PT-2020-10391

Name of the Vulnerable Software and Affected Versions The MojoHaus Exec Maven plugin version 1.1.1 Description The issue allows code execution via a crafted XML document. This is possible because a configuration element, within a plugin element, can specify an arbitrary program in an executable...

HomeAutomation 3.3.2 - Remote Code Execution Vulnerability

Exploit for php platform in category web applications Exploit: HomeAutomation 3.3.2 - Remote Code Execution Author: LiquidWorm Vendor: Tom Rosenback and Daniel Malmgren Product web page: http://karpero.mine.nu/ha/ Affected version: 3.3.2 Tested on: Apache/2.4.41 centos OpenSSL/1.0.2k-fips Advisor...

CVE-2019-10758

mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the toBSON method. A misuse of the vm dependency to perform exec commands in a non-safe environment...

CVE-2019-10758

mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the toBSON method. A misuse of the vm dependency to perform exec commands in a non-safe environment...

CVE-2019-10758

MongoDB mongo-express ≤0.53.x is vulnerable to Remote Code Execution via endpoints using toBSON, due to unsafe use of the vm module to run exec commands. Affected component: mongo-express server-side routes that invoke toBSON. Root cause: misusing vm to execute commands in a non-safe environment....

CVE-2019-10758: Improper Control of Generation of Code

mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the toBSON method. A misuse of the vm dependency to perform exec commands in a non-safe environment...

Updated libvirt packages fix security vulnerabilities

Updated libvirt packages fix security vulnerabilities: An information leak which allowed to retrieve the guest hostname under readonly mode CVE-2019-3886. Wrong permissions in systemd admin-sock due to missing SocketMode parameter CVE-2019-10132. Arbitrary file read/exec via...

Cisco IOS XE Software Privileged EXEC Mode Root Shell Access (cisco-sa-20180926-privesc)

According to its self-reported version, Cisco IOS XE Software is affected by a vulnerability in the CLI parser due to the affected software improperly sanitizing command arguments to prevent modifications to the underlying Linux file system on a device. An authenticated, local attacker who has...

PT-2019-4115

Name of the Vulnerable Software and Affected Versions Zyxel GS1900 devices with firmware before 2.50AAHH.0C0 Description An issue exists due to a lack of input validation in the cmd sys traceroute exec, cmd sys arp clear, and cmd sys ping exec functions in the libclicmd.so library. This could all...

CVE-2002-2444

CVE-2002-2444 affects Snoopy prior to 2.0.0, with a security hole in exec cURL. The initial entry reports CVSS v2 base score 7.5 (HIGH) and CVSS v3.1 base score 9.8 (CRITICAL). No exploitation details or remediation are provided in the connected documents.

CVE-2002-2444

Snoopy before 2.0.0 has a security hole in exec cURL...

CVE-2019-16663

An issue was discovered in rConfig 3.9.2. An attacker can directly execute system commands by sending a GET request to search.crud.php because the catCommand parameter is passed to the exec function without filtering, which can lead to command execution...

Command injection

An issue was discovered in rConfig 3.9.2. An attacker can directly execute system commands by sending a GET request to ajaxServerSettingsChk.php because the rootUname parameter is passed to the exec function without filtering, which can lead to command execution...

CVE-2002-2444: Improper Input Validation

Snoopy before 2.0.0 has a security hole in exec cURL...

PT-2019-6471

Name of the Vulnerable Software and Affected Versions Snoopy versions prior to 2.0.0 Description The issue is related to a security hole in the exec cURL functionality. Recommendations For versions prior to 2.0.0, update to version 2.0.0 or later to resolve the issue...

CVE-2019-16663: Improper Neutralization of Special Elements used in an OS Command

An issue was discovered in rConfig 3.9.2. An attacker can directly execute system commands by sending a GET request to search.crud.php because the catCommand parameter is passed to the exec function without filtering, which can lead to command execution...

Sourcecodester Restaurant Management System Cross-Site Request Forgery Vulnerability

Sourcecodester Restaurant Management System is a restaurant management system. A cross-site request forgery vulnerability exists in the admin/staff-exec.php file in version 1.0 of the Sourcecodester Restaurant Management System, which originates from a WEB application that does not adequately...

CVE-2019-16662: Improper Neutralization of Special Elements used in an OS Command

An issue was discovered in rConfig 3.9.2. An attacker can directly execute system commands by sending a GET request to ajaxServerSettingsChk.php because the rootUname parameter is passed to the exec function without filtering, which can lead to command execution...

CVE-2019-18414

Sourcecodester Restaurant Management System 1.0 is affected by an admin/staff-exec.php Cross Site Request Forgery vulnerability due to a lack of CSRF protection. This could lead to an attacker tricking the administrator into executing arbitrary code or adding a staff entry via a crafted HTML page...

GHSA-549F-73HH-MJ38 Command Injection in gitlabhook

All versions of gitlabhook are vulnerable to Command Injection. The package does not validate input the body of POST request and concatenates it to an exec call, allowing attackers to run arbitrary commands in the system. Recommendation No fix is currently available. Consider using an alternative...