CVE-2020-24631

A remote execution of arbitrary commands vulnerability was discovered in Aruba Airwave Software versions: Prior to 1.3.2...

CVE-2020-24631

CVE-2020-24631 is a remote command execution vulnerability affecting Aruba Airwave Software versions prior to 1.3.2. All connected documents identify Aruba Airwave as the affected product, with the issue described as allowing execution of arbitrary commands remotely. The root cause details are no...

Google patches actively exploited zero-day bug that affects Chrome users

Google has recently released Chrome version 86.0.4240.111 to patch several holes. One is for a zero-day flaw - that means a vulnerability that is being actively exploited in the wild. The flaw, which is officially designated as CVE-2020-15999, occurs in the way FreeType handles PNG images embedde...

Ajenti 2.1.36 - Remote Code Execution (Authenticated)

!/usr/bin/python3 import requests import sys import warnings from bs4 import BeautifulSoup import json warnings.filterwarnings"ignore", category=UserWarning, module='bs4' if lensys.argv 6: print"Usage: ./exploit.py https://url username password listenerIP listenerPort" exit url = sys.argv1 userna...

Google TensorFlow Buffer Overflow Vulnerability (CNVD-2020-62809)

Google TensorFlow is a suite of end-to-end open source platforms for machine learning from Google USA. A security vulnerability exists in Tensorflow versions prior to 2.4.0, which stems from when the parameter to boxes of tf.image.cropandresize has a very large value, and the CPU kernel...

CVE-2020-5791

Improper neutralization of special elements used in an OS command in Nagios XI 5.7.3 allows a remote, authenticated admin user to execute operating system commands with the privileges of the apache user...

Input validation

Improper neutralization of special elements used in an OS command in Nagios XI 5.7.3 allows a remote, authenticated admin user to execute operating system commands with the privileges of the apache user...

Exploit for CVE-2020-16898

PoC exploit for CVE-2020-16898, a Windows TCP/IP Remote Code Execution Vulnerability. The exploit targets the Windows TCP/IP stack and uses a specially crafted IPv6 packet to trigger a buffer overflow, leading to remote code execution. The exploit is implemented in Python using the Scapy library...

CVE-2020-7174

A soapconfigcontent expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center iMC versions: Prior to iMC PLAT 7.3 E0705P07...

CVE-2020-7184

A viewbatchtaskresultdetailfact expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center iMC versions: Prior to iMC PLAT 7.3 E0705P07...

CVE-2020-7745

This affects the package MintegralAdSDK before 6.6.0.0. The SDK distributed by the company contains malicious functionality that acts as a backdoor. Mintegral and their partners advertisers can remotely execute arbitrary code on a user device...

Qualcomm QCMAP OS Command Injection Vulnerability

Qualcomm QCMAP is Qualcomm's Linux-based data access point for cell phones. The Qualcomm QCMAP QCMAPCLI uses the system call without validating input while handling the SetGatewayUrl request, which can be exploited by a remote attacker to submit a special request that can pass shell metacharacter...

Remote code execution

A remote code execution vulnerability exists in the way that Microsoft Windows Codecs Library handles objects in memory. An attacker who successfully exploited the vulnerability could execute arbitrary code. Exploitation of the vulnerability requires that a program process a specially crafted ima...

Remote code execution

A remote code execution vulnerability exists when the Base3D rendering engine improperly handles memory. An attacker who successfully exploited the vulnerability would gain execution on a victim system. The security update addresses the vulnerability by correcting how the Base3D rendering engine...

Adobe Flash Player <= 32.0.0.433 (APSB20-58)

The version of Adobe Flash Player installed on the remote Windows host is equal or prior to version 32.0.0.433. It is therefore affected by a NULL pointer dereference flaw. An unauthenticated, remote attacker can exploit this, by inserting malicious strings in an HTTP response, to execute arbitra...

Microsoft Windows and Windows Server Remote Code Execution Vulnerability (CNVD-2021-71410)

Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation USA, an operating system for personal devices, and Microsoft Windows Server is a server operating system. A remote code execution vulnerability exists in Microsoft Windows and Windows Server. The vulnerabili...

Vulnerability of software packages for supervisory control and data collection: MC Works64/MC Works32, FrameWorX server, centralized configuration environment for HMI-/SCADA applications, Platform Services software platform, GenBroker64/GenBroker32 application for organization of access rights exchange. This vulnerability is related to insufficient control over code generation, allowing attackers to execute arbitrary commands.

The vulnerabilities of the software packages for supervisory control and data collection, MC Works64/MC Works32, the FrameWorX server, the centralized configuration environment for HMI-/SCADA applications, the Platform Services software platform, and the GenBroker64/GenBroker32 application for...

CVE-2020-17407

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microhard Bullet-LTE prior to v1.2.0-r1112. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of authentication headers. The issue results fro...

CVE-2020-17412

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 10.0.0.35798. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

VulnCheck KEV: CVE-2020-15227

Nette versions before 2.0.19, 2.1.13, 2.2.10, 2.3.14, 2.4.16, 3.0.6 are vulnerable to an code injection attack by passing specially formed parameters to URL that may possibly leading to RCE. Nette is a PHP/Composer MVC Framework...