CVE-2019-15498: Improper Neutralization of Argument Delimiters in a Command

cgi-bin/cmh/webcam.sh in Vera Edge Home Controller 1.7.4452 allows remote unauthenticated users to execute arbitrary OS commands via --output argument injection in the username parameter to /cgi-bin/cmh/webcam.sh...

Linux/x86_64 - AVX2 XOR Decoder + execve(/bin/sh) Shellcode (62 bytes)

/ ; Title : Linux/x8664 - AVX2 XOR Decoder + execve"/bin/sh" 62 bytes ; Author : Gonçalo Ribeiro @goncalor ; Website : goncalor.com ; SLAE64-ID : 1635 ; this only works on machines with a CPU that supports AVX2 instructions global start start: jmp calldecoder decoder: pop rsi lea rdi, rsi+1 ;...

CVE-2019-15119

lib/install/install.go in cnlh nps through 0.23.2 uses 0777 permissions for /usr/local/bin/nps and/or /usr/bin/nps, leading to a file overwrite by a local user...

PT-2019-13998 · Cnlh · Nps

Name of the Vulnerable Software and Affected Versions: cnlh nps versions 0.23.2 and earlier Description: The issue arises from the use of 0777 permissions for /usr/local/bin/nps and/or /usr/bin/nps in lib/install/install.go, allowing a local user to overwrite files. Recommendations: For versions...

The vulnerability of the FortiOS operating system, related to access control errors, allows a perpetrator to execute arbitrary code.

The vulnerability of the FortiOS operating system is related to access control errors. Exploiting this vulnerability allows a person with administrator privileges to execute arbitrary code by creating a symbolic link to an executable file in the “/bin/” directory...

radare2 Command Injection Vulnerability

radare2 is a set of libraries and tools for working with binary files. A command injection vulnerability exists in the 'binsymbols' function in the libr/core/cbin.c file in versions of radare2 prior to 3.7.0, which arises from a networked system or product that does not correctly filter special...

CVE-2019-14745

In radare2 before 3.7.0, a command injection vulnerability exists in binsymbols in libr/core/cbin.c. By using a crafted executable file, it's possible to execute arbitrary shell commands with the permissions of the victim. This vulnerability is due to improper handling of symbol names embedded in...

CVE-2019-14745

In radare2 before 3.7.0, a command injection vulnerability exists in binsymbols in libr/core/cbin.c. By using a crafted executable file, it's possible to execute arbitrary shell commands with the permissions of the victim. This vulnerability is due to improper handling of symbol names embedded in...

DEBIAN-CVE-2019-10167

The virConnectGetDomainCapabilities libvirt API, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accepts an "emulatorbin" argument to specify the program providing emulation for a domain. Since v1.2.19, libvirt will execute that program to probe the domain's capabilities. Read-only clients...

CVE-2016-10838

cPanel before 11.54.0.4 allows arbitrary file-read operations via the bin/fmq script SEC-70...

CVE-2016-10838

cPanel before 11.54.0.4 allows arbitrary file-read operations via the bin/fmq script SEC-70...

Sql injection

cPanel before 11.54.0.4 allows SQL injection in bin/hordeupdateusernames SEC-71...

CVE-2016-10838

cPanel before 11.54.0.4 allows arbitrary file-read operations via the bin/fmq script SEC-70...

CVE-2016-10841

The bin/mkvhostspasswd script in cPanel before 11.54.0.4 discloses password hashes SEC-73...

CVE-2016-10838: Improper Access Control

cPanel before 11.54.0.4 allows arbitrary file-read operations via the bin/fmq script SEC-70...

CVE-2016-10841: Undefined Security Weakness

The bin/mkvhostspasswd script in cPanel before 11.54.0.4 discloses password hashes SEC-73...

PT-2019-7637

Name of the Vulnerable Software and Affected Versions cPanel versions prior to 11.54.0.4 Description The issue concerns the disclosure of password hashes due to a problem in the bin/mkvhostspasswd script. Recommendations For versions prior to 11.54.0.4, update to version 11.54.0.4 or later to...

CVE-2016-10842: Improper Input Validation

cPanel before 11.54.0.4 allows certain file-read operations in bin/setupglobalspamfilter.pl SEC-74...

PT-2019-7635

Name of the Vulnerable Software and Affected Versions cPanel versions prior to 11.54.0.4 Description The issue allows SQL injection in the bin/horde update usernames script. Recommendations For versions prior to 11.54.0.4, update to version 11.54.0.4 or later to resolve the issue...

PT-2019-13619

Name of the Vulnerable Software and Affected Versions D-Link 6600-AP and DWL-3600AP Ax version 4.2.0.14 Description An issue was discovered that allows escaping to a shell in the restricted command line interface. This can be achieved by using the sequence /bin/sh -c wget. Recommendations For...