The vulnerability of the XStream Java library for converting objects to XML or JSON format allows attackers to execute arbitrary commands due to the recovery of unreliable data from memory.

The vulnerability of the XStream library for converting objects to XML or JSON format is related to the restoration of unreliable data in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands by interfering with the processing of XML objects or other support...

[ASA-201908-9] libreoffice-still: multiple issues

Arch Linux Security Advisory ASA-201908-9 ========================================= Severity: High Date : 2019-08-16 CVE-ID : CVE-2019-9848 CVE-2019-9849 Package : libreoffice-still Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1010 Summary ======= The package...

TP-Link M7350 V3 Command Injection Vulnerability

The TP-Link M7350 is a portable wireless router device from China P&L TP-Link. A command injection vulnerability exists in the TP-Link M7350 V3, which can be exploited by an attacker to execute illegal commands...

CVE-2019-10928

A vulnerability has been identified in SCALANCE SC-600 V2.0. An authenticated attacker with access to port 22/tcp as well as physical access to an affected device may trigger the device to allow execution of arbitrary commands. The security vulnerability could be exploited by an authenticated...

CVE-2019-10928

CVE-2019-10928 affects Siemens SCALANCE SC-600 (V2.0). The issue arises from improper adherence to coding standards (CWE-710) in the SC-600 firmware, allowing an authenticated attacker with network access via Port 22/TCP and, per updates, with physical access to the device, to trigger execution o...

NewStart CGSL CORE 5.05 / MAIN 5.05 : vim Vulnerability (NS-SA-2019-0164)

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has vim packages installed that are affected by a vulnerability: - It was found that the :source! command was not restricted by the sandbox mode. If modeline was explicitly enabled, opening a specially crafted text file in vim...

Amazon Linux 2 : vim (ALAS-2019-1239)

It was found that the :source! command was not restricted by the sandbox mode. If modeline was explicitly enabled, opening a specially crafted text file in vim could result in arbitrary command execution. CVE-2019-12735 C Tenable Network Security, Inc. The descriptive text and package checks in...

NewStart CGSL CORE 5.04 / MAIN 5.04 : golang Multiple Vulnerabilities (NS-SA-2019-0047)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has golang packages installed that are affected by multiple vulnerabilities: - An arbitrary command execution flaw was found in the way Go's go get command handled the checkout of source code repositories. A remote attacker...

Webmin 1.920 Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Webmin 1.920 Unauthenticated RCE', 'Description' = %q This module exploits an arbitrary command execution vulnerability in Webmin 1.920 and prior...

NewStart CGSL CORE 5.04 / MAIN 5.04 : vim Vulnerability (NS-SA-2019-0161)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has vim packages installed that are affected by a vulnerability: - It was found that the :source! command was not restricted by the sandbox mode. If modeline was explicitly enabled, opening a specially crafted text file in vim...

NewStart CGSL MAIN 4.05 : bash Multiple Vulnerabilities (NS-SA-2019-0108)

The remote NewStart CGSL host, running version MAIN 4.05, has bash packages installed that are affected by multiple vulnerabilities: - A denial of service flaw was found in the way bash handled popd commands. A poorly written shell script could cause bash to crash resulting in a local denial of...

RHEL 7 : vim (RHSA-2019:1947)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:1947 advisory. Vim Vi IMproved is an updated and improved version of the vi editor. Security Fixes: vim/neovim: ':source!' command allows arbitrary command executio...

Debian DSA-4494-1 : kconfig - security update

Dominik Penner discovered that KConfig, the KDE configuration settings framework, supported a feature to define shell command execution in .desktop files. If a user is provided with a malformed .desktop file e.g. if it's embedded into a downloaded archive and it gets opened in a file browser...

Command Execution Vulnerability in Netcom WAN Acceleration Gateway

Netcom WAN optimization gateway NS-WOG is the latest technological innovation from Netcom. WAN optimization, also commonly referred to as WAN acceleration. A command execution vulnerability exists in the Netcom WAN acceleration gateway. It allows attackers to exploit the vulnerability to execute...

CVE-2019-12805 NC Launcher 2 Arbitrary Command Injection Vulnerability

NCSOFT Game Launcher, NC Launcher2 2.4.1.691 and earlier versions have a vulnerability in the custom protocol handler that could allow remote attacker to execute arbitrary command. User interaction is required to exploit this vulnerability in that the target must visit a malicious web page. This...

CVE-2019-12805

The CVE-2019-12805 entry concerns NCSOFT Game Launcher, NC Launcher2 (versions up to 2.4.1.691). A vulnerability in the custom protocol handler could allow a remote attacker to execute arbitrary commands when a user visits a malicious page, executing code in the context of the current user. Conne...

Arbitrary Command Execution

zsh is vulnerable to arbitrary command execution. The truncation of Shebang lines that exceed 64 characters could potentially lead to arbitrary execve call...

HP 2910al-48G Arbitrary Command Execution Vulnerability

The HP 2910al-48G is an Ethernet switch from Hewlett Packard Enterprise HPE in the United States. An arbitrary command execution vulnerability exists in the HP 2910al-48G version W.15.14.0016, which can be exploited by an attacker to execute arbitrary commands...

Nextcloud Android app SQL injection vulnerability

Nextcloud Android app is an Android-based mobile application from Nextcloud Germany for accessing Nextcloud servers. A SQL injection vulnerability exists in the Nextcloud Android app versions prior to 3.0.0. The vulnerability stems from a lack of validation of externally entered SQL statements in...

vim/neovim: ': source!' command allows arbitrary command execution via modelines

It was found that the :source! command was not restricted by the sandbox mode. If modeline was explicitly enabled, opening a specially crafted text file in vim could result in arbitrary command execution...