CVE-2020-11830

QualityProtect has a vulnerability to execute arbitrary system commands, affected product is com.oppo.qualityprotect V2.0...

CVE-2020-4701

IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server 10.5, 11.1, and 11.5 is vulnerable to a buffer overflow, caused by improper bounds checking which could allow a local attacker to execute arbitrary code on the system with root privileges...

Buffer overflow

IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server 10.5, 11.1, and 11.5 is vulnerable to a buffer overflow, caused by improper bounds checking which could allow a local attacker to execute arbitrary code on the system with root privileges...

Design/Logic Flaw

QualityProtect has a vulnerability to execute arbitrary system commands, affected product is com.oppo.qualityprotect V2.0...

CVE-2020-11830

QualityProtect has a vulnerability to execute arbitrary system commands, affected product is com.oppo.qualityprotect V2.0...

Vulnerability fixed in IBM Db2

IBM has fixed a vulnerability in Db2 and Db2 Connect Server. A local, authenticated malicious agent could potentially exploit the vulnerability to execute arbitrary code under root or SYSTEM privileges. IBM has released updates to fix the vulnerability. For more information, see:...

KLA12101 Use after free vulnerability in VMware Workstation and Player

A use after free vulnerability was found in VMware Workstation and Player. Malicious users can exploit this vulnerability to execute arbitrary code. Original advisories VMSA-2020-0026 Exploitation Related products VMware-Workstation VMware-Player CVE list CVE-2020-4004 critical Solution Update to...

CVE-2020-26548

An issue was discovered in Aviatrix Controller before R5.4.1290. There is an insecure sudo rule: a user exists that can execute all commands as any user on the system...

CVE-2020-26548

An issue was discovered in Aviatrix Controller before R5.4.1290. There is an insecure sudo rule: a user exists that can execute all commands as any user on the system...

Design/Logic Flaw

A vulnerability in Apache OpenOffice scripting events allows an attacker to construct documents containing hyperlinks pointing to an executable on the target users file system. These hyperlinks can be triggered unconditionally. In fixed versions no internal protocol may be called from the documen...

Cross site scripting

In Progress MOVEit Transfer before 2020.1, a malicious user could craft and store a payload within the application. If a victim within the MOVEit Transfer instance interacts with the stored payload, it could invoke and execute arbitrary code within the context of the victim's browser XSS...

PT-2020-16451

Name of the Vulnerable Software and Affected Versions Aviatrix Controller versions prior to R5.4.1290 Description An issue was discovered in Aviatrix Controller where there is an insecure sudo rule, allowing a user to execute all commands as any user on the system. Recommendations For Aviatrix...

Dll Hijacking Vulnerability in Shoos Flash Wizard (Windows Client)

Shock Wave Flash Wizard is a SWF decompiler that not only captures, decompiles, views and extracts Shock Wave Flash movies .swf and .exe format files, but also converts SWF format files to FLA format files. A dll hijacking vulnerability exists in Shock Wave Flash Wizard Windows client. An attacke...

Apache Camel Unauthenticated Code Execution

The vulnerability of the Java framework Apache Camel is related to the restoration of unreliable data structures in memory. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access to protected information, execute arbitrary code, or cause service failure...

QNAP QTS Multiple Vulnerabilities (QSA-20-09)

QNAP QTS is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/o:qnap:qts"; if description...

KLA12011 Multiple vulnerabilities in Mozilla Firefox ESR

Multiple vulnerabilities were found in Mozilla Firefox ESR. Malicious users can exploit these vulnerabilities to gain privileges, perform cross-site scripting attack, obtain sensitive information, cause denial of service, spoof user interface, execute arbitrary code, bypass security restrictions...

Unrestricted file upload

An unrestricted file upload issue in HorizontCMS 1.0.0-beta allows an authenticated remote attacker to upload PHP code through a zip file by uploading a theme, and executing the PHP file via an HTTP GET request to /themes/...

CVE-2020-2490

If exploited, the command injection vulnerability could allow remote attackers to execute arbitrary commands. This issue affects: QNAP Systems Inc. QTS versions prior to 4.4.3.1421 on build 20200907...

CVE-2020-8270

An unprivileged Windows user on the VDA or an SMB user can perform arbitrary command execution as SYSTEM in CVAD versions before 2009, 1912 LTSR CU1 hotfixes CTX285871 and CTX285872, 7.15 LTSR CU6 hotfix CTX285341 and CTX285342...

TP-Link Archer A7 AC1750 Command Injection Vulnerability

TP-Link Archer A7 AC1750 is a wireless router from TP-Link. tdpServer security vulnerability exists in TP-Link Archer A7 AC1750 devices before version 201029, which can be exploited by attackers to execute arbitrary code from mac parameters...