229 matches found
CVE-2020-12754
An issue was discovered on LG mobile devices with Android OS 7.2, 8.0, 8.1, 9, and 10 software. A crafted application can obtain control of device input via the window system service. The LG ID is LVE-SMP-170011 May 2020...
Command Injection
Overview diskusage-ng is a package that get disk usage info in pure JavaScript and without any dependencies. Affected versions of this package are vulnerable to Command Injection. The argument path can be controlled by users without any sanitization. PoC var root = require"diskusage-ng"; root...
CVE-2020-8137
Code injection vulnerability in blamer 1.0.0 and earlier may result in remote code execution when the input can be controlled by an attacker...
git: Arbitrary path overwriting via export-marks in-stream command feature
A flaw was found in the git fast-import command where it provides the export-marks feature that may unexpectedly overwrite arbitrary paths. An attacker can abuse this flaw if they can control the input passed to the fast-import command by using the export-marks feature and overwrite arbitrary...
git: Arbitrary path overwriting via export-marks in-stream command feature
A flaw was found in the git fast-import command where it provides the export-marks feature that may unexpectedly overwrite arbitrary paths. An attacker can abuse this flaw if they can control the input passed to the fast-import command by using the export-marks feature and overwrite arbitrary...
CVE-2019-15598
A Code Injection exists in treekill on Windows which allows a remote code execution when an attacker is able to control the input into the command...
CVE-2019-15598
A Code Injection exists in treekill on Windows which allows a remote code execution when an attacker is able to control the input into the command...
CVE-2019-15599
A Code Injection exists in tree-kill on Windows which allows a remote code execution when an attacker is able to control the input into the command...
CVE-2019-1348
A flaw was found in the git fast-import command where it provides the export-marks feature that may unexpectedly overwrite arbitrary paths. An attacker can abuse this flaw if they can control the input passed to the fast-import command by using the export-marks feature and overwrite arbitrary...
CVE-2016-10894
xtrlock through 2.10 does not block multitouch events. Consequently, an attacker at a locked screen can send input to and thus control various programs such as Chromium via events such as pan scrolling, "pinch and zoom" gestures, or even regular mouse clicks by depressing the touchpad once and th...
Design/Logic Flaw
xtrlock through 2.10 does not block multitouch events. Consequently, an attacker at a locked screen can send input to and thus control various programs such as Chromium via events such as pan scrolling, "pinch and zoom" gestures, or even regular mouse clicks by depressing the touchpad once and th...
The vulnerability of the SnCloneVault.sys driver of the Secret Net Studio information protection system, which allows a hacker to trigger a service failure.
The vulnerability of the SnCloneVault.sys driver of the Secret Net Studio information protection system is related to deficiencies in data input control within the driver. Exploiting this vulnerability can allow attackers to cause service failures...
STOPzilla AntiMalware Arbitrary Write Vulnerability
STOPzilla AntiMalware is a malware removal software. An arbitrary write vulnerability exists in the driver file szkg64.sys in STOPzilla AntiMalware 6.5.2.59. The vulnerability stems from an unverified output buffer address value starting at IOCtl 0x80002063. An attacker can exploit this...
The vulnerability of the Spectrum Power software lies in the lack of proper control over incoming data, allowing a perpetrator to execute arbitrary system commands with administrator privileges.
The vulnerability of the Spectrum Power software relates to the control of incoming data. Exploiting this vulnerability allows a remote attacker to execute arbitrary system commands with administrator privileges, using ports 80/TCP and 443/TCP...
Information Disclosure
jenkins is vulnerable to information disclosure. The vulnerability exists through the input control in PasswordParameterDefinition where the default value can be used to obtain passwords...
Code injection
IBM WebSphere Commerce 9.0.0.0 through 9.0.0.6 could allow some server-side code injection due to inadequate input control. IBM X-Force ID: 149828...
CVE-2018-1808
IBM WebSphere Commerce 9.0.0.0 through 9.0.0.6 could allow some server-side code injection due to inadequate input control. IBM X-Force ID: 149828...
CVE-2018-1808
IBM WebSphere Commerce 9.0.0.0 through 9.0.0.6 could allow some server-side code injection due to inadequate input control. IBM X-Force ID: 149828...
CVE-2018-1808
CVE-2018-1808 affects IBM WebSphere Commerce versions 9.0.0.0 through 9.0.0.6, where inadequate input control could allow server-side code injection. The trusted sources in the provided documents identify the impact as server-side code injection, with the NVD listing CVSS3 base score 8.8 (HIGH) a...