Vulnerability Spotlight: MySQL Multi-Master Manager Remote Command Injection Vulnerability

Discovered by Matthew Van Gundy of Asig Overview Today, Talos is releasing details of a new vulnerability within MySQL Multi-Master Manager. This is used to perform monitoring, failover and management of MySQL master-master replication configurations. By using MySQL MMM Multi-Master Replication...

Multi-Master Replication Manager for MySQL mmm_agentd Remote Command Injection Vulnerabilities

Summary Multiple exploitable remote command injection vulnerabilities exist in the MySQL Master-Master Replication Manager MMM mmmagentd daemon 2.2.1. mmmagentd commonly runs with root privileges and does not require authentication by default. A specially crafted MMM protocol message can cause a...

The vulnerability of the VBWinExec function in the software for remote monitoring of Advantech WebAccess allows a hacker to execute arbitrary commands on the operating system.

The vulnerability of the VBWinExec function Node\AspVBObj.dll in the software for remote monitoring of Advantech WebAccess is related to the failure to take measures to neutralize special elements used in operating system commands. Exploiting this vulnerability allows a malicious actor to execute...

SUSE SLED12 / SLES12 Security Update : patch (SUSE-SU-2018:1128-1)

This update for patch fixes the following issues: Security issues fixed : - CVE-2018-1000156: Malicious patch files cause ed to execute arbitrary commands bsc1088420. - CVE-2018-6951: Fixed NULL pointer dereference in the intuitdifftype function in pch.c bsc1080918. - CVE-2016-10713: Fixed...

CVE-2018-8938

A Code Injection issue was discovered in DlgSelectMibFile.asp in Ipswitch WhatsUp Gold before 2018 18.0. Malicious actors can inject a specially crafted SNMP MIB file that could allow them to execute arbitrary commands and code on the WhatsUp Gold server...

CVE-2018-8938

A Code Injection issue was discovered in DlgSelectMibFile.asp in Ipswitch WhatsUp Gold before 2018 18.0. Malicious actors can inject a specially crafted SNMP MIB file that could allow them to execute arbitrary commands and code on the WhatsUp Gold server...

CVE-2018-8938

A Code Injection issue was discovered in DlgSelectMibFile.asp in Ipswitch WhatsUp Gold before 2018 18.0. Malicious actors can inject a specially crafted SNMP MIB file that could allow them to execute arbitrary commands and code on the WhatsUp Gold server...

CVE-2018-5234

The Norton Core router prior to v237 may be susceptible to a command injection exploit. This is a type of attack in which the goal is execution of arbitrary commands on the host system via vulnerable software...

Belkin N750 Arbitrary Command Execution Vulnerability

Belkin N750 is a wireless router product. The Belkin N750 version 1.10.22 suffers from a security vulnerability in its implementation, which allows an unauthenticated remote user to execute arbitrary commands with root privileges by sending an HTTP request to twonkycommand.cgi...

[ASA-201804-8] roundcubemail: arbitrary command execution

Arch Linux Security Advisory ASA-201804-8 ========================================= Severity: High Date : 2018-04-19 CVE-ID : CVE-2018-9846 Package : roundcubemail Type : arbitrary command execution Remote : Yes Link : https://security.archlinux.org/AVG-670 Summary ======= The package roundcubema...

Buffalo WZR-1750DHP2 Arbitrary Code Execution Vulnerability

The Buffalo WZR-1750DHP2 is a router product from the Buffalo Group of Japan. A security vulnerability exists in the Buffalo WZR-1750DHP2 version 2.30 and earlier. An attacker can exploit the vulnerability to bypass authentication and execute arbitrary commands...

Buffalo WZR-1750DHP2 Arbitrary Command Execution Vulnerability

The Buffalo WZR-1750DHP2 is a router product from the Buffalo Group of Japan. A security vulnerability exists in the Buffalo WZR-1750DHP2 version 2.30 and earlier. An attacker can exploit the vulnerability to execute arbitrary operating system commands...

McAfee ePolicy Orchestrator OS Command Injection Vulnerability

McAfee ePolicy Orchestrator ePO is a suite of scalable security management software from McAfee. The software enables centralized, streamlined management of endpoint, network, content security and compliance solutions. An operating system injection vulnerability exists in McAfee ePolicy...

CVE-2017-2853

An exploitable Code Execution vulnerability exists in the RequestForPatientInfoEEGfile functionality of Natus Xltek NeuroWorks 8. A specially crafted network packet can cause a stack buffer overflow resulting in arbitrary command execution. An attacker can send a malicious packet to trigger this...

Stack overflow

An exploitable Code Execution vulnerability exists in the RequestForPatientInfoEEGfile functionality of Natus Xltek NeuroWorks 8. A specially crafted network packet can cause a stack buffer overflow resulting in arbitrary command execution. An attacker can send a malicious packet to trigger this...

CVE-2017-2853

An exploitable Code Execution vulnerability exists in the RequestForPatientInfoEEGfile functionality of Natus Xltek NeuroWorks 8. A specially crafted network packet can cause a stack buffer overflow resulting in arbitrary command execution. An attacker can send a malicious packet to trigger this...

CVE-2017-2853

CVE-2017-2853 affects Natus Xltek NeuroWorks 8. During processing of the command RequestForPatientInfoEEGfile, the NWStorage component builds a file path from a client-supplied value and uses a stack buffer in a sprintf call, which can overflow and overwrite the SEH chain. This leads to remote co...

The vulnerability of the “go get” command implementation in the Go programming language allows a perpetrator to execute arbitrary commands.

The vulnerability of the “go get” command in the Go programming language exists due to insufficient validation of input data insufficient checking of the import path when using the “-insecure” option. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands using a...

CVE-2018-0493

remctld in remctl before 3.14, when an attacker is authorized to execute a command that uses the sudo option, has a use-after-free that leads to a daemon crash, memory corruption, or arbitrary command execution...

UBUNTU-CVE-2018-0493

remctld in remctl before 3.14, when an attacker is authorized to execute a command that uses the sudo option, has a use-after-free that leads to a daemon crash, memory corruption, or arbitrary command execution...