9485 matches found
VulnCheck KEV: CVE-2019-17230
includes/theme-functions.php in the OneTone theme through 3.0.6 for WordPress allows unauthenticated options changes...
CVE-2019-11480
The pc-kernel snap build process hardcoded the --allow-insecure-repositories and --allow-unauthenticated apt options when creating the build chroot environment. This could allow an attacker who is able to perform a MITM attack between the build environment and the Ubuntu archive to install a...
Privilege Escalation
The Apache HTTP Server is vulnerable to Privilege Escalation. A flaw was found in the handling of the "Options" and "AllowOverride" directives. In configurations using the "AllowOverride" directive with certain "Options=" arguments, local users were not restricted from executing commands from a...
Remote Code Execution (RCE)
node-mpv is vulnerable to remote code execution RCE. The vulnerability exists because the parameter options was not sanitized properly, allowing to be controlled by the attacker by sending malicious code to execute...
WordPress OneTone theme unauthorized operation vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.OneTone theme is a responsive website theme plugin used in it. A security vulnerability exists in the includes/theme-functions.php file...
CVE-2020-7632
node-mpv through 1.4.3 is vulnerable to Command Injection. It allows execution of arbitrary commands via the options argument...
CVE-2020-7635
compass-compile through 0.0.1 is vulnerable to Command Injection.It allows execution of arbitrary commands via tha options argument...
CVE-2020-7635
compass-compile through 0.0.1 is vulnerable to Command Injection.It allows execution of arbitrary commands via tha options argument...
Command injection
node-mpv through 1.4.3 is vulnerable to Command Injection. It allows execution of arbitrary commands via the options argument...
CVE-2020-7635
compass-compile through 0.0.1 is vulnerable to Command Injection.It allows execution of arbitrary commands via tha options argument...
Remote Code Execution (RCE)
install-package is vulnerable to remote code execution RCE. The attack is possible due to lack of sanitization of options parameter, allowing an attack to take the control of it and execute malicious code...
UBUNTU-CVE-2020-11565
An issue was discovered in the Linux kernel through 5.6.2. mpolparsestr in mm/mempolicy.c has a stack-based out-of-bounds write because an empty nodelist is mishandled during mount option parsing, aka CID-aa9f7d5172fa. NOTE: Someone in the security community disagrees that this is a vulnerability...
The vulnerability of TCP protocols in real-time operating systems like Wind River VxWorks allows attackers to trigger service interruptions.
The vulnerability of the TCP protocol in real-time operating systems like Wind River VxWorks is related to errors in the creation of TCP options. Exploiting this vulnerability can allow a malicious actor to cause service interruptions remotely...
CVE-2020-7635: Improper Neutralization of Special Elements used in an OS Command
compass-compile through 0.0.1 is vulnerable to Command Injection.It allows execution of arbitrary commands via tha options argument...
CVE-2020-7632: Improper Neutralization of Special Elements used in an OS Command
node-mpv through 1.4.3 is vulnerable to Command Injection. It allows execution of arbitrary commands via the options argument...
Command Injection
Overview compass-compile is a Compass wrapper for node.js. Affected versions of this package are vulnerable to Command Injection. The options argument can be controlled by users without any sanitization. PoC var Root = require'compass-compile'; var root = new Root; var options =...
Command Injection
Overview node-mpv is a wrapper to comfortably use mpv player with node.js. Affected versions of this package are vulnerable to Command Injection. The argument "options" can be controlled by users without any sanitization. PoC var Root = require"node-mpv"; var options = "binary": '" $touch JHU "'...
CVE-2019-17230
includes/theme-functions.php in the OneTone theme through 3.0.6 for WordPress allows unauthenticated options changes...
