Arbitrary Command Execution

smalruby-editor is vulnerable to arbitrary OS command injection attacks. The vulnerability exists due to the improper input sanitization in the usage of Open3.capture3...

Ghostscript 9.21 Type Confusion Arbitrary Command Execution Exploit

This Metasploit module exploits a type confusion vulnerability in Ghostscript that can be exploited to obtain arbitrary command execution. This vulnerability affects Ghostscript versions 9.21 and earlier and can be exploited through libraries such as ImageMagick and Pillow. This module requires...

Ghostscript 9.21 Type Confusion Arbitrary Command Execution

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Ghostscript Type Confusion Arbitrary Command Execution', 'Description' = %q This module exploits a type confusion vulnerability in Ghostscript tha...

CVE-2017-2141

WN-G300R3 firmware 1.03 and earlier allows attackers with administrator rights to execute arbitrary OS commands via unspecified vectors...

CVE-2017-2142

Buffer overflow in WN-G300R3 firmware Ver.1.03 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors...

Windows DCE-RPC MIBEntryGet vulnerability (ErraticGopher)

Added: 04/28/2017 Background Distributed Computing Environment - Remote Procedure Call DCE-RPC is the protocol used by Windows operating systems for calling program functions on remote targets. Problem A memory corruption vulnerability in the DCE-RPC MIBEntryGet call could allow remote attackers ...

gnome-shell Arbitrary Code Execution Vulnerability

gnome-shell is a window manager for the GNOME desktop environment developed by the GNOME project. A security vulnerability exists in the js/ui/extensionSystem.js file in gnome-shell versions 3.22 through 3.24.1, due to the program failing to properly handle exceptions. An attacker can exploit the...

Command injection

gnome-shell 3.22 through 3.24.1 mishandles extensions that fail to reload, which can lead to leaving extensions enabled in the lock screen. With these extensions, a bystander could launch applications but not interact with them, see information from the extensions e.g., what applications you have...

Ghostscript Type Confusion Arbitrary Command Execution

This module exploits a type confusion vulnerability in Ghostscript that can be exploited to obtain arbitrary command execution. This vulnerability affects Ghostscript versions 9.21 and earlier and can be exploited through libraries such as ImageMagick and Pillow. Module Options msf use...

UBUNTU-CVE-2016-6902

lshell 0.9.16 allows remote authenticated users to break out of a limited shell and execute arbitrary commands...

Tenable Appliance Arbitrary Command Execution Vulnerability

Tenable Appliance is a browser management program developed by Tenable Network Security. An arbitrary command execution vulnerability exists in Tenable Appliance versions 3.5 through 4.4.0. A remote attacker can inject arbitrary commands by manipulating the tnsappliancesessionuser parameter...

PT-2018-07: Arbitrary Command Execution in Ipswitch WhatsUp Gold

The specialists of the Positive Research center have detected an Arbitrary Command Execution vulnerability in Ipswitch WhatsUp Gold. Vulnerability in Ipswitch WhatsUp Gold, due to TFTP server misconfiguration, allows remote attackers to execute arbitrary commands on the TFTP server, obtain access...

CVE-2017-7283

An authenticated user of Unitrends Enterprise Backup before 9.1.2 can execute arbitrary OS commands by sending a specially crafted filename to the /api/restore/download-files endpoint, related to the downloadFiles function in api/includes/restore.php...

The vulnerability of the Cisco Firepower Extensible Operating System and the Cisco Unified Computing System Central device management system allows a intruder to inject arbitrary commands.

The vulnerability of the Cisco Firepower Extensible Operating System’s local management component and the Cisco Unified Computing System Central’s centralized device management system exists due to the lack of measures taken to neutralize special elements used in operating system commands...

The vulnerability of the Cisco IOS operating system, allowing a perpetrator to execute arbitrary commands

The vulnerability in the Cisco IOS operating system exists due to the lack of measures taken to neutralize special elements used in the operating system’s commands. Exploiting this vulnerability allows a malicious actor, operating locally, to execute arbitrary commands with superuser privileges...

Dell iDRAC6 Arbitrary Command Execution Vulnerability

Dell iDRAC6 is a remote management solution on the Dell PowerEdge family of servers. An arbitrary command execution vulnerability exists in Dell iDRAC6. An attacker could exploit the vulnerability to execute arbitrary commands in the context of an affected application...

SolarWinds Log and Event Manager < 6.3.1 Hotfix 4 Multiple Vulnerabilities

SolarWinds Log and Event Manager LEM is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Arbitrary Command Execution

Salt is vulnerable to command execution. If the pillar content given to cmd.run is not coming from a trusted source, attackers could execute commands on command line...

WN-G300R3 vulnerable to OS command injection

Overview WN-G300R3 provided by I-O DATA DEVICE, INC. contain an OS command injection vulnerability. Taizoh Tsukamoto of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact A...

Scientific Linux Security Update : bash on SL6.x i386/x86_64 (20170321)

Security Fixes : - An arbitrary command injection flaw was found in the way bash processed the hostname value. A malicious DHCP server could use this flaw to execute arbitrary commands on the DHCP client machines running bash under specific circumstances. CVE-2016-0634 - An arbitrary command...