CVE-2020-5242 openHAB exec add-ons allow remote arbitrary command execution

openHAB before 2.5.2 allow a remote attacker to use REST calls to install the EXEC binding or EXEC transformation service and execute arbitrary commands on the system with the privileges of the user running openHAB. Starting with version 2.5.2 all commands need to be whitelisted in a local file...

CVE-2020-5242

openHAB prior to 2.5.2 is affected. A remote attacker can use REST calls to install the EXEC binding or EXEC transformation service and execute arbitrary commands with the privileges of the openHAB user. The root cause is lack of proper enforcement of command installation via REST until 2.5.2. Fi...

CVE-2019-5242

CVE-2019-5242 is a Huawei PCManager driver vulnerability affecting PCManager versions older than 9.0.1.50. The Huawei PCManager HwOs2Ec10x64.sys watchdog IoDevice exposes an IOCTL path that, when accessed by a user-controlled process, can map arbitrary physical memory into user space with RW perm...

Security Advisory - Two Vulnerabilities in Huawei PCManager Product

There is a privilege escalation vulnerability in Huawei PCManager product. Successful exploitation may cause the attacker to obtain a higher privilege. Vulnerability ID: HWPSIRT-2018-11141 This vulnerability has been assigned a Common Vulnerabilities and Exposures CVE ID: CVE-2019-5241. There is ...

CVE-2018-5242

Affected product: Norton App Lock. Version pre-1.3.0.329 is vulnerable to a bypass that can allow a user to bypass the app and prevent locking, potentially gaining device access. Remediation: update to version 1.3.0.329 or later. This summary reflects details available in connected sources; no fu...

CVE-2017-5242: Nexpose/InsightVM Virtual Appliance Duplicate SSH Host Key

Today, Rapid7 is notifying Nexpose and InsightVM users of a vulnerability that affects certain virtual appliances. While this issue is relatively low severity, we want to make sure that our customers have all the information they need to make informed security decisions regarding their networks. ...

Debian DSA-3633-1 : xen - security update (Bunker Buster)

Multiple vulnerabilities have been discovered in the Xen hypervisor. The Common Vulnerabilities and Exposures project identifies the following problems : - CVE-2015-8338 Julien Grall discovered that Xen on ARM was susceptible to denial of service via long running memory operations. - CVE-2016-448...

[SECURITY] [DSA 3633-1] xen security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3633-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff July 27, 2016 https://www.debian.org/security/faq -...

DSA-3633-1 xen - security update

Bulletin has no description...

CVE-2016-5242

The p2mteardown function in arch/arm/p2m.c in Xen 4.4.x through 4.6.x allows local guest OS users with access to the driver domain to cause a denial of service NULL pointer dereference and host OS crash by creating concurrent domains and holding references to them, related to VMID exhaustion...

CVE-2016-5242

Observation: CVE-2016-5242 affects the Xen hypervisor. Affected component/version: the p2m_teardown function in arch/arm/p2m.c, impacting Xen 4.4.x through 4.6.x. Root cause/impact: local guest OS users who have access to the driver domain can trigger a NULL pointer dereference by creating concur...

CVE-2015-5242

CVE-2015-5242 affects OpenStack Swift-on-File (swiftonfile). The issue arises from loading metadata with Python’s pickle without proper restrictions, enabling a remote authenticated user to execute arbitrary code via crafted xattrs. Documented impact is remote code execution on the storage node; ...

RHEL 6 / 7 : swiftonfile (RHSA-2015:1918)

The remote Redhat Enterprise Linux 6 / 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2015:1918 advisory. Red Hat Gluster Storage is a software only scale-out storage solution that provides flexible and affordable unstructured data storage. It unifies...

Important: Red Hat Security Advisory: swiftonfile security update

An updated swiftonfile package that fixes one security issue is now available for Red Hat Gluster Storage 3.1 for Red Hat Enterprise Linux 6 and 7. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System CVSS base score, which give...

WordPress MiwoFTP Plugin 1.0.5 CSRF Arbitrary File Creation Exploit (RCE)

Summary MiwoFTP is a smart, fast and lightweight file manager plugin that operates from the back-end of WordPress. Description MiwoFTP WP Plugin suffers from a cross-site request forgery remote code execution vulnerability. The application allows users to perform certain actions via HTTP requests...

CVE-2012-5242

Directory traversal vulnerability in functions/suggest.php in Banana Dance B.2.6 and earlier allows remote attackers to include and execute arbitrary local files via a .. dot dot in the name parameter in a gettemplate action...

CVE-2012-5242

Banana Dance (Product: Banana Dance; Vendor: bananadance.org) is affected by CVE-2012-5242 and related issues in B.2.6 and earlier. The root causes include: PHP File Inclusion in functions/ajax.php/get_template flow and Directory Traversal via name parameter in get_template action; Improper Acces...

CVE-2012-5242

Directory traversal vulnerability in functions/suggest.php in Banana Dance B.2.6 and earlier allows remote attackers to include and execute arbitrary local files via a .. dot dot in the name parameter in a gettemplate action...

Fedora 20 : mediawiki-1.23.2-1.fc20 (2014-9583)

This is a major update from the 1.21 branch to the 1.23 long term support branch. - bug 68187 SECURITY: Prepend jsonp callback with comment. - CVE-2014-5241 - bug 66608 SECURITY: Fix for XSS issue in bug 66608: Generate the URL used for loading a new page in JavaScript,instead of relying on the U...

CVE-2014-5242

Cross-site scripting XSS vulnerability in mediawiki.page.image.pagination.js in MediaWiki 1.22.x before 1.22.9 and 1.23.x before 1.23.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving the multipageimagenavbox class in conjunction with an action=raw value...