CVE-2019-10166

It was discovered that libvirtd, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, would permit readonly clients to use the virDomainManagedSaveDefineXML API, which would permit them to modify managed save state files. If a managed save had already been created by a privileged user, a local...

PT-2019-2883

Name of the Vulnerable Software and Affected Versions libvirtd versions prior to 4.10.1 libvirtd versions prior to 5.4.1 Description The issue is related to the virDomainSaveImageGetXMLDesc API, which has access control errors. This allows an attacker with access to the libvirtd socket to probe t...

PT-2019-2575

Name of the Vulnerable Software and Affected Versions libvirtd versions 4.x.x through 4.10.0 libvirtd versions 5.x.x through 5.4.0 Description The issue is related to insufficient access control in the virDomainManagedSaveDefineXML API, allowing readonly clients to modify managed save state files...

CVE-2019-10038: Improper Limitation of a Pathname to a Restricted Directory

Evernote 7.9 on macOS allows attackers to execute arbitrary programs by embedding a reference to a local executable file such as the /Applications/Calculator.app/Contents/MacOS/Calculator file...

CVE-2019-12137

Typora 0.9.9.24.6 on macOS is affected by CVE-2019-12137 (directory traversal) that allows execution of arbitrary programs via crafted file:/// or ../ substrings in a shared note. Root cause is path traversal through URI handling, enabling local code execution. Publicly documented impact is arbit...

CVE-2019-12138: Improper Limitation of a Pathname to a Restricted Directory

MacDown 0.7.1 allows directory traversal, for execution of arbitrary programs, via a file:/// or ../ substring in a shared note...

File Upload Vulnerability in Siemens Wincc v7.3

Siemens Wincc v7.3 is a process monitoring system. A file upload vulnerability exists in Siemens Wincc v7.3, which can be exploited by an attacker to cause an elevation of privilege by launching an arbitrary program...

CVE-2018-0651

Buffer overflow in the license management function of YOKOGAWA products iDefine for ProSafe-RS R1.16.3 and earlier, STARDOM VDS R7.50 and earlier, STARDOM FCN/FCJ Simulator R4.20 and earlier, ASTPLANNER R15.01 and earlier, TriFellows V5.04 and earlier allows remote attackers to stop the license...

Buffer overflow

Buffer overflow in the license management function of YOKOGAWA products iDefine for ProSafe-RS R1.16.3 and earlier, STARDOM VDS R7.50 and earlier, STARDOM FCN/FCJ Simulator R4.20 and earlier, ASTPLANNER R15.01 and earlier, TriFellows V5.04 and earlier allows remote attackers to stop the license...

PT-2018-1511

Name of the Vulnerable Software and Affected Versions YOKOGAWA iDefine for ProSafe-RS versions 1.16.3 and earlier YOKOGAWA STARDOM VDS versions 7.50 and earlier YOKOGAWA STARDOM FCN/FCJ Simulator versions 4.20 and earlier YOKOGAWA ASTPLANNER versions 15.01 and earlier YOKOGAWA TriFellows versions...

Arbitrary Program Removal Vulnerability in HOLLYWOOD LE5109L PLCs

HOLLIS Group is a professional automation company integrating R&D, production, sales and technical service. An arbitrary program removal vulnerability exists in the HELISE LE5109L PLC, which can be exploited by an attacker to cause malicious removal of programs from the PLC controller via...

Haiwell C10S0R(-e) PLC has an arbitrary program removal vulnerability.

C10S0R-e PLC is a product in the programmable logic controller PLC series of Xiamen Haiwei Technology Co. The Haiwell C10S0R-e PLC suffers from an arbitrary program removal vulnerability, which can be exploited by an attacker to remove the PLC program via unauthorized construction of specific...

Arbitrary Program Override Vulnerability in DCCE MAC1100 PLCs

MAC1100 PLC is a programmable logic controller manufactured by Dalian Polytechnic Computer Control Engineering Co. DCCE MAC1100 PLC has an arbitrary program overwrite vulnerability, the vulnerability stems from the MAC1100 PLC programmable logic controller to download the program to the PLC did n...

Race condition

It is possible to exploit a Time of Check & Time of Use TOCTOU vulnerability by winning a race condition when Kaseya Virtual System Administrator agent 9.3.0.11 and earlier tries to execute its binaries from working and/or temporary folders. Successful exploitation results in the execution of...

CVE-2017-12410: Concurrent Execution using Shared Resource with Improper Synchronization

It is possible to exploit a Time of Check & Time of Use TOCTOU vulnerability by winning a race condition when Kaseya Virtual System Administrator agent 9.3.0.11 and earlier tries to execute its binaries from working and/or temporary folders. Successful exploitation results in the execution of...

CVE-2017-18123

The call parameter of /lib/exe/ajax.php in DokuWiki through 2017-02-19e does not properly encode user input, which leads to a reflected file download vulnerability, and allows remote attackers to run arbitrary programs...

CVE-2018-2363

SAP NetWeaver, SAP BASIS from 7.00 to 7.02, from 7.10 to 7.11, 7.30, 7.31, 7.40, from 7.50 to 7.52, contains code that allows you to execute arbitrary program code of the user's choice. A malicious user can therefore control the behaviour of the system or can potentially escalate privileges by...

PT-2018-15497

Name of the Vulnerable Software and Affected Versions SAP NetWeaver, SAP BASIS versions 7.00 through 7.02 SAP NetWeaver, SAP BASIS versions 7.10 through 7.11 SAP NetWeaver, SAP BASIS version 7.30 SAP NetWeaver, SAP BASIS version 7.31 SAP NetWeaver, SAP BASIS version 7.40 SAP NetWeaver, SAP BASIS...

CVE-2017-17867

Inteno iopsys 2.0-3.14 and 4.0 devices allow remote authenticated users to execute arbitrary OS commands by modifying the leasetrigger field in the odhcpd configuration to specify an arbitrary program, as demonstrated by a program located on an SMB share. This issue existed because the...

CVE-2017-1000117

A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL can result in any program that exists on the victim's machine being executed. Such a URL could be placed in the .gitmodules file of a malicious project, and an unsuspecting victim...