Cross site request forgery (csrf)

CSRF exists in Webmin 1.850. By sending a GET request to at/createjob.cgi containing dir=/&cmd= in the URI, an attacker to execute arbitrary commands...

CVE-2017-15645

CVE-2017-15645 : Webmin 1.850 is vulnerable to CSRF via a crafted GET request to at/create_job.cgi containing dir=/&cmd= in the URI, enabling an attacker to execute arbitrary commands. Multiple connected sources corroborate the vulnerability, including Red Hat and CVE registries; the attack vecto...

SUSE-SU-2017:2747-1 Security update for git

This update for git fixes the following issues: This security issue was fixed: - CVE-2017-14867: Git used unsafe Perl scripts to support subcommands such as cvsserver, which allowed attackers to execute arbitrary OS commands via shell metacharacters in a module name bsc1061041...

CVE-2017-11774

Microsoft Outlook 2010 SP2, Outlook 2013 SP1 and RT SP1, and Outlook 2016 allow an attacker to execute arbitrary commands, due to how Microsoft Office handles objects in memory, aka "Microsoft Outlook Security Feature Bypass Vulnerability."...

[ASA-201710-15] go: arbitrary command execution

Arch Linux Security Advisory ASA-201710-15 ========================================== Severity: High Date : 2017-10-12 CVE-ID : CVE-2017-15041 Package : go Type : arbitrary command execution Remote : Yes Link : https://security.archlinux.org/AVG-442 Summary ======= The package go before version...

[ASA-201710-16] go-pie: arbitrary command execution

Arch Linux Security Advisory ASA-201710-16 ========================================== Severity: High Date : 2017-10-12 CVE-ID : CVE-2017-15041 Package : go-pie Type : arbitrary command execution Remote : Yes Link : https://security.archlinux.org/AVG-442 Summary ======= The package go-pie before...

UI-Dialog Arbitrary Command Execution Vulnerability

UI-Dialog is a jQuery UI a set of JavaScript libraries in a pop-up box plugin . An arbitrary command execution vulnerability exists in UI-Dialog 1.09 and earlier versions. A remote attacker can exploit this vulnerability to execute arbitrary commands...

Important vulnerabilities early warning: the Windows DNS client in the broke multiple heap buffer overflow flaws vulnerabilities in bug-bug warning-the black bar safety net

Microsoft has in the 2017 year 10 months official fix for the vulnerability CVE-2017-11779, the vulnerability includes the Windows DNS client in the plurality of memory corruption vulnerabilities, running Windows 8/Server 2012 and an updated version ofOSthe computer will be affected by this...

The vulnerability of the “send and receive file” command handler in the Picocom terminal emulation software allows a hacker to execute any command they desire.

The vulnerability of the “send and receive file” command in the Picocom terminal emulation software lies in the lack of measures to sanitize input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands by using /bin/sh to launch external commands...

The vulnerability of the Zyxel Eir D1000 router’s microprogramming software, related to deficiencies in access control for the TR-064 protocol, allows a intruder to execute arbitrary commands.

The vulnerability of the Zyxel Eir D1000 router’s microprogramming software is related to deficiencies in access control for the TR-064 protocol. This allows a malicious actor to execute arbitrary commands through the TCP port 7547, by utilizing the NewNTPServer function...

The vulnerability of the microprogrammed Wi-Fi router STATION L-02F, related to deficiencies in access control, allows a hacker to gain access to the device with administrator privileges and execute arbitrary commands.

The vulnerability of the microprogrammed Wi-Fi router STATION L-02F is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to gain access to the device with administrator privileges and execute arbitrary commands...

The vulnerability of the HTTP Web-management component of Edgewater Networks Edgemarc software allows a perpetrator to execute arbitrary commands.

The vulnerability of the HTTP Web-management component of Edgewater Networks Edgemarc software is related to the lack of measures to sanitize input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands, using a hidden page as an interface for executing these...

IBM Security Identity Manager Virtual Appliance Arbitrary Command Execution Vulnerability (CNVD-2017-33517)

IBM Security Identity Manager ISIM is a suite of identity management and governance solutions from IBM in the United States. The solution automates the creation, modification, re-authentication and termination of user privileges throughout the user lifecycle and supports policy-based password...

CVE-2017-13997

A Missing Authentication for Critical Function issue was discovered in Schneider Electric InduSoft Web Studio v8.0 SP2 or prior, and InTouch Machine Edition v8.0 SP2 or prior. InduSoft Web Studio provides the capability for an HMI client to trigger script execution on the server for the purposes ...

CVE-2017-13997

A Missing Authentication for Critical Function issue was discovered in Schneider Electric InduSoft Web Studio v8.0 SP2 or prior, and InTouch Machine Edition v8.0 SP2 or prior. InduSoft Web Studio provides the capability for an HMI client to trigger script execution on the server for the purposes ...

Authentication flaw

A Missing Authentication for Critical Function issue was discovered in Schneider Electric InduSoft Web Studio v8.0 SP2 or prior, and InTouch Machine Edition v8.0 SP2 or prior. InduSoft Web Studio provides the capability for an HMI client to trigger script execution on the server for the purposes ...

CVE-2017-13997

A Missing Authentication for Critical Function issue was discovered in Schneider Electric InduSoft Web Studio v8.0 SP2 or prior, and InTouch Machine Edition v8.0 SP2 or prior. InduSoft Web Studio provides the capability for an HMI client to trigger script execution on the server for the purposes ...

CVE-2017-14867

Git before 2.10.5, 2.11.x before 2.11.4, 2.12.x before 2.12.5, 2.13.x before 2.13.6, and 2.14.x before 2.14.2 uses unsafe Perl scripts to support subcommands such as cvsserver, which allows attackers to execute arbitrary OS commands via shell metacharacters in a module name. The vulnerable code i...

UBUNTU-CVE-2017-14867

Git before 2.10.5, 2.11.x before 2.11.4, 2.12.x before 2.12.5, 2.13.x before 2.13.6, and 2.14.x before 2.14.2 uses unsafe Perl scripts to support subcommands such as cvsserver, which allows attackers to execute arbitrary OS commands via shell metacharacters in a module name. The vulnerable code i...

The vulnerability of the USB modem code of Cisco ASR 920 router series in the Cisco IOS operating system allows a intruder to implant and execute arbitrary commands.

The vulnerability of the Cisco ASR 920 router’s USB modem code exists because measures to neutralize special elements used in the operating system commands have not been taken. Exploiting this vulnerability allows a local attacker to inject and execute arbitrary commands by modifying the USB...