4221 matches found
CVE-2018-7785
In Schneider Electric U.motion Builder software versions prior to v1.3.4, a remote command injection allows authentication bypass...
CVE-2018-7785: Improper Neutralization of Special Elements used in a Command
In Schneider Electric U.motion Builder software versions prior to v1.3.4, a remote command injection allows authentication bypass...
Nikto 2.1.6 - CSV Injection
Nikto 2.1.6 - CSV Injection Exploit Title: Nikto 2.1.6 - CSV Injection Google Dork: N/A Date: 2018-06-01 Exploit Author: Adam Greenhill Vendor Homepage: https://cirt.net/Nikto2 Software Link: https://github.com/sullo/nikto Affected Version: 2.1.6, 2.1.5 Category: Applications Tested on: Kali Linu...
Security Bulletin: IBM QRadar Incident Forensics, as found in IBM QRadar SIEM, is vulnerable to an authentication bypass leading to remote command injection. (CVE-2018-1418)
Summary An authentication bypass leading to remote command injection has been found in IBM QRadar Incident Forensics. Vulnerability Details CVEID: CVE-2018-1418 DESCRIPTION: IBM QRadar Incident Forensics could allow a user to bypass authentication which could lead to code execution. CVSS Base...
QNAP QTS Remote Command Injection (CVE-2013-0143)
Remote command injection vulnerabilities exist in QNAP QTS. A remote attacker can exploit these weaknesses to execute arbitrary commands in the affected devices via a crafted request...
Fedora 26 : mysql-mmm (2018-92f04c6b61)
Multi-Master Replication Manager for MySQL mmmagentd Remote Command Injection Vulnerabilities This update adds data sanitization to inputs for the mmm agent. Multiple exploitable remote command injection vulnerabilities exist in the MySQL Master-Master Replication Manager MMM mmmagentd daemon...
Fedora 27 : mysql-mmm (2018-e31f52c5ee)
Multi-Master Replication Manager for MySQL mmmagentd Remote Command Injection Vulnerabilities This update adds data sanitization to inputs for the mmm agent. Multiple exploitable remote command injection vulnerabilities exist in the MySQL Master-Master Replication Manager MMM mmmagentd daemon...
CVE-2018-10992
lilypond-invoke-editor in LilyPond 2.19.80 does not validate strings before launching the program specified by the BROWSER environment variable, which allows remote attackers to conduct argument-injection attacks via a crafted URL, as demonstrated by a --proxy-pac-file argument, because the GNU...
Git Remote Command Injection Vulnerability
Git is a free, open source distributed version control system developed by American software developer Linus Torvalds Linus Torvalds. A command vulnerability exists in Git versions prior to 2.7.5. A remote attacker can run an arbitrary device with the help of a specially crafted 'ssh://...' URL t...
Command Execution Vulnerability in Panabit
Panabit is the intelligent application gateway software developed by PaiNet based on PanaOS operating system. Panabit suffers from a command execution vulnerability. An attacker can obtain root privileges by constructing a payload for remote command injection with web privileges...
Vulnerability Spotlight: MySQL Multi-Master Manager Remote Command Injection Vulnerability
Discovered by Matthew Van Gundy of Asig Overview Today, Talos is releasing details of a new vulnerability within MySQL Multi-Master Manager. This is used to perform monitoring, failover and management of MySQL master-master replication configurations. By using MySQL MMM Multi-Master Replication...
Multi-Master Replication Manager for MySQL mmm_agentd Remote Command Injection Vulnerabilities
Summary Multiple exploitable remote command injection vulnerabilities exist in the MySQL Master-Master Replication Manager MMM mmmagentd daemon 2.2.1. mmmagentd commonly runs with root privileges and does not require authentication by default. A specially crafted MMM protocol message can cause a...
CVE-2018-1238
Dell EMC ScaleIO versions prior to 2.5, contain a command injection vulnerability in the Light Installation Agent LIA. This component is used for central management of ScaleIO deployment and uses shell commands for certain actions. A remote malicious user, with network access to LIA and knowledge...
PowerShell Downgrade Attack: Unicorn
PowerShell Downgrade Attack Magic Unicorn is a simple tool for using a PowerShell downgrade attack and inject shellcode straight into memory. Based on Matthew Graeber’s powershell attacks and the powershell bypass technique presented by David Kennedy TrustedSec and Josh Kelly at Defcon 18. Usage ...
Remote Command Injection Vulnerability in Riptide Networks NBR1300G-E&RG-EG2000CE-1T
Riptide Networks NBR1300G-E is a new generation gateway product. Riptide Networks RG-EG2000CE-1T is an SSL VPN device. A remote command injection vulnerability exists in Riptide Networks NBR1300G-E & RG-EG2000CE-1T. An attacker can send malicious code to realize remote command injection before...
Zoho ManageEngine Applications Manager Remote Code Execution Vulnerability (CNVD-2018-06478)
ZOHO ManageEngine Applications Manager is a set of application performance monitoring software from ZOHO. The software allows remote monitoring and management of different business systems, applications and network services e.g. servers, operating systems, etc.. A command injection vulnerability...
Multiple IoT Vendors – Multiple Vulnerabilities
Vulnerabilities summary The following advisory describes three 3 vulnerabilities found in the following vendors: Lorex StarVedia Eminent Kraun The vulnerabilities found: Hard-coded credentials Remote command injection 2 It is possible to chain the vulnerabilities and to achieve unauthenticated...
USN-3571-1 erlang vulnerabilities
It was discovered that the Erlang FTP module incorrectly handled certain CRLF sequences. A remote attacker could possibly use this issue to inject arbitrary FTP commands. This issue only affected Ubuntu 14.04 LTS. CVE-2014-1693 It was discovered that Erlang incorrectly checked CBC padding bytes. ...
RubyGems echor 'backplane.rb' remote command injection vulnerability
RubyGems echor is a Ruby-based Echo application developed by software developer Pedro Del Gallego. A remote command injection vulnerability exists in RubyGems echor, which stems from the program failing to adequately filter user-submitted input data. An attacker could use this vulnerability to...
