Posts Tagged ‘command’

Alienvault OSSIM av-centerd Util.pm sync_rserver Command Execution

This Metasploit module exploits a command injection vulnerability found within the sync_rserver function in Util.pm. The vulnerability is triggered due to an incomplete blacklist during the parsing of the $uuid parameter. This allows for the escaping of a system command allowing for arbitrary command execution as root. Source: Alienvault OSSIM av-centerd Util.pm sync_rserver Command Execution


QNAP Transcode Server Command Execution

This Metasploit module exploits an unauthenticated remote command injection vulnerability in QNAP NAS devices. The transcoding server listens on port 9251 by default and is vulnerable to command injection using the ‘rmfile’ command. This Metasploit module was tested successfully on a QNAP TS-431 with firmware version 4.3.3.0262 (20170727). Source: QNAP Transcode Server Command Execution


REDDOXX Appliance Remote Command Execution

RedTeam Pentesting discovered a remote command execution vulnerability in the REDDOXX appliance software, which allows attackers to execute arbitrary command with root privileges while unauthenticated. Affected versions include build 2032 and 2.0.625. Source: REDDOXX Appliance Remote Command Execution