[SECURITY] [DSA 3853-1] bitlbee security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3853-1 [email protected] https://www.debian.org/security/ Sebastien Delafond May 15, 2017 https://www.debian.org/security/faq -...

NovaBACKUP DataCenter Linux datamover module arbitrary command execution vulnerability

NovaBACKUP DataCenter is a data backup solution developed by NovaStor Germany, Linux is the operating system, datamover module is one of the data transfer module. A security vulnerability exists in the datamover module of NovaBACKUP DataCenter 09.06.03.0353 and earlier versions for Linux. A remot...

Ghostscript Type Confusion Arbitrary Command Execution (CVE-2017-8291)

An arbitrary code execution vulnerability exists within Ghostscript. This vulnerability is due to the way Ghostscript parses .eps files. An attacker can manipulate a .eps file and run arbitrary commands on the victims computer...

Netgear WNR2000\R2000 Series Buffer Overflow Vulnerability

The WNR2000v3, WNR2000v4, WNR2000v5 and R2000 are all router products from Netgear. A buffer overflow vulnerability exists in the Netgear WNR2000\R2000 family of products, which can be exploited by remote attackers to bypass authentication and execute arbitrary commands...

Arbitrary Command Execution

smalruby-editor is vulnerable to arbitrary OS command injection attacks. The vulnerability exists due to the improper input sanitization in the usage of Open3.capture3...

Ghostscript 9.21 Type Confusion Arbitrary Command Execution Exploit

This Metasploit module exploits a type confusion vulnerability in Ghostscript that can be exploited to obtain arbitrary command execution. This vulnerability affects Ghostscript versions 9.21 and earlier and can be exploited through libraries such as ImageMagick and Pillow. This module requires...

Ghostscript 9.21 Type Confusion Arbitrary Command Execution

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Ghostscript Type Confusion Arbitrary Command Execution', 'Description' = %q This module exploits a type confusion vulnerability in Ghostscript tha...

CVE-2017-2142

Buffer overflow in WN-G300R3 firmware Ver.1.03 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors...

gnome-shell Arbitrary Code Execution Vulnerability

gnome-shell is a window manager for the GNOME desktop environment developed by the GNOME project. A security vulnerability exists in the js/ui/extensionSystem.js file in gnome-shell versions 3.22 through 3.24.1, due to the program failing to properly handle exceptions. An attacker can exploit the...

Command injection

gnome-shell 3.22 through 3.24.1 mishandles extensions that fail to reload, which can lead to leaving extensions enabled in the lock screen. With these extensions, a bystander could launch applications but not interact with them, see information from the extensions e.g., what applications you have...

Ghostscript Type Confusion Arbitrary Command Execution

This module exploits a type confusion vulnerability in Ghostscript that can be exploited to obtain arbitrary command execution. This vulnerability affects Ghostscript versions 9.21 and earlier and can be exploited through libraries such as ImageMagick and Pillow. Module Options msf use...

UBUNTU-CVE-2016-6902

lshell 0.9.16 allows remote authenticated users to break out of a limited shell and execute arbitrary commands...

Tenable Appliance Arbitrary Command Execution Vulnerability

Tenable Appliance is a browser management program developed by Tenable Network Security. An arbitrary command execution vulnerability exists in Tenable Appliance versions 3.5 through 4.4.0. A remote attacker can inject arbitrary commands by manipulating the tnsappliancesessionuser parameter...

PT-2018-07: Arbitrary Command Execution in Ipswitch WhatsUp Gold

The specialists of the Positive Research center have detected an Arbitrary Command Execution vulnerability in Ipswitch WhatsUp Gold. Vulnerability in Ipswitch WhatsUp Gold, due to TFTP server misconfiguration, allows remote attackers to execute arbitrary commands on the TFTP server, obtain access...

CVE-2017-7283

An authenticated user of Unitrends Enterprise Backup before 9.1.2 can execute arbitrary OS commands by sending a specially crafted filename to the /api/restore/download-files endpoint, related to the downloadFiles function in api/includes/restore.php...

The vulnerability of the Cisco IOS operating system, allowing a perpetrator to execute arbitrary commands

The vulnerability in the Cisco IOS operating system exists due to the lack of measures taken to neutralize special elements used in the operating system’s commands. Exploiting this vulnerability allows a malicious actor, operating locally, to execute arbitrary commands with superuser privileges...

Dell iDRAC6 Arbitrary Command Execution Vulnerability

Dell iDRAC6 is a remote management solution on the Dell PowerEdge family of servers. An arbitrary command execution vulnerability exists in Dell iDRAC6. An attacker could exploit the vulnerability to execute arbitrary commands in the context of an affected application...

Arbitrary Command Execution

Salt is vulnerable to command execution. If the pillar content given to cmd.run is not coming from a trusted source, attackers could execute commands on command line...

WN-G300R3 vulnerable to OS command injection

Overview WN-G300R3 provided by I-O DATA DEVICE, INC. contain an OS command injection vulnerability. Taizoh Tsukamoto of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact A...

SCADA engine BACnetOPCServer suffers from dll hijacking vulnerability

SCADA system is a data acquisition and monitoring control system. bacnetOPCServer is the server software for the SCADA engine. The BACnetOPCServer software's BACnSvrTest.exe component is vulnerable to DLL hijacking due to insecure loading of library files, which can be used to maliciously load a...