Total
2452 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2020-26085 | 1 Cisco | 1 Jabber | 2021-01-11 | 9.0 HIGH | 9.9 CRITICAL |
| Multiple vulnerabilities in Cisco Jabber for Windows, Jabber for MacOS, and Jabber for mobile platforms could allow an attacker to execute arbitrary programs on the underlying operating system (OS) with elevated privileges or gain access to sensitive information. For more information about these vulnerabilities, see the Details section of this advisory. | |||||
| CVE-2020-17368 | 2 Debian, Firejail Project | 2 Debian Linux, Firejail | 2021-01-10 | 7.5 HIGH | 9.8 CRITICAL |
| Firejail through 0.9.62 mishandles shell metacharacters during use of the --output or --output-stderr option, which may lead to command injection. | |||||
| CVE-2020-35851 | 1 Hgiga | 2 Msr45 Isherlock-user, Ssr45 Isherlock-user | 2021-01-07 | 10.0 HIGH | 9.8 CRITICAL |
| HGiga MailSherlock does not validate specific parameters properly. Attackers can use the vulnerability to launch Command inject attacks remotely and execute arbitrary commands of the system. | |||||
| CVE-2020-17363 | 1 Usvn | 1 Usvn | 2021-01-05 | 9.0 HIGH | 9.9 CRITICAL |
| USVN (aka User-friendly SVN) before 1.0.9 allows remote code execution via shell metacharacters in the number_start or number_end parameter to LastHundredRequest (aka lasthundredrequestAction) in the Timeline module. NOTE: this may overlap CVE-2020-25069. | |||||
| CVE-2020-35715 | 1 Linksys | 2 Re6500, Re6500 Firmware | 2020-12-28 | 9.0 HIGH | 8.8 HIGH |
| Belkin LINKSYS RE6500 devices before 1.0.012.001 allow remote authenticated users to execute arbitrary commands via shell metacharacters in a filename to the upload_settings.cgi page. | |||||
| CVE-2020-35713 | 1 Linksys | 2 Re6500, Re6500 Firmware | 2020-12-28 | 10.0 HIGH | 9.8 CRITICAL |
| Belkin LINKSYS RE6500 devices before 1.0.012.001 allow remote attackers to execute arbitrary commands or set a new password via shell metacharacters to the goform/setSysAdm page. | |||||
| CVE-2020-26284 | 1 Gohugo | 1 Hugo | 2020-12-23 | 8.5 HIGH | 8.5 HIGH |
| Hugo is a fast and Flexible Static Site Generator built in Go. Hugo depends on Go's `os/exec` for certain features, e.g. for rendering of Pandoc documents if these binaries are found in the system `%PATH%` on Windows. In Hugo before version 0.79.1, if a malicious file with the same name (`exe` or `bat`) is found in the current working directory at the time of running `hugo`, the malicious command will be invoked instead of the system one. Windows users who run `hugo` inside untrusted Hugo sites are affected. Users should upgrade to Hugo v0.79.1. Other than avoiding untrusted Hugo sites, there is no workaround. | |||||
| CVE-2020-12522 | 1 Wago | 42 750-8101\/025-000, 750-8102\/025-000, 750-8202\/000-012 and 39 more | 2020-12-23 | 10.0 HIGH | 9.8 CRITICAL |
| The reported vulnerability allows an attacker who has network access to the device to execute code with specially crafted packets in WAGO Series PFC 100 (750-81xx/xxx-xxx), Series PFC 200 (750-82xx/xxx-xxx), Series Wago Touch Panel 600 Standard Line (762-4xxx), Series Wago Touch Panel 600 Advanced Line (762-5xxx), Series Wago Touch Panel 600 Marine Line (762-6xxx) with firmware versions <=FW10. | |||||
| CVE-2020-24581 | 1 D-link | 2 Dsl2888a, Dsl2888a Firmware | 2020-12-22 | 7.7 HIGH | 8.0 HIGH |
| An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU_2.31_V1.1.47ae55. It contains an execute_cmd.cgi feature (that is not reachable via the web user interface) that lets an authenticated user execute Operating System commands. | |||||
| CVE-2020-25618 | 1 Solarwinds | 1 N-central | 2020-12-21 | 9.0 HIGH | 8.8 HIGH |
| An issue was discovered in SolarWinds N-Central 12.3.0.670. The sudo configuration has incorrect access control because the nable web user account is effectively able to run arbitrary OS commands as root (i.e., the use of root privileges is not limited to specific programs listed in the sudoers file). | |||||
| CVE-2020-26274 | 1 Systeminformation | 1 Systeminformation | 2020-12-18 | 7.5 HIGH | 8.8 HIGH |
| In systeminformation (npm package) before version 4.31.1 there is a command injection vulnerability. The problem was fixed in version 4.31.1 with a shell string sanitation fix. | |||||
| CVE-2020-7789 | 1 Node-notifier Project | 1 Node-notifier | 2020-12-17 | 6.8 MEDIUM | 5.6 MEDIUM |
| This affects the package node-notifier before 9.0.0. It allows an attacker to run arbitrary commands on Linux machines due to the options params not being sanitised when being passed an array. | |||||
| CVE-2020-12148 | 1 Silver-peak | 22 Ecos, Nx-10700, Nx-11700 and 19 more | 2020-12-16 | 8.5 HIGH | 6.8 MEDIUM |
| A command injection flaw identified in the nslookup API in Silver Peak Unity ECOSTM (ECOS) appliance software could allow an attacker to execute arbitrary commands with the privileges of the web server running on the EdgeConnect appliance. An attacker could exploit this vulnerability to establish an interactive channel, effectively taking control of the target system. This vulnerability can be exploited by an attacker with authenticated access to the Orchestrator UI or EdgeConnect UI. This affects all ECOS versions prior to : 8.1.9.15, 8.3.0.8, 8.3.1.2, 8.3.2.0, 9.0.2.0, and 9.1.0.0. | |||||
| CVE-2020-12149 | 1 Silver-peak | 22 Ecos, Nx-10700, Nx-11700 and 19 more | 2020-12-16 | 8.5 HIGH | 6.8 MEDIUM |
| The configuration backup/restore function in Silver Peak Unity ECOSTM (ECOS) appliance software was found to directly incorporate the user-controlled config filename in a subsequent shell command, allowing an attacker to manipulate the resulting command by injecting valid OS command input. This vulnerability can be exploited by an attacker with authenticated access to the Orchestrator UI or EdgeConnect UI. This affects all ECOS versions prior to: 8.1.9.15, 8.3.0.8, 8.3.1.2, 8.3.2.0, 9.0.2.0, and 9.1.0.0. | |||||
| CVE-2020-5636 | 1 Necplatforms | 2 Aterm Sa3500g, Aterm Sa3500g Firmware | 2020-12-15 | 5.2 MEDIUM | 6.8 MEDIUM |
| Aterm SA3500G firmware versions prior to Ver. 3.5.9 allows an attacker with an administrative privilege to send a specially crafted request to a specific URL, which may result in an arbitrary command execution. | |||||
| CVE-2020-5635 | 1 Necplatforms | 2 Aterm Sa3500g, Aterm Sa3500g Firmware | 2020-12-15 | 5.8 MEDIUM | 8.8 HIGH |
| Aterm SA3500G firmware versions prior to Ver. 3.5.9 allows an attacker on the adjacent network to send a specially crafted request to a specific URL, which may result in an arbitrary command execution. | |||||
| CVE-2020-19142 | 1 Idreamsoft | 1 Icms | 2020-12-11 | 10.0 HIGH | 9.8 CRITICAL |
| iCMS 7 attackers to execute arbitrary OS commands via shell metacharacters in the DB_PREFIX parameter to install/install.php. | |||||
| CVE-2020-19527 | 1 Idreamsoft | 1 Icms | 2020-12-11 | 10.0 HIGH | 9.8 CRITICAL |
| iCMS 7.0.14 attackers to execute arbitrary OS commands via shell metacharacters in the DB_NAME parameter to install/install.php. | |||||
| CVE-2020-26838 | 1 Sap | 2 Business Warehouse, Bw\/4hana | 2020-12-10 | 9.0 HIGH | 9.1 CRITICAL |
| SAP Business Warehouse, versions - 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 782, and SAP BW4HANA, versions - 100, 200 allows an attacker authenticated with (high) developer privileges to submit a crafted request to generate and execute code without requiring any user interaction. It is possible to craft a request which will result in the execution of Operating System commands leading to Code Injection vulnerability which could completely compromise the confidentiality, integrity and availability of the server and any data or other applications running on it. | |||||
| CVE-2018-10900 | 2 Debian, Gnome | 2 Debian Linux, Network Manager Vpnc | 2020-12-04 | 7.2 HIGH | 7.8 HIGH |
| Network Manager VPNC plugin (aka networkmanager-vpnc) before version 1.2.6 is vulnerable to a privilege escalation attack. A new line character can be used to inject a Password helper parameter into the configuration data passed to VPNC, allowing an attacker to execute arbitrary commands as root. | |||||