Remote code execution

A Remote Code Execution vulnerability exists in DourceCodester Alumni Management System 1.0. An authenticated attacker can upload arbitrary file in the gallery.php page and executing it on the server reaching the RCE...

CVE-2020-28072

CVE-2020-28072 affects DourceCodester Alumni Management System 1.0. An authenticated attacker can upload arbitrary PHP files via gallery.php and execute them on the server, achieving Remote Code Execution. Root cause is improper file upload handling enabling arbitrary file upload and execution. E...

FreeBSD : glpi -- Remote Code Execution (RCE) via the backup functionality (832fd11b-3b11-11eb-af2a-080027dbe4b7)

MITRE Corporation reports : In GLPI before 9.4.6, an attacker can execute system commands by abusing the backup functionality. Theoretically, this vulnerability can be exploited by an attacker without a valid account by using a CSRF. Due to the difficulty of the exploitation, the attack is only...

CVE-2020-25112

An issue was discovered in the IPv6 stack in Contiki through 3.0. There are inconsistent checks for IPv6 header extension lengths. This leads to Denial-of-Service and potential Remote Code Execution via a crafted ICMPv6 echo packet...

CVE-2020-24338

An issue was discovered in picoTCP through 1.7.0. The DNS domain name record decompression functionality in picodnsdecompressname in picodnscommon.c does not validate the compression pointer offset values with respect to the actual data present in a DNS response packet, causing out-of-bounds writ...

CVE-2020-25112

An issue was discovered in the IPv6 stack in Contiki through 3.0. There are inconsistent checks for IPv6 header extension lengths. This leads to Denial-of-Service and potential Remote Code Execution via a crafted ICMPv6 echo packet...

CVE-2020-25112

The CVE-2020-25112 entry corresponds to a memory-corruption vulnerability in Contiki’s uIP-Contiki-OS IPv6 stack. The issue arises from insufficient and inconsistent checks of IPv6 header extension lengths, enabling crafted ICMPv6 or other IPv6-extension-based packets to trigger memory corruption...

CVE-2020-25107

CVE-2020-25107 has concrete details in the connected SUSE advisory: it concerns Nut/Net’s DNS processing (the DNS questions/responses path) in Nut/OS Nut/Net. The vulnerability is an out-of-bounds read (CWE-125) in the DNS handling code, reported for Nut/Net 5.1 and prior, with a CVSSv3 base scor...

CVE-2020-24338

An issue was discovered in picoTCP through 1.7.0. The DNS domain name record decompression functionality in picodnsdecompressname in picodnscommon.c does not validate the compression pointer offset values with respect to the actual data present in a DNS response packet, causing out-of-bounds writ...

Zero-Click Wormable RCE Vulnerability in Cisco Jabber Gets Fixed, Again

Cisco Systems released an updated patch for a critical vulnerability in its video and instant messaging platform Jabber, originally patched in September. The cross-site scripting bug could have allowed an adversary to execute arbitrary code by merely sending a specially-crafted chat message and...

CVE-2020-17158

Microsoft Dynamics 365 for Finance and Operations on-premises Remote Code Execution Vulnerability...

CVE-2020-17117

Microsoft Exchange Remote Code Execution Vulnerability...

CVE-2020-17152 Microsoft Dynamics 365 for Finance and Operations (on-premises) Remote Code Execution Vulnerability

...

CVE-2020-17152

CVE-2020-17152 affects Microsoft Dynamics 365 for Finance and Operations (on-premises). The connected sources describe a remote code execution vulnerability arising from incorrect code generation management, enabling an attacker to execute arbitrary code on the affected system. The CVSSv3 base sc...

CVE-2020-17142

CVE-2020-17142 is described in the provided materials as a Microsoft Exchange Server remote code execution vulnerability. The connected documents do not specify affected versions, exact root cause, in-the-wild exploit details, or remediation steps within the supplied content. Exploitation status ...

CVE-2020-17117

Technical details for CVE-2020-17117 are not publicly available in the provided documents. Monitor for updates from vendors and CERT advisories.

CVE-2020-7787

CVE-2020-7787 affects all versions of react-adal. The root cause is in how nonce/session/refresh values are stored in browser storage: values are appended with ||, which means an empty string can be accepted in the validation, allowing an attacker-generated JWT to be treated as authentic. Affecte...

Microsoft Releases Windows Update (Dec 2020) to Fix 58 Security Flaws

Microsoft on Tuesday released fixes for 58 newly discovered security flaws spanning as many as 11 products and services as part of its final Patch Tuesday of 2020, effectively bringing their CVE total to 1,250 for the year. Of these 58 patches, nine are rated as Critical, 46 are rated as Importan...

Microsoft Releases Windows Update (Dec 2020) to Fix 58 Security Flaws

Microsoft on Tuesday released fixes for 58 newly discovered security flaws spanning as many as 11 products and services as part of its final Patch Tuesday of 2020, effectively bringing their CVE total to 1,250 for the year. Of these 58 patches, nine are rated as Critical, 46 are rated as Importan...

CVE-2020-26249

Red Discord Bot Dashboard is an easy-to-use interactive web dashboard to control your Redbot. In Red Discord Bot before version 0.1.7a an RCE exploit has been discovered. This exploit allows Discord users with specially crafted Server names and Usernames/Nicknames to inject code into the webserve...