12977 matches found
PT-2020-15665
Name of the Vulnerable Software and Affected Versions ShopXO version 1.8.1 Description The issue allows attackers to execute arbitrary commands, potentially leading to server control. Recommendations For ShopXO version 1.8.1, update to a newer version that contains a fix for this issue. At the...
Design/Logic Flaw
In Nim 1.2.4, the standard library browsers mishandles the URL argument to browsers.openDefaultBrowser. This argument can be a local file path that will be opened in the default explorer. An attacker can pass one argument to the underlying open command to execute arbitrary registered system...
CVE-2020-15692
In Nim 1.2.4, the standard library browsers mishandles the URL argument to browsers.openDefaultBrowser. This argument can be a local file path that will be opened in the default explorer. An attacker can pass one argument to the underlying open command to execute arbitrary registered system...
PT-2020-14587
Name of the Vulnerable Software and Affected Versions Nim version 1.2.4 Description The standard library browsers in Nim mishandle the URL argument to browsers.openDefaultBrowser, allowing an attacker to pass an argument to the underlying open command and execute arbitrary registered system...
PT-2020-14743
Name of the Vulnerable Software and Affected Versions VNG Zalo Desktop version 19.8.1.0 Description An issue was discovered in Zalo.exe that allows an attacker to run arbitrary commands on a remote Windows machine running the Zalo client. This can be achieved by sending the user of the device a...
Arbitrary Command Execution
spamassassin is vulnerable to command execution. The vulnerability exists as crafted nefarious Configuration .cf files can be configured to run system commands similar to CVE-2018-11805...
PT-2020-5338
Name of the Vulnerable Software and Affected Versions D-Link DSR-250 version 3.17 D-Link DSR-150 affected versions not specified D-Link DSR-150N affected versions not specified D-Link DSR-250N affected versions not specified D-Link DSR-500 affected versions not specified D-Link DSR-500N affected...
Exploit for OS Command Injection in Pi-Hole
CVE 2020-8816 : Pi-holehttps://f...
CVE-2020-5609
Directory traversal vulnerability in CAMS for HIS CENTUM CS 3000 includes CENTUM CS 3000 Small R3.08.10 to R3.09.50, CENTUM VP includes CENTUM VP Small, Basic R4.01.00 to R6.07.00, B/M9000CS R5.04.01 to R5.05.01, and B/M9000 VP R6.01.01 to R8.03.01 allows a remote unauthenticated attacker to crea...
CVE-2020-5609: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in CAMS for HIS CENTUM CS 3000 includes CENTUM CS 3000 Small R3.08.10 to R3.09.50, CENTUM VP includes CENTUM VP Small, Basic R4.01.00 to R6.07.00, B/M9000CS R5.04.01 to R5.05.01, and B/M9000 VP R6.01.01 to R8.03.01 allows a remote unauthenticated attacker to crea...
PT-2020-10164
Name of the Vulnerable Software and Affected Versions Wowza Streaming Engine versions prior to 4.8.5 Description The issue concerns insecure permissions in the Linux version of the server, potentially allowing a local attacker to escalate privileges by writing arbitrary commands in any file and...
PT-2020-19721
Name of the Vulnerable Software and Affected Versions Gerapy versions 0 through 0.9.3 Description The issue arises from unsanitized input being passed to Popen via the "project configure" endpoint. Recommendations For Gerapy versions 0 through 0.9.3, update to version 0.9.3 or later to resolve th...
CVE-2020-14487: Hidden Functionality
OpenClinic GA 5.09.02 contains a hidden default user account that may be accessed if an administrator has not expressly turned off this account, which may allow an attacker to login and execute arbitrary commands...
CVE-2020-14493: Execution with Unnecessary Privileges
A low-privilege user may use SQL syntax to write arbitrary files to the OpenClinic GA 5.09.02 and 5.89.05b server, which may allow the execution of arbitrary commands...
PT-2020-14035
Name of the Vulnerable Software and Affected Versions OpenClinic GA version 5.09.02 Description The issue concerns a hidden default user account in OpenClinic GA. If an administrator has not explicitly disabled this account, it may be accessed by an attacker, potentially allowing them to log in a...
D-Link DSL-7740C Operating System Command Injection Vulnerability
The D-Link DSL-7740C is a modem from AUO D-Link of Taiwan, China. An operating system command injection vulnerability exists in the D-Link DSL-7740C, which originates when the program does not properly validate user input. An attacker could exploit the vulnerability to inject arbitrary commands...
Code Injection in swooningfish/ffmpeg-web-gui
Description The ffmpeg-web-gui project is a simple video converter written in PHP which uses the ffmpeg command to convert videos in HTML formats. The issue arises at the following line: https://github.com/swooningfish/ffmpeg-web-gui/blob/master/upload-and-convert.phpL176. The arbitrary command...
Nagios XI Arbitrary Command Execution Vulnerability (CNVD-2020-64267)
Nagios XI is a suite of IT infrastructure monitoring solutions from the US-based Nagios. The solution supports monitoring and alerting of applications, services, operating systems and more. An arbitrary command execution vulnerability exists in the ajaxhelper.php file in Nagios XI versions prior ...
