Webmin 1.920 Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Webmin 1.920 Unauthenticated RCE', 'Description' = %q This module exploits an arbitrary command execution vulnerability in Webmin 1.920 and prior...

NewStart CGSL MAIN 4.05 : bash Multiple Vulnerabilities (NS-SA-2019-0108)

The remote NewStart CGSL host, running version MAIN 4.05, has bash packages installed that are affected by multiple vulnerabilities: - A denial of service flaw was found in the way bash handled popd commands. A poorly written shell script could cause bash to crash resulting in a local denial of...

NewStart CGSL CORE 5.04 / MAIN 5.04 : vim Vulnerability (NS-SA-2019-0161)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has vim packages installed that are affected by a vulnerability: - It was found that the :source! command was not restricted by the sandbox mode. If modeline was explicitly enabled, opening a specially crafted text file in vim...

NewStart CGSL CORE 5.04 / MAIN 5.04 : golang Multiple Vulnerabilities (NS-SA-2019-0047)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has golang packages installed that are affected by multiple vulnerabilities: - An arbitrary command execution flaw was found in the way Go's go get command handled the checkout of source code repositories. A remote attacker...

RHEL 7 : vim (RHSA-2019:1947)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:1947 advisory. Vim Vi IMproved is an updated and improved version of the vi editor. Security Fixes: vim/neovim: ':source!' command allows arbitrary command executio...

Debian DSA-4494-1 : kconfig - security update

Dominik Penner discovered that KConfig, the KDE configuration settings framework, supported a feature to define shell command execution in .desktop files. If a user is provided with a malformed .desktop file e.g. if it's embedded into a downloaded archive and it gets opened in a file browser...

Command Execution Vulnerability in Netcom WAN Acceleration Gateway

Netcom WAN optimization gateway NS-WOG is the latest technological innovation from Netcom. WAN optimization, also commonly referred to as WAN acceleration. A command execution vulnerability exists in the Netcom WAN acceleration gateway. It allows attackers to exploit the vulnerability to execute...

CVE-2019-12805 NC Launcher 2 Arbitrary Command Injection Vulnerability

NCSOFT Game Launcher, NC Launcher2 2.4.1.691 and earlier versions have a vulnerability in the custom protocol handler that could allow remote attacker to execute arbitrary command. User interaction is required to exploit this vulnerability in that the target must visit a malicious web page. This...

CVE-2019-12805

The CVE-2019-12805 entry concerns NCSOFT Game Launcher, NC Launcher2 (versions up to 2.4.1.691). A vulnerability in the custom protocol handler could allow a remote attacker to execute arbitrary commands when a user visits a malicious page, executing code in the context of the current user. Conne...

Arbitrary Command Execution

zsh is vulnerable to arbitrary command execution. The truncation of Shebang lines that exceed 64 characters could potentially lead to arbitrary execve call...

HP 2910al-48G Arbitrary Command Execution Vulnerability

The HP 2910al-48G is an Ethernet switch from Hewlett Packard Enterprise HPE in the United States. An arbitrary command execution vulnerability exists in the HP 2910al-48G version W.15.14.0016, which can be exploited by an attacker to execute arbitrary commands...

Nextcloud Android app SQL injection vulnerability

Nextcloud Android app is an Android-based mobile application from Nextcloud Germany for accessing Nextcloud servers. A SQL injection vulnerability exists in the Nextcloud Android app versions prior to 3.0.0. The vulnerability stems from a lack of validation of externally entered SQL statements in...

Important: Red Hat Security Advisory: vim security update

An update for vim is now available for Red Hat Enterprise Linux 7.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for eac...

vim/neovim: ': source!' command allows arbitrary command execution via modelines

It was found that the :source! command was not restricted by the sandbox mode. If modeline was explicitly enabled, opening a specially crafted text file in vim could result in arbitrary command execution...

CVE-2019-14416

An issue was discovered in Veritas Resiliency Platform VRP before 3.4 HF1. An arbitrary command execution vulnerability allows a malicious VRP user to execute commands with root privilege within the VRP virtual machine, related to resiliency plans and custom script functionality...

CVE-2019-14416

An issue was discovered in Veritas Resiliency Platform VRP before 3.4 HF1. An arbitrary command execution vulnerability allows a malicious VRP user to execute commands with root privilege within the VRP virtual machine, related to resiliency plans and custom script functionality...

CVE-2019-14417

An issue was discovered in Veritas Resiliency Platform VRP before 3.4 HF1. An arbitrary command execution vulnerability allows a malicious VRP user to execute commands with root privilege within the VRP virtual machine, related to DNS functionality...

Command injection

An issue was discovered in Veritas Resiliency Platform VRP before 3.4 HF1. An arbitrary command execution vulnerability allows a malicious VRP user to execute commands with root privilege within the VRP virtual machine, related to resiliency plans and custom script functionality...

CVE-2019-14417

An issue was discovered in Veritas Resiliency Platform VRP before 3.4 HF1. An arbitrary command execution vulnerability allows a malicious VRP user to execute commands with root privilege within the VRP virtual machine, related to DNS functionality...

CVE-2019-14417

Veritas Resiliency Platform (VRP) prior to 3.4 HF1 contains an arbitrary command execution vulnerability in its DNS-related functionality that lets a malicious VRP user run commands with root privileges inside the VRP VM. Affected software is VRP before 3.4 HF1; the underlying issue is tied to DN...