CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2019-10663
https://notcve.org/view.php?id=CVE-2019-10663
Grandstream UCM6204 before 1.0.19.20 devices allow remote authenticated users to conduct SQL injection attacks via the sord parameter in a listCodeblueGroup API call to the /cgi? URI. Grandstream UCM6204, en dispositivos con versiones anteriores a la 1.0.19.20, permite a los usuarios remotos autenticados realizar ataques de inyección SQL mediante el parámetro "sord" en una llamada API "listCodeblueGroup" en el URI "/cgi?". • https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=23920&dl=1 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.0EPSS: 0%CPEs: 2EXPL: 0CVE-2019-10662
https://notcve.org/view.php?id=CVE-2019-10662
Grandstream UCM6204 before 1.0.19.20 devices allow remote authenticated users to execute arbitrary code via shell metacharacters in the backupUCMConfig file-backup parameter to the /cgi? URI. Grandstream UCM6204, en dispositivos con versiones anteriores a la 1.0.19.20, permite a los usuarios remotos ejecutar código arbitrario mediante metacaracteres shell en el parámetro "backupUCMConfig file-backup" en el URI "/cgi?". • https://github.com/scarvell/grandstream_exploits https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=23920&dl=1 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 10.0EPSS: 0%CPEs: 2EXPL: 0CVE-2019-10661
https://notcve.org/view.php?id=CVE-2019-10661
On Grandstream GXV3611IR_HD before 1.0.3.23 devices, the root account lacks a password. En Grandstream GXV3611IR_HD, en dispositivos con versiones anteriores a la 1.0.3.23, la cuenta root carece de una contraseña. • https://github.com/scarvell/grandstream_exploits https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=23920&dl=1 • CWE-287: Improper Authentication •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2019-10660
https://notcve.org/view.php?id=CVE-2019-10660
Grandstream GXV3611IR_HD before 1.0.3.23 devices allow remote authenticated users to execute arbitrary code via shell metacharacters in the /goform/systemlog?cmd=set logserver field. Los dispositivos Grandstream GXV3611IR_HD, en versiones anteriores a la 1.0.3.23, permiten a los usuarios remotos ejecutar código arbitrario mediante metacaracteres shell en el campo "logserver" en /goform/systemlog?cmd=set. • https://github.com/scarvell/grandstream_exploits https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=23920&dl=1 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 0CVE-2019-10659
https://notcve.org/view.php?id=CVE-2019-10659
Grandstream GXV3370 before 1.0.1.41 and WP820 before 1.0.3.6 devices allow remote authenticated users to execute arbitrary code via shell metacharacters in a /manager?action=getlogcat priority field. Los dispositivos Grandstream GXV3370, en versiones anteriores a la 1.0.1.41, y Grandstream WP820, en versiones anteriores a la 1.0.3.6, permite a los usuarios remotos autenticados ejecutar código arbitrario mediante metacaracteres shell en un campo "priority" en /manager?action=getlogcat. • https://github.com/scarvell/grandstream_exploits https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=23920&dl=1 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •