CVE-2020-4627

IBM Cloud Pak for Security 1.3.0.1CP4S potentially vulnerable to CVS Injection. A remote attacker could execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 185367...

CVE-2020-4627

CVE-2020-4627 affects IBM Cloud Pak for Security (CP4S) version 1.3.0.1, where a vulnerability in the handling/validation of CSV file contents could allow a remote attacker to execute arbitrary commands. The root cause is improper validation of CSV data leading to CVS Injection. The IBM security ...

mariadb: Insufficient SST method name check leading to code injection in mysql-wsrep

A flaw was found in the mysql-wsrep component of mariadb. Lack of input sanitization in wsrepsstmethod allows for command injection that can be exploited by a remote attacker to execute arbitrary commands on galera cluster nodes. This threatens the system's confidentiality, integrity, and...

CVE-2020-27660

SQL injection vulnerability in request.cgi in Synology SafeAccess before 1.2.3-0234 allows remote attackers to execute arbitrary SQL commands via the domain parameter...

Git LFS Remote Code Execution (CVE-2020-27955)

A remote code execution vulnerability exists in Git LFS. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

The vulnerability of the vRealize Suite Lifecycle Manager software, a virtualization platform from VMware Cloud Foundation, and administration consoles like VMware Identity Manager and VMware Workspace One Access, arises due to insufficient validation of arguments passed to commands. This allows attackers to execute arbitrary commands.

The vulnerability of the vRealize Suite Lifecycle Manager software, a virtualization platform from VMware Cloud Foundation, as well as the VMware Identity Manager administration consoles and VMware Workspace One Access application management platform, is related to insufficient validation of...

Cisco Security Manager Input Validation Error Vulnerability

Cisco Security Manager CSM is a suite of enterprise-level management applications from Cisco that are used to configure firewall, VPN, and intrusion protection security services on Cisco network and security devices. A security vulnerability exists in Cisco Security Manager that stems from affect...

The vulnerability of the HEVC Video Extension codec, related to improper code generation, allows a perpetrator to execute arbitrary code.

The vulnerability of the HEVC Video Extension codec is related to improper code generation control. Exploiting this vulnerability may allow a remote attacker to execute arbitrary code...

CVE-2020-3470 Cisco Integrated Management Controller Multiple Remote Code Execution Vulnerabilities

Multiple vulnerabilities in the API subsystem of Cisco Integrated Management Controller IMC could allow an unauthenticated, remote attacker to execute arbitrary code with root privileges. The vulnerabilities are due to improper boundary checks for certain user-supplied input. An attacker could...

Design/Logic Flaw

httpd on TP-Link TL-WPA4220 devices versions 2 through 4 allows remote authenticated users to execute arbitrary OS commands by sending crafted POST requests to the endpoint /admin/powerline. Fixed version: TL-WPA4220EUV4201023...

Cisco DNA Spaces 操作系统命令注入漏洞

Cisco DNA Spaces: Connector is used to connect Cisco DNA Spaces to a Cisco wireless controller. A command injection vulnerability exists in the Web management interface of the Cisco DNA Spaces Connector version 2.2 and earlier. The vulnerability stems from insufficient validation of user-supplied...

The vulnerability of the application for extending HEVC Video Extensions is related to errors in code generation, allowing a perpetrator to execute arbitrary code.

The vulnerability of the application for extending HEVC Video Extensions is related to errors in code generation. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

Multiple Industrial Control System Vendors Warn of Critical Bugs

Industrial control system firms Real Time Automation and Paradox both warned of critical vulnerabilities Tuesday that opened systems up to remote attacks by adversaries. Flaws are rated 9.8 out of 10 in severity by the industry standard Common Vulnerability Scoring System. The Real Time Automatio...

CVE-2020-27131

Multiple vulnerabilities in the Java deserialization function that is used by Cisco Security Manager could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected device. These vulnerabilities are due to insecure deserialization of user-supplied content by the...

Paradox IP150 Buffer Error Vulnerability

Paradox IP150 is a communication module from Paradox Corporation of the United States that provides monitoring and management of Paradox devices over the Internet. The module provides a web interface to monitor and manage connected Paradox devices. A buffer error vulnerability exists in Paradox...

CVE-2020-27131

Multiple vulnerabilities in the Java deserialization function that is used by Cisco Security Manager could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected device. These vulnerabilities are due to insecure deserialization of user-supplied content by the...

HorizontCMS Code Injection Vulnerability

HorizontCMS is a customer relationship management web platform for individual developers. A code injection vulnerability exists in the HorizontCMS product, which can be exploited by remote attackers to execute arbitrary PHP code by uploading a PHP payload...

Zimbra Collaboration Server < 8.8.15 P10 / 9.x < 9.0.0 P3 Unrestricted Upload

According to its self-reported version number, Zimbra Collaboration Server is below 8.8.15 Patch 10, or 9.x prior to 9.0.0 Patch 3. It is, therefore, affected by an unrestricted upload vulnerability in the '/service/upload' servlet. An authenticated, remote attacker can exploit this, by uploading...

CVE-2020-24719

Exposed Erlang Cookie could lead to Remote Command Execution RCE attack. Communication between Erlang nodes is done by exchanging a shared secret aka "magic cookie". There are cases where the magic cookie is included in the content of the logs. An attacker can use the cookie to attach to an Erlan...

CVE-2020-27386

An unrestricted file upload issue in FlexDotnetCMS before v1.5.9 allows an authenticated remote attacker to upload and execute arbitrary files by using the FileManager to upload malicious code e.g., ASP code in the form of a safe file type e.g., a TXT file, and then using the FileEditor in v1.5.8...