Security Bulletin: A security vulnerability in Node.js nodemailer module affects IBM Cloud Automation Manager.

Summary A security vulnerability in Node.js nodemailer module affects IBM Cloud Automation Manager. Vulnerability Details CVEID: CVE-2020-7769 DESCRIPTION: Nodejs could allow a remote attacker to execute arbitrary commands on the system, caused by improper input validation by the recipient email...

Blue Coat ASG Command Injection (CVE-2016-9091)

A command execution vulnerability exists in Blue Coat Advanced Secure Gateway. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

Command Execution Vulnerability in XAMPP for Windows

XAMPP is a free open source cross-platform Web server solution stack package developed by Apache Friends. A command execution vulnerability exists in XAMPP for Windows. An attacker can use this vulnerability to execute arbitrary commands leading to elevation of privilege...

The vulnerability of the “xopen(filepath)” function in the application for working with xopen files in npm allows a hacker to execute arbitrary operating system commands.

The vulnerability of the “xopenfilepath” function in the application for working with xopen files in npm exists because measures to neutralize special elements used in the operating system command have not been taken. Exploiting this vulnerability allows a malicious actor to execute arbitrary...

Remote Code Execution (RCE)

Smarty is vulnerable to remote code execution. The library does not properly handle the illegal function names in function name='blah'/function, allowing a malicious user to inject and execute arbitrary commands...

Huawei EulerOS: Security Advisory for bzr (EulerOS-SA-2021-1283)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

WordPress wpDataTables Plugin SQL Injection (CVE-2021-26754)

An SQL injection vulnerability exists in WordPress wpDataTables Plugin. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system...

Huawei EulerOS: Security Advisory for cifs-utils (EulerOS-SA-2021-1284)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Command Execution Vulnerability in Riptide Networks NBR Routers

Ltd. is a company mainly engaged in information system integration services; Internet virtual private network services; Internet management services and other items. A command execution vulnerability exists in Ruijie Networks NBR routers, which can be exploited by an attacker to execute arbitrary...

Belkin Linksys WRT160NL Command Injection (CVE-2021-25310)

A command injection vulnerability exists in Belkin Linksys WRT160NL. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

D-Link DNS-320 Command Injection (CVE-2020-25506)

A command injection vulnerability exists in D-Link DNS-320. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

D-Link DSR-250 Command Injection (CVE-2020-18568)

A command injection vulnerability exists in D-Link DSR-250. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

LiteSpeed Web Server Enterprise Command Injection

A command injection vulnerability exists in LiteSpeed Web Server Enterprise. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

CVE-2021-22855

The specific function of HR Portal of Soar Cloud System accepts any type of object to be deserialized. Attackers can send malicious serialized objects to execute arbitrary commands...

CVE-2021-22855

CVE-2021-22855 affects the HR Portal of Soar Cloud System, where the deserialization function accepts any object type, enabling execution of arbitrary commands. According to NVD data, this is a remote, high-severity issue (CVSS v3.1: 9.8, CRITICAL; CVSS v2.0: 7.5, HIGH) with network access, low a...

CVE-2021-22858

Attackers can access the CGE account management function without privilege for permission elevation and execute arbitrary commands or files after obtaining user permissions...

CVE-2021-22858

Attackers can access the CGE account management function without privilege for permission elevation and execute arbitrary commands or files after obtaining user permissions...

Design/Logic Flaw

Attackers can access the CGE account management function without privilege for permission elevation and execute arbitrary commands or files after obtaining user permissions...

CVE-2021-22858

CVE-2021-22858 relates to ChanGate Enterprise Co., Ltd (CGE) property management system. The connected documents indicate a broken authentication/privilege-elevation flaw in the CGE account management function, enabling attackers to access the function without proper privileges and execute arbitr...

CVE-2021-22858 ChanGate EnterPrise Co., Ltd property management system - Broken Authentication

Attackers can access the CGE account management function without privilege for permission elevation and execute arbitrary commands or files after obtaining user permissions...