[ASA-202002-11] chromium: multiple issues

Arch Linux Security Advisory ASA-202002-11 ========================================== Severity: High Date : 2020-02-25 CVE-ID : CVE-2020-6407 CVE-2020-6418 Package : chromium Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1102 Summary ======= The package chromium...

OpenSMTPD Out-Of-Bounds Read

Qualys Security Advisory LPE and RCE in OpenSMTPD's default install CVE-2020-8794 ============================================================================== Contents ============================================================================== Summary Analysis ... Acknowledgments...

CVE-2020-4222

IBM Spectrum Protect Plus 10.1.0 and 10.1.5 could allow a remote attacker to execute arbitrary code on the system. By using a specially crafted HTTP command, an attacker could exploit this vulnerability to execute arbitrary command on the system. IBM X-Force ID: 175091...

ksh: certain environment variables interpreted as arithmetic expressions on startup, leading to code injection

A flaw was found in the way ksh evaluates certain environment variables. An attacker could use this flaw to override or bypass environment restrictions to execute shell commands. Services and applications that allow remote unauthenticated attackers to provide one of those environment variables...

NEC Aterm WG2600HS OS Command Execution Vulnerability

The NEC Aterm WG2600HS is a wireless router from Nippon Electric NEC. An operating system command injection vulnerability exists in the NEC Aterm WG2600HS version 1.3.2, which arises from a network system or product not properly filtering special characters, commands, etc. from external input dat...

Design/Logic Flaw

graphrealtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has the graph real-time privilege...

CVE-2020-8813

graphrealtime.php in Cacti 1.2.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in a cookie, if a guest user has the graph real-time privilege...

CVE-2020-6841

D-Link DCH-M225 1.05b01 and earlier devices allow remote attackers to execute arbitrary OS commands via shell metacharacters in the spotifyConnect.php userName parameter...

CVE-2020-6841

D-Link DCH-M225 1.05b01 and earlier devices allow remote attackers to execute arbitrary OS commands via shell metacharacters in the spotifyConnect.php userName parameter...

Design/Logic Flaw

D-Link DCH-M225 1.05b01 and earlier devices allow remote attackers to execute arbitrary OS commands via shell metacharacters in the spotifyConnect.php userName parameter...

CVE-2020-6842

D-Link DCH-M225 (version 1.05b01 and earlier) is affected. The issue is a command injection where remote authenticated admins can execute arbitrary OS commands via shell metacharacters in the media renderer name, due to insufficient input sanitization. Documented impact aligns with high severity ...

CVE-2020-6841

D-Link DCH-M225 1.05b01 and earlier devices allow remote attackers to execute arbitrary OS commands via shell metacharacters in the spotifyConnect.php userName parameter...

Synacor Zimbra Collaboration Operating System Command Injection Vulnerability

Synacor Zimbra Collaboration Suite ZCS is an open source collaboration suite from Synacor, USA. The product includes WebMail, Calendar, Address Book and more. An operating system command injection vulnerability exists in Synacor Zimbra Collaboration versions prior to 8.0.9. The vulnerability stem...

Hyperledger: RCE vulnerability in Hyperledger Fabric SDK for Java

Hyperledger Fabric SDK for Java version 2.0.0 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types, resulting in a remote code execution vulnerability. In the following source code files and corresponding line number, an arbitrary file gets parsed by...

CVE-2020-5242

openHAB before 2.5.2 allow a remote attacker to use REST calls to install the EXEC binding or EXEC transformation service and execute arbitrary commands on the system with the privileges of the user running openHAB. Starting with version 2.5.2 all commands need to be whitelisted in a local file...

CVE-2014-4657

The safeeval function in Ansible before 1.5.4 does not properly restrict the code subset, which allows remote attackers to execute arbitrary code via crafted instructions...

CVE-2013-2018

Multiple SQL injection vulnerabilities in BOINC allow remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2020-3154

Cisco Cloud Web Security (CWS) web UI contains a SQL injection vulnerability. The web-based management interface improperly validates SQL values, allowing an authenticated, remote attacker to send malicious requests to an affected device and modify or return values from the underlying database. A...

Exploit for Improper Handling of Exceptional Conditions in Openbsd Opensmtpd

CVE-2020-7247 Proof Of Concept Exploit for CVE...

CVE-2020-8010 Nimbus protocol allows unauth read/write/execute

CA Unified Infrastructure Management Nimsoft/UIM 20.1, 20.3.x, and 9.20 and below contains an improper ACL handling vulnerability in the robot controller component. A remote attacker can execute commands, read from, or write to the target system...