2891 matches found
CVE-2019-20343
The MojoHaus Exec Maven plugin 1.1.1 for Maven allows code execution via a crafted XML document because a configuration element within a plugin element can specify an arbitrary program in an executable element and can also specify arbitrary command-line arguments in an arguments element...
Code injection
The MojoHaus Exec Maven plugin 1.1.1 for Maven allows code execution via a crafted XML document because a configuration element within a plugin element can specify an arbitrary program in an executable element and can also specify arbitrary command-line arguments in an arguments element...
CVE-2019-20343
The CVE-2019-20343 issue affects the MojoHaus Exec Maven plugin for Maven (version 1.1.1). A crafted XML document can trigger code execution because a configuration element (within a plugin element) can specify an arbitrary program in an executable element and may include arbitrary command-line a...
CVE-2019-20343
The MojoHaus Exec Maven plugin 1.1.1 for Maven allows code execution via a crafted XML document because a configuration element within a plugin element can specify an arbitrary program in an executable element and can also specify arbitrary command-line arguments in an arguments element...
HomeAutomation 3.3.2 - Remote Code Execution Vulnerability
Exploit for php platform in category web applications Exploit: HomeAutomation 3.3.2 - Remote Code Execution Author: LiquidWorm Vendor: Tom Rosenback and Daniel Malmgren Product web page: http://karpero.mine.nu/ha/ Affected version: 3.3.2 Tested on: Apache/2.4.41 centos OpenSSL/1.0.2k-fips Advisor...
CVE-2019-10758
mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the toBSON method. A misuse of the vm dependency to perform exec commands in a non-safe environment...
CVE-2019-10758
mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the toBSON method. A misuse of the vm dependency to perform exec commands in a non-safe environment...
CVE-2019-10758
MongoDB mongo-express ≤0.53.x is vulnerable to Remote Code Execution via endpoints using toBSON, due to unsafe use of the vm module to run exec commands. Affected component: mongo-express server-side routes that invoke toBSON. Root cause: misusing vm to execute commands in a non-safe environment....
Updated libvirt packages fix security vulnerabilities
Updated libvirt packages fix security vulnerabilities: An information leak which allowed to retrieve the guest hostname under readonly mode CVE-2019-3886. Wrong permissions in systemd admin-sock due to missing SocketMode parameter CVE-2019-10132. Arbitrary file read/exec via...
Cisco IOS XE Software Privileged EXEC Mode Root Shell Access (cisco-sa-20180926-privesc)
According to its self-reported version, Cisco IOS XE Software is affected by a vulnerability in the CLI parser due to the affected software improperly sanitizing command arguments to prevent modifications to the underlying Linux file system on a device. An authenticated, local attacker who has...
CVE-2002-2444
Snoopy before 2.0.0 has a security hole in exec cURL...
CVE-2002-2444
CVE-2002-2444 affects Snoopy prior to 2.0.0, with a security hole in exec cURL. The initial entry reports CVSS v2 base score 7.5 (HIGH) and CVSS v3.1 base score 9.8 (CRITICAL). No exploitation details or remediation are provided in the connected documents.
CVE-2019-16663
An issue was discovered in rConfig 3.9.2. An attacker can directly execute system commands by sending a GET request to search.crud.php because the catCommand parameter is passed to the exec function without filtering, which can lead to command execution...
Command injection
An issue was discovered in rConfig 3.9.2. An attacker can directly execute system commands by sending a GET request to ajaxServerSettingsChk.php because the rootUname parameter is passed to the exec function without filtering, which can lead to command execution...
Sourcecodester Restaurant Management System Cross-Site Request Forgery Vulnerability
Sourcecodester Restaurant Management System is a restaurant management system. A cross-site request forgery vulnerability exists in the admin/staff-exec.php file in version 1.0 of the Sourcecodester Restaurant Management System, which originates from a WEB application that does not adequately...
CVE-2019-18414
Sourcecodester Restaurant Management System 1.0 is affected by an admin/staff-exec.php Cross Site Request Forgery vulnerability due to a lack of CSRF protection. This could lead to an attacker tricking the administrator into executing arbitrary code or adding a staff entry via a crafted HTML page...
GHSA-549F-73HH-MJ38 Command Injection in gitlabhook
All versions of gitlabhook are vulnerable to Command Injection. The package does not validate input the body of POST request and concatenates it to an exec call, allowing attackers to run arbitrary commands in the system. Recommendation No fix is currently available. Consider using an alternative...
Node.js third-party modules: [create-git] RCE via insecure command formatting
The create-git NPM module was vulnerable against command injection which was possible since some user supplied inputs were concatenated without proper checks inside a exec call, which made possible executing arbitrary commands besides the git one which is used by the tool. The PoC resulted in: js...
CredSSP Remote Code Execution Vulnerability March 2018 Security Update
The remote Windows host allows fallback to insecure versions of Credential Security Support Provider protocol CredSSP. It is therefore, affected by a remote code execution vulnerability. An attacker who successfully exploited this vulnerability could relay user credentials and use them to execute...
