.1 a specially crafted MMM protocol message can cause a shell command injection resulting in arbitrary command execution with the privileges of the mmm\\_agentd process. An attacker that can initiate a TCP session with mmm\\_agentd can trigger this vulnerability.


In the MMM::Agent::Helpers::Network::clear_ip function in MySQL Multi-Master Replication Manager (MMM) mmm_agentd 2.2.1 (for FreeBSD) a specially crafted MMM protocol message can cause a shell command injection resulting in arbitrary command execution with the privileges of the mmm\\_agentd process. An attacker that can initiate a TCP session with mmm\\_agentd can trigger this vulnerability.


In the MMM::Agent::Helpers::Network::add_ip function in MySQL Multi-Master Replication Manager (MMM) mmm_agentd 2.2.1 (for Linux) a specially crafted MMM protocol message can cause a shell command injection resulting in arbitrary command execution with the privileges of the mmm\\_agentd process. An attacker that can initiate a TCP session with mmm\\_agentd can trigger this vulnerability.


In Asterisk 11.x before 11.25.2 13.x before 13.17.1 and 14.x before 14.6.1 and Certified Asterisk 11.x before 11.6-cert17 and 13.x before 13.13-cert5 unauthorized command execution is possible. The app_minivm module has an \externnotify\ program configuration option that is executed by the MinivmNotify dialplan application. The application uses the caller-id name and number as part of a built string passed to the OS shell for interpretation and execution. Since the caller-id name and number can come from an untrusted source a crafted caller-id name or number allows an arbitrary shell command injection.


In the MMM::Agent::Helpers::Network::clear_ip function in MySQL Multi-Master Replication Manager (MMM) mmm_agentd 2.2.1 (for Solaris) a specially crafted MMM protocol message can cause a shell command injection resulting in arbitrary command execution with the privileges of the mmm\\_agentd process. An attacker that can initiate a TCP session with mmm\\_agentd can trigger this vulnerability.


An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP POST can cause a privilege escalation resulting in root shell. An attacker can inject OS commands into the openvpnServer0_tmp= parameter in the \/goform/net\\_Web\\_get_value\ uri to trigger this vulnerability.


Sourcetree for macOS had several argument and command injection bugs in Mercurial and Git repository handling. An attacker with permission to commit to a repository linked in Sourcetree for macOS is able to exploit this issue to gain code execution on the system. From version 1.4.0 of Sourcetree for macOS this vulnerability can be triggered from a webpage through the use of the Sourcetree URI handler. Versions of Sourcetree for macOS starting with 1.0b2 before version 2.7.0 are affected by this vulnerability.


In the MMM::Agent::Helpers::Network::add_ip function in MySQL Multi-Master Replication Manager (MMM) mmm_agentd 2.2.1 (for FreeBSD) a specially crafted MMM protocol message can cause a shell command injection resulting in arbitrary command execution with the privileges of the mmm\\_agentd process. An attacker that can initiate a TCP session with mmm\\_agentd can trigger this vulnerability.


An exploitable command injection vulnerability exists in the web server functionality of Moxa EDR-810 V4.1 build 17030317. A specially crafted HTTP POST can cause a privilege escalation resulting in root shell. An attacker can inject OS commands into the remoteNetmask0= parameter in the \/goform/net\\_Web\\_get_value\ uri to trigger this vulnerability.


An Improper Neutralization of Special Elements used in an OS Command issue was discovered in Digium Asterisk GUI 2.1.0 and prior. An OS command injection vulnerability has been identified that may allow the execution of arbitrary code on the system through the inclusion of OS commands in the URL request of the program.


In the MMM::Agent::Helpers::Network::add_ip function in MySQL Multi-Master Replication Manager (MMM) mmm_agentd 2.2.1 (for Solaris) a specially crafted MMM protocol message can cause a shell command injection resulting in arbitrary command execution with the privileges of the mmm\\_agentd process. An attacker that can initiate a TCP session with mmm\\_agentd can trigger this vulnerability.


An OS Command Injection vulnerability in Fortinet FortiWLC 6.1-2 through 6.1-5 7.0-7 through 7.0-10 8.0 through 8.2 and 8.3.0 through 8.3.2 file management AP script download webUI page allows an authenticated admin user to execute arbitrary system console commands via crafted HTTP requests.


In Horde_Crypt before 2.7.6 as used in Horde Groupware Webmail Edition 5.x through 5.2.17 OS Command Injection can occur if the user has PGP features enabled in the user's preferences and has enabled the \Should PGP signed messages be automatically verified when viewed?\ preference. To exploit this vulnerability an attacker can send a PGP signed email (that is maliciously crafted) to the Horde user who then must either view or preview it.


Tuleap before 9.7 allows command injection via the PhpWiki 1.3.10 SyntaxHighlighter plugin. This occurs in the Project Wiki component because the proc_open PHP function is used within PhpWiki before 1.5.5 with a syntax value in its first argument and an authenticated Tuleap user can control this value even with shell metacharacters as demonstrated by a '<?plugin SyntaxHighlighter syntax=\c;id\' line to execute the id command.


In Horde_Crypt before 2.7.6 as used in Horde Groupware Webmail Edition through 5.2.17 OS Command Injection can occur if the attacker is an authenticated Horde Webmail user has PGP features enabled in their preferences and attempts to encrypt an email addressed to a maliciously crafted email address.


Ruckus Wireless Zone Director Controller firmware releases ZD9.9.x ZD9.10.x ZD9.13.0.x less than 9.13.0.0.232 contain OS Command Injection vulnerabilities in the ping functionality that could allow local authenticated users to execute arbitrary privileged commands on the underlying operating system.


A vulnerability in the web interface of the Cisco Web Security Appliance (WSA) could allow an authenticated remote attacker to perform command injection and elevate privileges to root. The attacker must authenticate with valid administrator credentials. Affected Products: Cisco AsyncOS Software 10.0 and later for WSA on both virtual and hardware appliances. More Information: CSCvd88862. Known Affected Releases: 10.1.0-204. Known Fixed Releases: 10.5.1-270 10.1.1-235.


In Sophos Web Appliance (SWA) before 4.3.1.2 a section of the machine's configuration utilities for adding (and detecting) Active Directory servers was vulnerable to remote command injection aka NSWA-1314.


A vulnerability in the local-mgmt CLI command of the Cisco Unified Computing System (UCS) Manager Cisco Firepower 4100 Series Next-Generation Firewall (NGFW) and Cisco Firepower 9300 Security Appliance could allow an authenticated local attacker to perform a command injection attack. More Information: CSCvb61394 CSCvb86816. Known Affected Releases: 2.0(1.68) 3.1(1k)A. Known Fixed Releases: 92.2(1.101) 92.1(1.1658) 2.0(1.115).


In Sophos Web Appliance (SWA) before 4.3.1.2 a section of the machine's interface responsible for generating reports was vulnerable to remote command injection via functions aka NSWA-1304.


A vulnerability in the CLI of Cisco Unified Computing System (UCS) Manager Cisco Firepower 4100 Series Next-Generation Firewall (NGFW) and Cisco Firepower 9300 Security Appliance could allow an authenticated local attacker to perform a command injection attack. More Information: CSCvb66189 CSCvb86775. Known Affected Releases: 2.0(1.68) 3.1(1k)A. Known Fixed Releases: 92.2(1.101) 92.1(1.1742) 92.1(1.1658) 2.1(1.38) 2.0(1.107) 2.0(1.87) 1.1(4.148) 1.1(4.138).


A Command Injection issue was discovered in Satel Iberia SenNet Data Logger and Electricity Meters: SenNet Optimal DataLogger V5.37c-1.43c and prior SenNet Solar Datalogger V5.03-1.56a and prior and SenNet Multitask Meter V5.21a-1.18b and prior. Successful exploitation of this vulnerability could result in the attacker breaking out of the jailed shell and gaining full access to the system.


A remote command injection vulnerability exists in the Barracuda Load Balancer product line (confirmed on v5.4.0.004 (2015-11-26) and v6.0.1.006 (2016-08-19); fixed in 6.1.0.003 (2017-01-17)) in which an authenticated user can execute arbitrary shell commands and gain root privileges. The vulnerability stems from unsanitized data being processed in a system call when the delete_assessment command is issued.


In Sophos Web Appliance (SWA) before 4.3.1.2 a section of the machine's interface responsible for generating reports was vulnerable to remote command injection via the token parameter aka NSWA-1303.


Ruckus Networks Solo APs firmware releases R110.x or before and Ruckus Networks SZ managed APs firmware releases R5.x or before contain authenticated Root Command Injection in the web-GUI that could allow authenticated valid users to execute privileged commands on the respective systems.


An issue was discovered in Riello NetMan 204 14-2 and 15-2. The issue is with the login script and wrongpass Python script used for authentication. When calling wrongpass the variables $VAL0 and $VAL1 should be enclosed in quotes to prevent the potential for Bash command injection. Further to this VAL0 and VAL1 should be sanitised to ensure they do not contain malicious characters. Passing it the username of '-' will cause it to time out and log the user in because of poor error handling. This will log the attacker in as an administrator where the telnet / ssh services can be enabled and the credentials for local users can be reset. Also login.cgi accepts the username as a GET parameter so login can be achieved by browsing to the /cgi-bin/login.cgi?username=-%20a URI.


A vulnerability in the CLI of the Cisco Unified Computing System (UCS) Manager Cisco Firepower 4100 Series Next-Generation Firewall (NGFW) and Cisco Firepower 9300 Security Appliance could allow an authenticated local attacker to perform a command injection attack. More Information: CSCvb61351 CSCvb61637. Known Affected Releases: 2.0(1.68) 3.1(1k)A. Known Fixed Releases: 92.2(1.101) 92.1(1.1645) 2.0(1.82) 1.1(4.136.


Ruckus Wireless Zone Director Controller firmware releases ZD9.x ZD10.0.0.x ZD10.0.1.x (less than 10.0.1.0.17 MR1 release) and Ruckus Wireless Unleashed AP Firmware releases 200.0.x 200.1.x 200.2.x 200.3.x 200.4.x. contain OS Command Injection vulnerabilities that could allow local authenticated users to execute arbitrary privileged commands on the underlying operating system by appending those commands in the Common Name field in the Certificate Generation Request.


A vulnerability in the CLI of the Cisco Unified Computing System (UCS) Manager Cisco Firepower 4100 Series Next-Generation Firewall (NGFW) and Cisco Firepower 9300 Security Appliance could allow an authenticated local attacker to perform a command injection attack. More Information: CSCvb61384 CSCvb86764. Known Affected Releases: 2.0(1.68) 3.1(1k)A. Known Fixed Releases: 92.2(1.101) 92.1(1.1647).


A vulnerability in the CLI command-parsing code of Cisco Meeting Server could allow an authenticated local attacker to perform command injection and escalate their privileges to root. The attacker must first authenticate to the application with valid administrator credentials. The vulnerability is due to insufficient validation of user-supplied input at the CLI for certain commands. An attacker could exploit this vulnerability by authenticating to the affected application and submitting a crafted CLI command for execution at the Cisco Meeting Server CLI. An exploit could allow the attacker to perform command injection and escalate their privilege level to root. Vulnerable Products: This vulnerability exists in Cisco Meeting Server software versions prior to and including 2.0 2.1 and 2.2. Cisco Bug IDs: CSCvf53830.


A vulnerability in the CLI command-parsing code of the Cisco StarOS operating system for Cisco ASR 5000 Series 11.0 through 21.0 5500 Series and 5700 Series devices and Cisco Virtualized Packet Core (VPC) Software could allow an authenticated local attacker to break from the StarOS CLI of an affected system and execute arbitrary shell commands as a Linux root user on the system aka Command Injection. The vulnerability exists because the affected operating system does not sufficiently sanitize commands before inserting them into Linux shell commands. An attacker could exploit this vulnerability by submitting a crafted CLI command for execution in a Linux shell command as a root user. Cisco Bug IDs: CSCvc69329 CSCvc72930.


A vulnerability in the CLI parser of the Cisco Web Security Appliance (WSA) could allow an authenticated local attacker to perform command injection and elevate privileges to root. The attacker must authenticate with valid operator-level or administrator-level credentials. Affected Products: virtual and hardware versions of Cisco Web Security Appliance (WSA). More Information: CSCvd88855. Known Affected Releases: 10.1.0-204. Known Fixed Releases: 10.5.1-270 10.1.1-234.


Ruckus Networks Unleashed AP firmware releases before 200.6.10.1.x and Ruckus Networks Zone Director firmware releases 10.1.0.0.x 9.10.2.0.x 9.12.3.0.x 9.13.3.0.x 10.0.1.0.x or before contain authenticated Root Command Injection in the CLI that could allow authenticated valid users to execute privileged commands on the respective systems.


In manager.c in ss-manager in shadowsocks-libev 3.1.0 improper parsing allows command injection via shell metacharacters in a JSON configuration request received via 127.0.0.1 UDP traffic related to the add_server build_config and construct_command_line functions.


Zyxel NBG6716 V1.00(AAKG.9)C0 devices allow command injection in the ozkerz component because beginIndex and endIndex are used directly in a popen call.


VMware Horizon View Client (2.x 3.x and 4.x prior to 4.5.0) contains a command injection vulnerability in the service startup script. Successful exploitation of this issue may allow unprivileged users to escalate their privileges to root on the Mac OSX system where the client is installed.


Zivif

and

(and

possibly

in-between

versions)

web

cameras

are

vulnerable

to

unauthenticated

blind

remote

command

injection

via

CGI

scripts

used

as

part

of

the

web

interface

as

demonstrated

by

a

cgi-bin/iptest.cgi?cmd=iptest.cgi&-time=\1504225666237\&-url=$(reboot)

request.


In Apache Airflow 1.8.2 and earlier a CSRF vulnerability allowed for a remote command injection on a default install of Airflow.


On D-Link DCS-5009 devices with firmware 1.08.11 and earlier DCS-5010 devices with firmware 1.14.09 and earlier and DCS-5020L devices with firmware before 1.15.01 command injection in alphapd (binary responsible for running the camera's web server) allows remote authenticated attackers to execute code through sanitized /setSystemAdmin user input in the AdminID field being passed directly to a call to system.


Ruby before 2.4.3 allows Net::FTP command injection. Net::FTP#get getbinaryfile gettextfile put putbinaryfile and puttextfile use Kernel#open to open a local file. If the localfile argument starts with the \|\ pipe character the command following the pipe character is executed. The default value of localfile is File.basename(remotefile) so malicious FTP servers could cause arbitrary command execution.


The lazy_initialize function in lib/resolv.rb in Ruby through 2.4.3 uses Kernel#open which might allow Command Injection attacks as demonstrated by a Resolv::Hosts::new argument beginning with a '|' character a different vulnerability than CVE-2017-17405. NOTE: situations with untrusted input may be highly unlikely.


Command Injection vulnerability in app_data_center on Shenzhen Tenda Ac9 US_AC9V1.0BR_V15.03.05.14_multi_TD01 Ac9 ac9_kf_V15.03.05.19(6318_)_cn Ac15 US_AC15V1.0BR_V15.03.05.18_multi_TD01 Ac15 US_AC15V1.0BR_V15.03.05.19_multi_TD01 Ac18 US_AC18V1.0BR_V15.03.05.05_multi_TD01 and Ac18 ac18_kf_V15.03.05.19(6318_)_cn devices allows remote unauthenticated attackers to execute arbitrary OS commands via a crafted cgi-bin/luci/usbeject?dev_name= GET request from the LAN. This occurs because the \sub_A6E8 usbeject_process_entry\ function executes a system function with untrusted input.


dns-sync is a sync/blocking dns resolver. If untrusted user input is allowed into the resolve() method then command injection is possible.


Insufficient validation of untrusted input in Blink's mailto: handling in Google Chrome prior to 59.0.3071.86 for Linux Windows and Mac allowed a remote attacker to perform command injection via a crafted HTML page a similar issue to CVE-2004-0121. For example characters such as * have an incorrect interaction with xdg-email in xdg-utils and a space character can be used in front of a command-line argument.


fs-git is a file system like api for git repository. The fs-git version 1.0.1 module relies on child_process.exec however the buildCommand method used to construct exec strings does not properly sanitize data and is vulnerable to command injection across all methods that use it and call exec.


RVM automatically loads environment variables from files in $PWD resulting in command execution RVM vulnerable to command injection when automatically loading environment variables from files in $PWD RVM automatically executes hooks located in $PWD resulting in code execution RVM automatically installs gems as specified by files in $PWD resulting in code execution RVM automatically does \bundle install\ on a Gemfile specified by .versions.conf in $PWD resulting in code execution


Cobbler version up to 2.8.2 is vulnerable to a command injection vulnerability in the \add repo\ component resulting in arbitrary code execution as root user.


I Librarian version <=4.6 & 4.7 is vulnerable to OS Command Injection in batchimport.php resulting the web server being fully compromised.


Command injection in evince via filename when printing to PDF. This affects versions earlier than 3.25.91.


GitPHP by xiphux is vulnerable to OS Command Injections


Linux Dash up to version v2 is vulnerable to multiple command injection vulnerabilities in the way module names are parsed and then executed resulting in code execution on the server potentially as root.


Plexus-utils before 3.0.16 is vulnerable to command injection because it does not correctly process the contents of double quoted strings.


soyuka/pidusage <=1.1.4 is vulnerable to command injection in the module resulting in arbitrary command execution


npm/KyleRoss windows-cpu all versions vulnerable to command injection resulting in code execution as Node.js user


Certain NETGEAR devices are affected by command injection by an authenticated user. This affects WNDR3700v4 before 1.0.2.88 WNDR4300v1 before 1.0.2.90 and WNR2000v5 before 1.0.0.58.


The ZyXEL P660HN-T1A v1 TCLinux Fw $7.3.15.0 v001 / 3.40(ULM.0)b31 router distributed by TrueOnline has two user accounts with default passwords including a hardcoded service account with the username true and password true. These accounts can be used to login to the web interface exploit authenticated command injections and change router settings for malicious purposes.


Certain

NETGEAR

devices

are

affected

by

command

injection

by

an

unauthenticated

attacker.

This

affects

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

command

injection.

This

affects

before

before

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

command

injection

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


The ZyXEL P660HN-T1A v1 TCLinux Fw $7.3.15.0 v001 / 3.40(ULM.0)b31 router distributed by TrueOnline has a command injection vulnerability in the Remote System Log forwarding function which is accessible by an unauthenticated user. The vulnerability is in the ViewLog.asp page and can be exploited through the remote_host parameter.


The ZyXEL P660HN-T1A v2 TCLinux Fw #7.3.37.6 router distributed by TrueOnline has a command injection vulnerability in the Remote System Log forwarding function which is only accessible by an authenticated user. The vulnerability is in the logSet.asp page and can be exploited through the ServerIP parameter. Authentication can be achieved by exploiting CVE-2017-18371.


NETGEAR ReadyNAS 6.6.1 and earlier is affected by command injection.


Certain

NETGEAR

devices

are

affected

by

command

injection.

This

affects

before

before

before

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

command

injection.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

command

injection.

This

affects

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

command

injection

by

an

authenticated

user.

This

affects

through

through

through

through

through

and

through


Certain

NETGEAR

devices

are

affected

by

command

injection

by

an

unauthenticated

attacker.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

command

injection

by

an

unauthenticated

attacker.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

and

before


Certain NETGEAR devices are affected by command injection. This affects D6220 before 1.0.0.28 and D6100 before 1.0.0.50_0.0.50.


The Billion 5200W-T 1.02b.rc5.dt49 router distributed by TrueOnline has a command injection vulnerability in the Remote System Log forwarding function which is accessible by an unauthenticated user. The vulnerability is in the adv_remotelog.asp page and can be exploited through the syslogServerAddr parameter.


Certain

NETGEAR

devices

are

affected

by

command

injection.

This

affects

before

before

before

before

and

before


The ZyXEL P660HN-T1A v2 TCLinux Fw #7.3.37.6 router distributed by TrueOnline has three user accounts with default passwords including two hardcoded service accounts: one with the username true and password true and another with the username supervisor and password zyad1234. These accounts can be used to login to the web interface exploit authenticated command injections and change router settings for malicious purposes.


Certain NETGEAR devices are affected by command injection. This affects R7800 before 1.0.2.16 and R9000 before 1.0.2.4.


A Command Injection issue was discovered in ContentStore/Base/CVDataPipe.dll in Commvault before v11 SP6. A certain message parsing function inside the Commvault service does not properly validate the input of an incoming string before passing it to CreateProcess. As a result a specially crafted message can inject commands that will be executed on the target operating system. Exploitation of this vulnerability does not require authentication and can lead to SYSTEM level privilege on any system running the cvd daemon. This is a different vulnerability than CVE-2017-3195.


An

issue

was

discovered

on

Wireless

IP

Camera

WIFICAM

cameras.

There

is

Command

Injection

in

the

script

via

shell

metacharacters

in

the

pwd

variable

as

demonstrated

by

a

set_ftp.cgi?svr=192.168.1.1&port=21&user=ftp

URI.


Certain

NETGEAR

devices

are

affected

by

command

injection

by

an

unauthenticated

attacker.

This

affects

before

before

before

before

before

and

before


The Billion 5200W-T TCLinux Fw $7.3.8.0 v008 130603 router distributed by TrueOnline has three user accounts with default passwords including two hardcoded service accounts: one with the username true and password true and another with the username user3 and and a long password consisting of a repetition of the string 0123456789. These accounts can be used to login to the web interface exploit authenticated command injections and change router settings for malicious purposes.


Certain

NETGEAR

devices

are

affected

by

command

injection

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

command

injection.

This

affects

before

before

before

before

before

before

and

before


NETGEAR D6100 devices before 1.0.0.50_0.0.50 are affected by command injection.


The Billion 5200W-T TCLinux Fw $7.3.8.0 v008 130603 router distributed by TrueOnline has a command injection vulnerability in the Time Setting function which is only accessible by an authenticated user. The vulnerability is in the tools_time.asp page and can be exploited through the uiViewSNTPServer parameter. Authentication can be achieved by exploiting CVE-2017-18373.


Certain

NETGEAR

devices

are

affected

by

command

injection.

This

affects

before

before

before

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

command

injection.

This

affects

before

before

before

before

before

before

before

before

and

before


NETGEAR ReadyNAS devices before 6.6.1 are affected by command injection.


Certain

NETGEAR

devices

are

affected

by

command

injection

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

before

before

before

before

and

before


'/cgi-bin/admin/testserver.cgi' of the web service in most of the VIVOTEK Network Cameras is vulnerable to shell command injection which allows remote attackers to execute any shell command as root via a crafted HTTP request. This vulnerability is already verified on VIVOTEK Network Camera IB8369/FD8164/FD816BA; most others have similar firmware that may be affected. An attack uses shell metacharacters in the senderemail parameter.


A shell command injection in the obs-service-source_validator before 0.7 could be used to execute code as the packager when checking RPM SPEC files with specific macro constructs.


In Green Packet DX-350 Firmware version v2.8.9.5-g1.4.8-atheeb the \PING\ (aka tag_ipPing) feature within the web interface allows performing command injection via the \pip\ parameter.


A command injection was identified on Barco ClickShare Base Unit devices with CSM-1 firmware before 1.7.0.3 and CSC-1 firmware before 1.10.0.10. An attacker with access to the product's web API can exploit this vulnerability to completely compromise the vulnerable device.


IPFire 2.19 has a Remote Command Injection vulnerability in ids.cgi via the OINKCODE parameter which is mishandled by a shell. This can be exploited directly by authenticated users or through CSRF.


FusionSphere V100R006C00SPC102(NFV) has a command injection vulnerability. An authenticated remote attacker could craft packets with malicious strings and send them to a target device. Successful exploit could allow the attacker to launch a command injection attack and execute system commands.


An issue was discovered on Securifi Almond Almond+ and Almond 2015 devices with firmware AL-R096. The device provides a user with the capability of adding new port forwarding rules to the device. It seems that the POST parameters passed in this request to set up routes on the device can be set in such a way that would result in passing commands to a \system\ API in the function and thus result in command injection on the device. If the firmware version AL-R096 is dissected using binwalk tool we obtain a cpio-root archive which contains the filesystem set up on the device that contains all the binaries. The binary \goahead\ is the one that has the vulnerable function that recieves the values sent by the POST request. If we open this binary in IDA-pro we will notice that this follows a MIPS little endian format. The function sub_43C280in IDA pro is identified to be receiving the values sent in the POST request and the value set in POST parameter \ip_address\ is extracted at address 0x0043C2F0. The POST parameter \ipaddress\ is concatenated at address 0x0043C958 and this is passed to a \system\ function at address 0x00437284. This allows an attacker to provide the payload of his/her choice and finally take control of the device.


Huawei iManager NetEco with software V600R008C00 and V600R008C10 has a command injection vulnerability. An authenticated remote attacker could exploit this vulnerability to send malicious packets to a target device. Successful exploit could enable a low privileged user to execute commands that a high privileged user could execute causing the files to be tampered with or deleted.


An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of setting a SMB folder for the video clippings recorded by the device. It seems that the POST parameters passed in this request (to test if email credentials and hostname sent to the device work properly) result in being passed as commands to a \system\ API in the function and thus result in command injection on the device. If the firmware version is dissected using binwalk tool we obtain a cramfs-root archive which contains the filesystem set up on the device that contains all the binaries. The library \libmailutils.so\ is the one that has the vulnerable function \sub_1FC4\ that receives the values sent by the POST request. If we open this binary in IDA-pro we will notice that this follows an ARM little endian format. The function sub_1FC4 in IDA pro is identified to be receiving the values sent in the POST request and the value set in POST parameter \receiver1\ is extracted in function \sub_15AC\ which is then passed to the vulnerable system API call. The vulnerable library function is accessed in \cgibox\ binary at address 0x00023BCC which calls the \Send_mail\ function in \libmailutils.so\ binary as shown below which results in the vulnerable POST parameter being passed to the library which results in the command injection issue.