CVE-2020-25483

An arbitrary command execution vulnerability exists in the fopen function of file writes of UCMS v1.4.8, where an attacker can gain access to the server...

Command injection

An arbitrary command execution vulnerability exists in the fopen function of file writes of UCMS v1.4.8, where an attacker can gain access to the server...

CVE-2020-25483

An arbitrary command execution vulnerability exists in the fopen function of file writes of UCMS v1.4.8, where an attacker can gain access to the server...

CVE-2020-25483

UCMS v1.4.8 contains an arbitrary command execution vulnerability in the fopen() function used for file writes. The issue stems from UCMS’s handling of file writes, enabling an attacker to gain access to the server. Public references from NVD, Red Hat, CNVD and others corroborate the vulnerabilit...

CVE-2019-14719

Verifone MX900 series Pinpad Payment Terminals with OS 30251000 allow multiple arbitrary command injections, as demonstrated by the file manager...

CVE-2019-14718

Verifone MX900 series Pinpad Payment Terminals with OS 30251000 have Insecure Permissions, with resultant svcnetcontrol arbitrary command injection and privilege escalation...

CVE-2019-14719

CVE-2019-14719 affects Verifone MX900 series Pinpad Payment Terminals running OS 30251000, where the file manager enables multiple arbitrary command injections due to the underlying issue described in the CVE. The vulnerability is documented with local attack vector and high impact on confidentia...

CVE-2020-25483: Unrestricted Upload of File with Dangerous Type

An arbitrary command execution vulnerability exists in the fopen function of file writes of UCMS v1.4.8, where an attacker can gain access to the server...

PT-2020-16095

Name of the Vulnerable Software and Affected Versions UCMS version 1.4.8 Description An arbitrary command execution issue exists in the fopen function of file writes, allowing an attacker to gain access to the server. Recommendations For UCMS version 1.4.8, consider restricting access to the fope...

CVE-2019-14718: Incorrect Default Permissions

Verifone MX900 series Pinpad Payment Terminals with OS 30251000 have Insecure Permissions, with resultant svcnetcontrol arbitrary command injection and privilege escalation...

HPESBNW04051 rev.2 - Aruba AirWave Glass, Multiple Vulnerabilities

Potential Security Impact: Remote: Escalation of Privilege, Execution of Arbitrary Commands, Unauthenticated Arbitrary Code Execution, Unauthorized Access, Server-Side Request Forgery SSRF SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. Aruba Airwave Software - Prior to 1.3.2 CVSS...

CloudBees Jenkins Selection tasks Plugin Arbitrary Command Execution Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company a set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing project and some timed execution of the task . Jenkins Selection tasks Plugi...

PT-2020-6039

Name of the Vulnerable Software and Affected Versions Exim versions prior to 4.94.2 Description The issue is related to insufficient input validation in the Exim message relay agent, which can be exploited to bypass security restrictions and execute arbitrary commands. Local users can alter the...

Arbitrary Command Execution

vim is vulnerable to arbitrary command execution. An attacker is able to bypass the rvim restricted mode and execute arbitrary OS commands via scripting interfaces...

PT-2020-16247

Name of the Vulnerable Software and Affected Versions Qualcomm QCMAP software suite versions prior to October 2020 Description The QCMAP CLI utility in the Qualcomm QCMAP software suite has an issue where it uses a system call without validating the input when handling a SetGatewayUrl request. Th...

CVE-2020-4689: Improper Neutralization of Formula Elements in a CSV File

IBM Security Guardium 11.2 is vulnerable to CVS Injection. A remote privileged attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-ForceID: 186696...

IBM QRadar Untrusted Data Deserialization Vulnerability

IBM QRadar SIEM is an IBM USA solution that utilizes security intelligence to protect assets and information from advanced threats. The solution provides oversight of the entire scope of the IT architecture, generates detailed reports on data access and user activity, and more. An untrustworthy...

Nord Security: Possible RCE through Windows Custom Protocol on Windows client

Summary: The NordVPN windows client application registered two custom protocols NordVPN: and NordVPN.Notification: for process communication. This makes us are able to communicate with NordVPN.exe from web browser. After looking the executable binary, I noticed the class...

Ubuntu: Security Advisory (USN-4569-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2020-26124: Improper Control of Generation of Code

openmediavault before 4.1.36 and 5.x before 5.5.12 allows authenticated PHP code injection attacks, via the sortfield POST parameter of rpc.php, because jsonencodesafe is not used in config/databasebackend.inc. Successful exploitation allows arbitrary command execution on the underlying operating...