Remote code execution

Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin 1.3 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability...

Oracle WebLogic Server Java Object Deserialization RCE (CVE-2020-2883)

Binary data oracleweblogicservercve20202883.nbin...

Improper Control of Generation of Code ('Code Injection')

The is a code injection vulnerability in versions of Rails that wouldallow an attacker who controlled the locals argument of a render call to perform a RCE...

Microsoft Windows Codecs Library Multiple RCE Vulnerabilities

This host is missing an important security update according to Microsoft updates for Windows Codecs Library. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

CVE-2020-5902

In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface TMUI, also referred to as the Configuration utility, has a Remote Code Execution RCE vulnerability in undisclosed pages...

Exploit for Incorrect Calculation in Google Android

BluefragCVE-2020-0022 This is a RCE bluetooth vulnerability o...

CVE-2020-5902

In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface TMUI, also referred to as the Configuration utility, has a Remote Code Execution RCE vulnerability in undisclosed pages...

CVE-2020-5902

CVE-2020-5902 is an unauthenticated RCE in F5 BIG-IP TMUI (Traffic Management User Interface). The root cause is a path traversal/authentication bypass flaw in TMUI that allows remote attackers to trigger arbitrary code execution on vulnerable BIG-IP devices. Affected versions include multiple 11...

F5 Networks BIG-IP : TMUI RCE vulnerability (K52145254)

The version of F5 Networks BIG-IP installed on the remote host is prior to 11.6.5.2 / 12.1.5.2 / 13.1.3.4 / 14.1.2.6 / 15.0.1.4 / 15.1.0.4 / 16.0.0. It is, therefore, affected by a vulnerability as referenced in the K52145254 advisory. - In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5,...

PrestaShop Responsive Mega Menu Module RCE / SQLi Vulnerability

The SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:prestashop:prestashop"; ifdescription scriptoid"1.3.6.1.4.1.25623.1.0.144185"...

Node.js third-party modules: property-expr - Prototype pollution

I would like to report Prototype pollution in property-expr It allows attacker to modify the prototype of a base object. Module module name: property-expr version: 2.0.2 npm page: https://www.npmjs.com/package/property-expr Module Description Tiny property path utilities, including path parsing a...

'Satori' IoT DDoS Botnet Operator Sentenced to 13 Months in Prison

The United States Department of Justice yesterday sentenced a 22-year-old Washington-based hacker to 13 months in federal prison for his role in creating botnet malware, infecting a large number of systems with it, and then abusing those systems to carry out large scale distributed...

Huawei EulerOS: Security Advisory for python-paramiko (EulerOS-SA-2020-1703)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS Virtualization for ARM 64 3.0.6.0 : python-paramiko (EulerOS-SA-2020-1703)

According to the version of the python-paramiko package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - Paramiko version 2.4.1, 2.3.2, 2.2.3, 2.1.5, 2.0.8, 1.18.5, 1.17.6 contains a Incorrect Access Control...

CVE-2020-11960

Xiaomi router R3600 ROM before 1.0.50 is affected by a vulnerability when checking backup file in cupload interface let attacker able to extract malicious file under any location in /tmp, lead to possible RCE and DoS...

Design/Logic Flaw

Xiaomi router R3600 ROM before 1.0.50 is affected by a vulnerability when checking backup file in cupload interface let attacker able to extract malicious file under any location in /tmp, lead to possible RCE and DoS...

CVE-2020-11960

Xiaomi router R3600 ROM before 1.0.50 is affected by a vulnerability when checking backup file in cupload interface let attacker able to extract malicious file under any location in /tmp, lead to possible RCE and DoS...

CVE-2020-11960

The CVE-2020-11960 entry concerns the Xiaomi router R3600 ROM prior to 1.0.50. A flaw in the c_upload interface’s backup file handling lets an attacker extract a malicious file to arbitrary /tmp locations, enabling potential remote code execution and denial of service. The NVD description documen...

CVE-2020-14972

CVE-2020-14972 affects Sourcecodester Pisay Online E-Learning System 1.0. Connected sources describe multiple SQL injection vulnerabilities in the admin login-portal and the edit-lessons pages that allow remote unauthenticated attackers to bypass authentication and achieve Remote Code Execution (...

Online Student Enrollment System 1.0 Arbitrary File Upload

Exploit Title: Online Student Enrollment System 1.0 - Unauthenticated Arbitrary File Upload Google Dork: N/A Date: 2020-06-20 Exploit Author: BKpatron Vendor Homepage: https://www.campcodes.com/projects/php/4745/online-student-enrollment-system-in-php-mysqli/ Software Link:...