CloudBees Jenkins Selection tasks Plugin Arbitrary Command Execution Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company a set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing project and some timed execution of the task . Jenkins Selection tasks Plugi...

Arbitrary Command Execution

vim is vulnerable to arbitrary command execution. An attacker is able to bypass the rvim restricted mode and execute arbitrary OS commands via scripting interfaces...

IBM QRadar Untrusted Data Deserialization Vulnerability

IBM QRadar SIEM is an IBM USA solution that utilizes security intelligence to protect assets and information from advanced threats. The solution provides oversight of the entire scope of the IT architecture, generates detailed reports on data access and user activity, and more. An untrustworthy...

Nord Security: Possible RCE through Windows Custom Protocol on Windows client

Summary: The NordVPN windows client application registered two custom protocols NordVPN: and NordVPN.Notification: for process communication. This makes us are able to communicate with NordVPN.exe from web browser. After looking the executable binary, I noticed the class...

Ubuntu: Security Advisory (USN-4569-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[ASA-202009-14] yaws: multiple issues

Arch Linux Security Advisory ASA-202009-14 ========================================== Severity: High Date : 2020-09-26 CVE-ID : CVE-2020-12872 CVE-2020-24379 CVE-2020-24916 Package : yaws Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1228 Summary ======= The packag...

CloudBees Jenkins Perfecto Arbitrary Command Execution Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company a set of Java-based development of continuous integration tools . The product is mainly used to monitor the continuous software version release/testing project and some timed execution of the task . Jenkins Perfecto plugin versi...

CVE-2020-0391

In applyPolicy of PackageManagerService.java, there is possible arbitrary command execution as System due to an unenforced protected-broadcast. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

CVE-2020-0391

In applyPolicy of PackageManagerService.java, there is possible arbitrary command execution as System due to an unenforced protected-broadcast. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

CVE-2020-0391

In applyPolicy of PackageManagerService.java, there is possible arbitrary command execution as System due to an unenforced protected-broadcast. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

CVE-2020-0391

CVE-2020-0391 is an Android elevation-of-privilege issue in PackageManagerService.applyPolicy that allows arbitrary command execution as System due to an unenforced protected-broadcast. It enables local privilege escalation with no user interaction on Android 9–11. The Android bulletin notes this...

CVE-2020-2276

Jenkins Selection tasks Plugin 1.0 and earlier executes a user-specified program on the Jenkins controller, allowing attackers with Job/Configure permission to execute an arbitrary system command on the Jenkins controller as the OS user that the Jenkins process is running as...

CVE-2020-2261

Jenkins Perfecto Plugin 1.17 and earlier executes a command on the Jenkins controller, allowing attackers with Job/Configure permission to run arbitrary commands on the Jenkins controller...

CVE-2020-2261

Jenkins Perfecto Plugin 1.17 and earlier executes a command on the Jenkins controller, allowing attackers with Job/Configure permission to run arbitrary commands on the Jenkins controller...

Command Injection in wizard-syncronizer

All versions of wizard-syncronizer are vulnerable to Command Injection. The package does not validate input on the cloneAndSync function and concatenates it to an exec call. This can be abused through a malicious widget containing the payload in the gitURL value or through a MITM attack since the...

CVE-2020-10050

SIMATIC RTLS Locating Manager (Siemens) versions prior to 2.10.2 are affected by CVE-2020-10050. The vulnerability arises from the directory of service executables, enabling a local attacker to include arbitrary commands that execute with SYSTEM privileges on system restart. Impact is local privi...

Siemens SIMATIC RTLS Locating Manager Elevation of Privilege Vulnerability (CNVD-2020-51249)

SIMATIC RTLS is a real-time wireless positioning system for locating solutions.Siemens SIMATIC RTLS Locating Manager is used for the configuration, operation and maintenance of SIMATIC RTLS installations. An elevation of privilege vulnerability exists in Siemens SIMATIC RTLS Locating Manager. An...

Siemens SIMATIC RTLS Locating Manager Elevation of Privilege Vulnerability

SIMATIC RTLS is a real-time wireless positioning system for locating solutions.Siemens SIMATIC RTLS Locating Manager is used for the configuration, operation and maintenance of SIMATIC RTLS installations. An elevation of privilege vulnerability exists in Siemens SIMATIC RTLS Locating Manager. An...

CVE-2020-24986

Concrete5 (CMS) up to and including 8.5.2 is vulnerable to an Unrestricted Upload of a dangerous file type (e.g., .php) via the File Manager, enabling execution of arbitrary commands. Affected: Concrete5 8.5.2 and earlier. Root cause: file-type upload not sufficiently restricted. Impact: potentia...

CVE-2020-3451

Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV340 Series Routers could allow an authenticated, remote attacker with administrative credentials to execute arbitrary commands on the underlying operating system OS as a restricted user. For more information...