CVE-2017-8836: Cross-Site Request Forgery (CSRF)

CSRF exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2380hw6580hw2710hw31350hw22500-7.0.1-build2093. The CGI scripts in the administrative interface are affected. This allows an attacker to execute commands, if a logged in user visits a malicious...

CVE-2017-9294

RMI vulnerability in Hitachi Device Manager before 8.5.2-01 allows remote attackers to execute internal commands without authentication via RMI ports...

WMI Command Shell Wrapper: WMIcmd

WMI Command Shell Wrapper When doing low impact investigations and other similar activities you may want to minimize what is written to disk / obvious. This tool allows us to execute commands via WMI and get information not otherwise available via this channel. Purpose A small utility which only...

vmware horizon client dll hijacking vulnerability

Horizon Client is used to virtualize desktops and applications. A DLL hijacking vulnerability exists in the vmware horizon client, which could allow an attacker to maliciously load a DLL and execute arbitrary commands by constructing a malicious application and placing it in a specific path...

CVE-2017-3980

A directory traversal vulnerability in the ePO Extension in McAfee ePolicy Orchestrator ePO 5.9.0, 5.3.2, and 5.1.3 and earlier allows remote authenticated users to execute a command of their choice via an authenticated ePO session...

PT-2017-18261 · Gnome +3 · Gnome Shell +3

Name of the Vulnerable Software and Affected Versions: gnome-shell versions 3.22 through 3.24.1 Description: The issue arises from the mishandling of extensions that fail to reload, potentially leaving them enabled on the lock screen. This could allow a bystander to launch applications, although...

Buffalo WNC01WH Command Injection Vulnerability

Buffalo WNC01WH is a network camera from the Buffalo Group of Japan. A command injection vulnerability exists in the Buffalo WNC01WH. This allows a locally authenticated attacker to perform a command injection attack...

CVE-2015-7564

Multiple SQL injection vulnerabilities in TeamPass 2.1.24 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 id parameter in an actiononquickicon action to item.query.php or the 2 order or 3 direction parameter in an a connectionslogs, b errorslogs or c accesslogs acti...

CVE-2017-6971

AlienVault USM and OSSIM before 5.3.7 and NfSen before 1.3.8 allow remote authenticated users to execute arbitrary commands in a privileged context, or launch a reverse shell, via vectors involving the PHP session ID and the NfSen PHP code, aka AlienVault ID ENG-104862...

CVE-2017-6590

An issue was discovered in network-manager-applet aka network-manager-gnome in Ubuntu 12.04 LTS, 14.04 LTS, 16.04 LTS, and 16.10. A local attacker could use this issue at the default Ubuntu login screen to access local files and execute arbitrary commands as the lightdm user. The exploitation...

CVE-2016-9726

IBM QRadar Incident Forensics 7.2 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary commands on the system. IBM Reference : 1999542...

CVE-2016-6077

IBM Cognos Disclosure Management 10.2 could allow a malicious attacker to execute commands as a lower privileged user that opens a malicious document. IBM Reference : 1991584...

Information disclosure

IBM InfoSphere Information Server could allow a local user under special circumstances to execute commands during installation processes that could expose sensitive information...

The vulnerability of the Android operating system, allowing a hacker to execute arbitrary commands

The vulnerability of the initial loader of the Android operating system is related to deficiencies in access control. Exploiting this vulnerability allows a local attacker to execute arbitrary commands on the device’s modem. This issue is considered “high” because it causes continuous service...

Debian DSA-3779-1 : wordpress - security update

Several vulnerabilities were discovered in wordpress, a web blogging tool. They would allow remote attackers to hijack victims' credentials, access sensitive information, execute arbitrary commands, bypass read and post restrictions, or mount denial-of-service attacks. %NASLMINLEVEL 70300 C Tenab...

Remote msfconsole: msf-remote-console

Remote msfconsole A remote msfconsole written in Python 2.7 to connect to the msfrcpd server of metasploit. This tool gives you the ability to load modules permanently as daemon on your server like autopwn2. Although it gives you the ability to remotely use the msfrpcd server it is recommended to...

System privilege elevation vulnerability in Guangsheng FOTA service for multiple mtk platform phones (Phantom Vulnerability)

Shanghai Guangsheng Information Technology Co., Ltd. is the world's leading provider of terminal management cloud platform, FOTA Wireless Upgrade provides professional wireless upgrade solutions for IoT devices smart car, wearable, home, VR, etc.. System privilege elevation vulnerability exists i...

CVE-2016-7488: Undefined Security Weakness

Teradata Virtual Machine Community Edition v15.10 has insecure file permissions on /etc/luminex/pkgmgr. These could allow a local user to modify its contents and execute commands as root...

Arbitrary File Read Vulnerability in zzcms 7.2 Version

ZZCMS highlights the investment and supply and demand functions, you can quickly build a product investment website. ZZCMS v7.1 has an arbitrary file read vulnerability that can be exploited by an attacker to access restricted directories and execute commands outside the root directory of the web...

Yokogawa STARDOM Authentication Bypass Vulnerability

Yokogawa STARDOM is prone to an authenticatio bypass vulnerability. SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...