CVE-2019-12735

getchar.c in Vim before 8.1.1365 and Neovim before 0.3.6 allows remote attackers to execute arbitrary OS commands via the :source! command in a modeline, as demonstrated by execute in Vim, and assertfails or nviminput in Neovim...

CVE-2019-12735

CVE-2019-12735 affects Vim and the Neovim fork, where the ":source!" command was not filtered inside a sandbox, enabling shell command execution via a crafted file opened in Vim/Neovim. Connected documents confirm affected products include vim (and Neovim) across multiple distributions (Debian, C...

CVE-2019-11444

An issue was discovered in Liferay Portal CE 7.1.2 GA3. An attacker can use Liferay's Groovy script console to execute OS commands. Commands can be executed via a command.execute call, as demonstrated by "def cmd =" in the ServerAdminPortletscript value to group/controlpanel/manage. Valid...

Input validation

DISPUTED An issue was discovered in Liferay Portal CE 7.1.2 GA3. An attacker can use Liferay's Groovy script console to execute OS commands. Commands can be executed via a command.execute call, as demonstrated by "def cmd =" in the ServerAdminPortletscript value to group/controlpanel/manage. Vali...

CVE-2019-11444

Affected software: Liferay Portal CE 7.1.2 GA3. Issue: Groovy script console allows OS command execution via a command.execute() call (def cmd = ...) in ServerAdminPortlet_script. Exploitation requires valid application administrator credentials. Impact: remote command execution with high severit...

CVE-2019-11444

An issue was discovered in Liferay Portal CE 7.1.2 GA3. An attacker can use Liferay's Groovy script console to execute OS commands. Commands can be executed via a command.execute call, as demonstrated by "def cmd =" in the ServerAdminPortletscript value to group/controlpanel/manage. Valid...

PT-2019-12309 · Liferay · Liferay Portal

Name of the Vulnerable Software and Affected Versions: Liferay Portal CE version 7.1.2 GA3 Description: An issue in Liferay Portal CE allows an attacker to execute OS commands using the Groovy script console. This can be achieved via a command.execute call. The attacker needs valid credentials fo...

CVE-2018-20323

www/soap/application/MCSoap/Logs.php in MailCleaner Community Edition 2018.08 allows remote attackers to execute arbitrary OS commands...

CVE-2018-20323

CVE-2018-20323 affects MailCleaner Community Edition 2018.08. The vulnerability is a command-injection in www/soap/application/MCSoap/Logs.php that allows an authenticated user to execute arbitrary OS commands on the web server when accessing the /admin/managetracing/search/search endpoint. Publi...

[SECURITY] [DLA 1700-1] uw-imap security update

Package : uw-imap Version : 8:2007fdfsg-4+deb8u1 CVE ID : CVE-2018-19518 Debian Bug : 914632 A vulnerability was discovered in uw-imap, the University of Washington IMAP Toolkit, that might allow remote attackers to execute arbitrary OS commands if the IMAP server name is untrusted input e.g.,...

PT-2019-6248 · Vim +8 · Vim +8

Name of the Vulnerable Software and Affected Versions: Vim versions prior to 8.1.0881 Description: The issue is related to the lack of input sanitization in the Vim text editor, allowing an attacker to access confidential data, compromise its integrity, and cause a denial of service. In Vim, user...

CVE-2018-0638

Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via import.cgi encKey parameter...

CVE-2018-0639

Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via toolsfirmware.cgi date parameter, time parameter, and offset parameter...

CVE-2018-0637

Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via export.cgi encKey parameter...

Design/Logic Flaw

Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via export.cgi encKey parameter...

Sql injection

Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via toolsfirmware.cgi date parameter, time parameter, and offset parameter...

Design/Logic Flaw

Aterm W300P Ver1.0.13 and earlier allows attacker with administrator rights to execute arbitrary OS commands via targetAPSsid parameter...

CVE-2018-0636

Aterm HC100RC Ver1.0.1 and earlier allows attacker with administrator rights to execute arbitrary OS commands via FactoryPassword parameter of a certain URL, different URL from CVE-2018-0634...

CVE-2018-0634

NEC Aterm HC100RC router (Firmware v1.0.1 and earlier) is affected by CVE-2018-0634 and related CVEs. A local attacker with administrator rights can execute arbitrary OS commands by supplying crafted values to the FactoryPassword or bootmode URL parameters. The issue is documented across multiple...

CVE-2018-0638

The CVE-2018-0638 issue affects NEC/Aterm HC100RC devices (firmware Ver1.0.1 and earlier). A local-administrator level attacker can exploit an OS command injection via the import.cgi encKey parameter to execute arbitrary commands on the underlying OS. The vulnerability arises in the product’s web...