3694 matches found
PHPUnit RCE Vulnerability
PHPUnit is one of the PHP-based testing framework. A security vulnerability exists in the Util/PHP/eval-stdin.php file in PHPUnit versions prior to 4.8.28 and 5.x versions prior to 5.6.3. A remote attacker can exploit this vulnerability by sending HTTP POST data beginning with the string '?php' t...
Remote Code Execution (RCE)
phpunit is vulnerable to remote code execution RCE attacks. A malicious user can inject and execute arbitrary PHP script by using the ?php tag and sending a POST request to the eval-stdin.php file on the system...
UBUNTU-CVE-2017-9841
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the...
Code injection
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "?php " substring, as demonstrated by an attack on a site with an exposed /vendor folder, i.e., external access to the...
CVE-2017-9841: Improper Control of Generation of Code
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST data beginning with a "...
E2open Device OpenWebif Plugin Arbitrary Code Execution Vulnerability
OpenWebif plugin for E2 open devices is a Web interface plugin for E2open devices from E2open, Inc. A security vulnerability exists in versions of the OpenWebif plugin for E2open devices prior to version 1.2.4, which originates from the 'saveConfig' function in...
CVE-2017-9807: Improper Control of Generation of Code
An issue was discovered in the OpenWebif plugin through 1.2.4 for E2 open devices. The saveConfig function of "plugin/controllers/models/config.py" performs an eval call on the contents of the "key" HTTP GET parameter. This allows an unauthenticated remote attacker to execute arbitrary Python cod...
Remote Code Execution (RCE)
kmc is vulnerable to remote code execution RCE. A malicious user can inject and execute arbitrary code due to the lack of sanitization of user input before executing the eval function...
Remote Code Execution (RCE)
mongo-edit is vulnerable to remote code execution RCE. A malicious user can inject and execute arbitrary code due to the lack of sanitization of user input before executing the eval function...
Remote Code Execution (RCE)
mongui is vulnerable to remote code execution RCE. A malicious user can inject and execute arbitrary code due to the lack of sanitization of user input before executing the eval function...
Remote Code Execution (RCE)
mongoosify is vulnerable to remote code execution RCE. A malicious user can inject and execute arbitrary code due to the lack of sanitization of user input before executing the eval function...
Remote Code Execution (RCE)
nameless-cli is vulnerable to remote code execution RCE. A malicious user can inject and execute arbitrary code due to the lack of sanitization of user input before executing the eval function...
Remote Code Execution (RCE)
nd-validator is vulnerable to remote code execution RCE. A malicious user can inject and execute arbitrary code due to the lack of sanitization of user input before executing the eval function...
Remote Code Execution (RCE)
m2m-supervisor is vulnerable to remote code execution RCE. A malicious user can inject and execute arbitrary code due to the lack of sanitization of user input before executing the eval function...
Sandbox Breakout
Overview Affected versions of safe-eval are vulnerable to a sandbox escape. By accessing object constructors, un-sanitized user input can access the entire standard library and effectively break out of the sandbox. Proof of Concept: This code accesses the process object and calls .exit var safeEv...
Command Execution Through Collection Name
summit is vulnerable to command execution. There is an unsafe eval in summit which allows an attacker to execute arbitrary commands through a malicious collection name. This only happens when using the PouchDB driver...
Remote Code Execution (RCE)
MathJS is vulnerable to remote code execution RCE attacks. These attacks are possible through the eval function...
Remote Code Execution (RCE)
MathJS is vulnerable to remote code execution RCE attacks. These attacks are possible through the eval function...
Remote Code Execution (RCE) Through Eval
heist is vulnerable to remote code execution RCE attacks. The vulnerability exists as the eval code for strings leads to Kernel.eval, and allows string interpolation to happen. This can eventually lead to a sandbox escape and remote code execution. The following code illustrates the issue RCE...
