Design/Logic Flaw

In the Upload Modules page in GeniXCMS 1.1.4, remote authenticated users can execute arbitrary PHP code via a .php file in a ZIP archive of a module...

CVE-2017-14763

In the Install Themes page in GeniXCMS 1.1.4, remote authenticated users can execute arbitrary PHP code via a .php file in a ZIP archive of a theme...

NodeJS Debugger Command Injection

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "NodeJS Debugger Command Injection", 'Description' = %q This module uses the "evaluate" request type of the NodeJS V8 debugger protocol version 1 t...

Cash Back Comparison Script SQL Injection Vulnerability

Cash Back Comparison Script is a cash back script. A SQL injection vulnerability exists in Cash Back Comparison Script version 1.0. A remote attacker can exploit this vulnerability to execute arbitrary SQL commands...

CVE-2015-5181

The JBoss console in A-MQ allows remote attackers to execute arbitrary JavaScript...

Design/Logic Flaw

The JBoss console in A-MQ allows remote attackers to execute arbitrary JavaScript...

CVE-2017-7972

CVE-2017-7972 affects Schneider Electric PowerSCADA Anywhere 1.0 (redistributed with PowerSCADA Expert v8.1/v8.2) and Citect Anywhere 1.0. The root cause is improper neutralization of expression/command delimiters, enabling an attacker to escape a remote PowerSCADA Anywhere application and launch...

PT-2017-7223 · Red Hat · Red Hat Enterprise Virtualization Manager

Name of the Vulnerable Software and Affected Versions: Red Hat Enterprise Virtualization Manager versions prior to 3.6 Description: The issue allows remote authenticated users with the SuperUser role on any Entity to execute arbitrary commands on any host in the environment. Recommendations: For...

Chromium: Multiple vulnerabilities

Background Chromium is an open-source browser project that aims to build a safer, faster, and more stable way for all users to experience the web. Description Multiple vulnerabilities have been discovered in Chromium. Please review the referenced CVE identifiers for details. Impact A remote...

CVE-2017-14078

SQL Injection vulnerabilities in Trend Micro Mobile Security Enterprise versions before 9.7 Patch 3 allow remote attackers to execute arbitrary code on vulnerable installations...

New Relic .NET Agent SQL Injection Vulnerability

New Relic .NET Agent is a . A SQL injection vulnerability exists in New Relic .NET Agent versions prior to 6.3.123.0. A remote attacker can exploit this vulnerability to execute arbitrary SQL commands...

The vulnerability of the libgdx library in the Android operating system allows a hacker to execute arbitrary code.

The vulnerability of the libgdx library in the Android operating system is related to lack of access control. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

The vulnerability of the VMSF_DELTA memory component of the UnRAR file decompression tool and the Sophos Anti-Virus antivirus protection allows a perpetrator to execute arbitrary code.

The vulnerability of the VMSFDELTA component, a file decompression tool, and the UnRAR decompression tool is caused by a numerical overflow. This occurs when the variable MemDestPos exceeds its allowable limits due to the negative value of the argument DestPos during the summation of DataSize and...

The vulnerability of the libstagefright library in the Media Framework of the Android operating system allows a hacker to execute arbitrary code.

The vulnerability of the libstagefright library in the Media Framework of the Android operating system is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Code injection

The ping tool in multiple D-Link and TRENDnet devices allow remote attackers to execute arbitrary code via the pingaddr parameter to ping.ccp...

Disk Pulse Enterprise 9.9.16 GET Buffer Overflow

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Disk Pulse Enterprise GET Buffer Overflow', 'Description' = %q This module exploits an SEH buffer overflow in Disk Pulse Enterprise 9.9.16. If a...

CVE-2015-1329

Use-after-free vulnerability in oxide::qt::URLRequestDelegatedJob in oxide-qt in Ubuntu 15.04 and 14.04 LTS might allow remote attackers to execute arbitrary code...

QNAP NAS medialibrary component remote code execution vulnerability

QNAP NAS is a set of network storage devices from QNAP Systems. It is used for home, SOHO, and SMB users. medialibrary component is one of the multimedia components. A security vulnerability exists in the media library component of QNAP NAS version 4.3.3.0229. A remote attacker can exploit this...

emacs: command injection flaw within "enriched mode" handling

A command injection flaw within the Emacs "enriched mode" handling has been discovered. By tricking an unsuspecting user into opening a specially crafted file using Emacs, a remote attacker could exploit this flaw to execute arbitrary commands with the privileges of the Emacs user...

Design/Logic Flaw

In the medialibrary component in QNAP NAS 4.3.3.0229, an un-authenticated, remote attacker can execute arbitrary system commands as the root user of the NAS application...