CVE-2020-2261

Jenkins Perfecto Plugin 1.17 and earlier executes a command on the Jenkins controller, allowing attackers with Job/Configure permission to run arbitrary commands on the Jenkins controller...

Command Injection in wizard-syncronizer

All versions of wizard-syncronizer are vulnerable to Command Injection. The package does not validate input on the cloneAndSync function and concatenates it to an exec call. This can be abused through a malicious widget containing the payload in the gitURL value or through a MITM attack since the...

CVE-2020-10050

SIMATIC RTLS Locating Manager (Siemens) versions prior to 2.10.2 are affected by CVE-2020-10050. The vulnerability arises from the directory of service executables, enabling a local attacker to include arbitrary commands that execute with SYSTEM privileges on system restart. Impact is local privi...

Siemens SIMATIC RTLS Locating Manager Elevation of Privilege Vulnerability (CNVD-2020-51249)

SIMATIC RTLS is a real-time wireless positioning system for locating solutions.Siemens SIMATIC RTLS Locating Manager is used for the configuration, operation and maintenance of SIMATIC RTLS installations. An elevation of privilege vulnerability exists in Siemens SIMATIC RTLS Locating Manager. An...

Siemens SIMATIC RTLS Locating Manager Elevation of Privilege Vulnerability

SIMATIC RTLS is a real-time wireless positioning system for locating solutions.Siemens SIMATIC RTLS Locating Manager is used for the configuration, operation and maintenance of SIMATIC RTLS installations. An elevation of privilege vulnerability exists in Siemens SIMATIC RTLS Locating Manager. An...

CVE-2020-24986

Concrete5 (CMS) up to and including 8.5.2 is vulnerable to an Unrestricted Upload of a dangerous file type (e.g., .php) via the File Manager, enabling execution of arbitrary commands. Affected: Concrete5 8.5.2 and earlier. Root cause: file-type upload not sufficiently restricted. Impact: potentia...

CVE-2020-3451

Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV340 Series Routers could allow an authenticated, remote attacker with administrative credentials to execute arbitrary commands on the underlying operating system OS as a restricted user. For more information...

D-Link DCS-2530L and DCS-2670L Command Injection Vulnerability

The DCS-2530L and DCS-2670L are Full HD 180-degree Wi-Fi cameras from D-Link. A command injection vulnerability exists in cgi-bin/ddnsenc.cgi in the D-Link DCS-2530L and DCS-2670L. The vulnerability stems from a network system or product not properly filtering specific elements of externally...

CVE-2020-7712

CVE-2020-7712—Initial public details: the vulnerability in json package prior to 10.0.0 enables arbitrary command injection via parseLookup. Connected data from a Nessus plugin (Oracle Siebel Server <= 22.5) cites the CVE and describes a vulnerability in Siebel CRM (component: Loging/APache Zo...

IBM Security Guardium Data Encryption (GDE) Arbitrary Command Execution Vulnerability

IBM Security Guardium Data Encryption GDE provides a modular set of encryption solutions that help security teams effectively implement data-at-rest security across the organization. An arbitrary command execution vulnerability exists in IBM Security Guardium Data Encryption GDE 3.0.0.2, which ca...

CVE-2020-17384 Cellopoint CelloOS - Remote Command Execution (RCE)

Cellopoint CelloOS v4.1.10 Build 20190922 does not validate URL inputted properly. With the cookie of the system administrator, attackers can inject and remotely execute arbitrary command to manipulate the system...

CVE-2020-24364

MineTime through 1.8.5 allows arbitrary command execution via the notes field in a meeting. Could lead to RCE via meeting invite...

CVE-2020-24364

MineTime (version 1.8.5 and earlier) is affected by CVE-2020-24364. The vulnerability allows arbitrary command execution via the notes field in a meeting invitation, potentially leading to remote code execution. The CVSS metrics indicate a high-severity impact (CVSSv3.1 HR, network attack vector,...

CVE-2020-24364

MineTime through 1.8.5 allows arbitrary command execution via the notes field in a meeting. Could lead to RCE via meeting invite...

CVE-2020-24054

The CVE-2020-24054 issue affects Moog EXO Series EXVF5C-2 and EXVP7C2-3 administration consoles. The vulnerability arises from a privileged “statusbroadcast” feature that can spawn a specified binary repeatedly at set intervals as root. Although the feature accepts only a binary path without argu...

CVE-2020-7710

This affects all versions of package safe-eval. It is possible for an attacker to run an arbitrary command on the host machine...

CVE-2020-7710

This affects all versions of package safe-eval. It is possible for an attacker to run an arbitrary command on the host machine...

CVE-2020-7710

This affects all versions of package safe-eval. It is possible for an attacker to run an arbitrary command on the host machine...

CVE-2020-7710 Sandbox Escape

This affects all versions of package safe-eval. It is possible for an attacker to run an arbitrary command on the host machine...

CVE-2020-7710

CVE-2020-7710 affects all versions of the safe-eval package. The vulnerability arises from the package failing to restrict access to the main JavaScript context via Error objects, enabling a sandbox escape and remote code execution. Proof-of-concept payloads in advisory sources demonstrate how an...