Joyent Node.js macaddress module command injection vulnerability

Joyent Node.js is the United States Joyent company's set of built on Google V8 JavaScript engine on top of the web application platform. macaddress module is used in one of the Mac address management module. A command injection vulnerability exists in Joyent Node.js macaddress module versions pri...

GitLab: Vulnerability in project import leads to arbitrary command execution

Summary: A filename regular expression could be bypassed and enable the attacker to create a symbolic link in Gitlab upload directory by importing a specially crafted Gitlab export. Further more, Gitlab is designed to not delete project upload directory currently. So, the attacker could delete th...

PT-2018-3718

Name of the Vulnerable Software and Affected Versions Info-ZIP Zip version 3.0 Description The issue is related to the use of memory after it has been freed, which can allow a remote attacker to access confidential information or cause a denial of service. The vulnerability is associated with the...

Geutebruck 5.02024 G-Cam/EFD-2250 - simple_loglistjs.cgi Remote Command Execution Exploit

This Metasploit module exploits a an arbitrary command execution vulnerability. The vulnerability exists in the /uapi-cgi/viewer/simpleloglistjs.cgi page and allows an anonymous user to execute arbitrary commands with root privileges. Firmware 'Geutebruck simpleloglistjs.cgi Remote Command...

D-Link DSL-2750B OS Command Injection Vulnerability

The D-Link DSL-2750B is an ADSL router. An OS command injection vulnerability exists in the D-Link DSL-2750B. An attacker can exploit the vulnerability to execute arbitrary commands...

McAfee ePolicy Orchestrator CSV File Handling Arbitrary Command Execution (SB10227)

The remote host is running a version of McAfee ePolicy Orchestrator that contains a flaw that is triggered as user-supplied input passed via CSV files is not properly sanitized. This may allow a context- dependent attacker to potentially execute arbitrary commands. C Tenable Network Security, Inc...

Arbitrary Command Execution

topydo is vulnerable to arbitrary command execution attacks. The library does not sanitize any of the TODO texts that are passed to the command line, allowing a malicious user to pass arbitrary bytes to the command line by prepending the bytes with the \ character...

openSUSE: Security Advisory for go1.9 (openSUSE-SU-2018:1811-1)

The remote host is missing an update for the Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Multiple Cisco Products NX-OS Software Arbitrary Command Execution Vulnerability

Cisco MDS 9000 Series Multilayer Switches are products of Cisco Corporation.Cisco MDS 9000 Series Multilayer Switches is a 9000 series switch device.Nexus 2000 Series Fabric Extenders is a Nexus 2000 series switch array expander.NX-OS Software is the data center-class operating system software th...

TIBCO Data Virtualization Command Injection Vulnerability

TIBCO Data Virtualization formerly known as Cisco Information Server is the United States TIBCO Software, Inc. of a data virtualization suite Cisco Data Virtualization Suite is the basis of the Java-based information server. version version control adapters is one of the version control adapters....

CVE-2018-5428

The version control adapters component of TIBCO Data Virtualization formerly known as Cisco Information Server contains vulnerabilities that may allow for arbitrary command execution. Affected releases are TIBCO Data Virtualization: 7.0.5; 7.0.6...

CVE-2018-5428

The version control adapters component of TIBCO Data Virtualization formerly known as Cisco Information Server contains vulnerabilities that may allow for arbitrary command execution. Affected releases are TIBCO Data Virtualization: 7.0.5; 7.0.6...

Input validation

The version control adapters component of TIBCO Data Virtualization formerly known as Cisco Information Server contains vulnerabilities that may allow for arbitrary command execution. Affected releases are TIBCO Data Virtualization: 7.0.5; 7.0.6...

CVE-2018-5428

The CVE-2018-5428 issue affects the version control adapters component of TIBCO Data Virtualization (formerly Cisco Information Server). The vulnerability allows arbitrary command execution in releases 7.0.5 and 7.0.6 due to the underlying flaw in the adapters. CVSSv3 base score is 8.8 (HIGH) wit...

CVE-2018-5428 TIBCO Data Virtualization Command Injection Vulnerability

The version control adapters component of TIBCO Data Virtualization formerly known as Cisco Information Server contains vulnerabilities that may allow for arbitrary command execution. Affected releases are TIBCO Data Virtualization: 7.0.5; 7.0.6...

Cisco NX-OS Software Role-Based Access Arbitrary Command Execution Vulnerability

A vulnerability in the role-based access-checking mechanisms of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on an affected device. The vulnerability exists because the affected software lacks proper input and validation checks for certain file...

CVE-2018-9023

An input validation vulnerability in CA Privileged Access Manager 2.x allows unprivileged users to execute arbitrary commands by passing specially crafted arguments to the updatecrld script...

CVE-2018-9023

CA Privileged Access Manager 2.x contains an input validation vulnerability that allows unprivileged users to execute arbitrary commands by passing specially crafted parameters to the update_crld script. Affected component is CA Privileged Access Manager 2.x (update_crld script). Underlying cause...

Security Bulletin: IBM Tivoli Monitoring TEP Server vulnerabilities

Summary By default, communications between the Tivoli Enterprise Portal client and server are not encrypted which can cause the following vulnerabilities. Vulnerability Details CVEID: CVE-2017-1181 DESCRIPTION: IBM Tivoli Monitoring Portal client could allow a local attacker to gain elevated...

CVE-2017-3936

OS Command Injection vulnerability in McAfee ePolicy Orchestrator ePO 5.9.0, 5.3.2, 5.3.1, 5.1.3, 5.1.2, 5.1.1, and 5.1.0 allows attackers to run arbitrary OS commands with limited privileges via not sanitizing the user input data before exporting it into a CSV format output...