Command injection

A local arbitrary command execution vulnerability in HPE System Management Homepage for Windows and Linux version prior to v7.6.1 was found...

Design/Logic Flaw

A local arbitrary execution of commands vulnerability in HPE System Management Homepage for Windows and Linux version prior to v7.6.1 was found...

NewsBee CMS SQL Injection Vulnerability

NewsBee CMS is a news website CMS Content Management System. A SQL injection vulnerability exists in NewsBee CMS. A remote attacker can exploit this vulnerability to execute arbitrary SQL commands...

USN-3515-1 ruby1.9.1, ruby2.0, ruby2.3 vulnerability

It was discovered that Ruby allows FTP command injection. An attacker could use this to cause arbitrary command execution...

Cross site scripting

ELabftw version 1.7.8 is vulnerable to stored cross-site scripting in the experiment infos component resulting in arbitrary execution of JavaScript and denial of service...

CVE-2017-1000478

ELabftw version 1.7.8 is vulnerable to stored cross-site scripting in the experiment infos component resulting in arbitrary execution of JavaScript and denial of service...

Zivif PR115-204-P-RS Remote Command Injection Vulnerability

The Zivif PR115-204-P-RS is a webcam device. A remote command injection vulnerability exists in Zivif PR115-204-P-RS version 2.3.4.2103. A remote attacker can exploit this vulnerability to inject arbitrary commands...

ruby -- Command injection vulnerability in Net::FTP

Etienne Stalmans from the Heroku product security team reports: There is a command injection vulnerability in Net::FTP bundled with Ruby. Net::FTPget, getbinaryfile, gettextfile, put, putbinaryfile, and puttextfile use Kernelopen to open a local file. If the localfile argument starts with the pip...

CVE-2016-7066

It was found that the improper default permissions on /tmp/auth directory in EAP 7 can allow any local user to connect to CLI and allow the user to execute any arbitrary operations...

CVE-2017-12339

A vulnerability in the CLI of Cisco NX-OS System Software could allow an authenticated, local attacker to perform a command injection attack. The vulnerability is due to insufficient input validation of command arguments to the CLI parser. An attacker could exploit this vulnerability by injecting...

QEMU - NBD Server Long Export Name Stack Buffer Overflow

Introduced in commit f37708f6b8 2.10. The NBD spec says a client can request export names up to 4096 bytes in length, even though they should not expect success on names longer than 256. However, qemu hard-codes the limit of 256, and fails to filter out a client that probes for a longer name; the...

CVE-2017-1001004

typed-function before 0.10.6 had an arbitrary code execution in the JavaScript engine. Creating a typed function with JavaScript code in the name could result arbitrary execution...

CVE-2017-1001002

math.js before 3.17.0 had an arbitrary code execution in the JavaScript engine. Creating a typed function with JavaScript code in the name could result arbitrary execution...

Design/Logic Flaw

math.js before 3.17.0 had an arbitrary code execution in the JavaScript engine. Creating a typed function with JavaScript code in the name could result arbitrary execution...

Design/Logic Flaw

typed-function before 0.10.6 had an arbitrary code execution in the JavaScript engine. Creating a typed function with JavaScript code in the name could result arbitrary execution...

CVE-2017-1001004

typed-function before 0.10.6 had an arbitrary code execution in the JavaScript engine. Creating a typed function with JavaScript code in the name could result arbitrary execution...

CVE-2017-1001004

typed-function before 0.10.6 had an arbitrary code execution in the JavaScript engine. Creating a typed function with JavaScript code in the name could result arbitrary execution...

CVE-2017-1000220

soyuka/pidusage =1.1.4 is vulnerable to command injection in the module resulting in arbitrary command execution...

IBM Security Access Manager Appliance Command Injection Vulnerability

IBM Security Access Manager Appliance is an application for information security management from IBM, USA. The program enables access management control through an integrated appliance for web, mobile and cloud computing. A command injection vulnerability exists in IBM Security Access Manager...

Confire config.py File Arbitrary Command Execution Vulnerability

Confire is a set of application configuration tools built on Scapy, Django and other configuration parsers. A security vulnerability in the YAML parsing function of the config.py file in Confire version 0.2.0 stems from the program using the 'yaml.load' function to load user-specific configuratio...