18261 matches found
CVE-2019-16652
The BPM component in Genius Bytes Genius Server Genius CDDS 3.2.2 allows remote authenticated users to execute arbitrary commands...
Command injection
The BPM component in Genius Bytes Genius Server Genius CDDS 3.2.2 allows remote authenticated users to execute arbitrary commands...
CVE-2019-16652
The CVE-2019-16652 entry concerns Genius Bytes Genius Server (Genius CDDS) BPM component, version 3.2.2, where remote authenticated users can execute arbitrary commands. Multiple connected sources (CNVD-2020-27220; RH: CVE-2019-16652; NVD; CVE records) corroborate that a code/injection-style path...
CVE-2020-7609
node-rules including 3.0.0 and prior to 5.0.0 allows injection of arbitrary commands. The argument rules of function "fromJSON" can be controlled by users without any sanitization...
CVE-2020-7609
node-rules including 3.0.0 and prior to 5.0.0 allows injection of arbitrary commands. The argument rules of function "fromJSON" can be controlled by users without any sanitization...
CVE-2020-7640
pixl-class prior to 1.0.3 allows execution of arbitrary commands. The members argument of the create function can be controlled by users without any sanitization...
CVE-2020-7640
pixl-class prior to 1.0.3 allows execution of arbitrary commands. The members argument of the create function can be controlled by users without any sanitization...
Code injection
pixl-class prior to 1.0.3 allows execution of arbitrary commands. The members argument of the create function can be controlled by users without any sanitization...
CVE-2020-7640
CVE-2020-7640 describes an OS command injection in pixl-class prior to version 1.0.3. The vulnerability arises because the members parameter of the create function is not sanitized, allowing an attacker to execute arbitrary commands. Affected: pixl-class (Node.js module) before 1.0.3. Impact per ...
CVE-2020-11817
The CVE describes a vulnerability in Rukovoditel V2.5.2 where an attacker can upload an arbitrary file by altering the Content-Type, leading to command execution on the server. This occurs in Maintenance Mode and is exposed via a network attack vector with high impact to confidentiality, integrit...
Node.js third-party modules: [wireguard-wrapper] Command Injection via insecure command concatenation
I would like to report a Command Injection issue in the wireguard-wrapper module. It allows to execute arbitrary commands on the victim's PC. Module module name: wireguard-wrapper version: 1.0.2 npm page: https://www.npmjs.com/package/wireguard-wrapper Module Description This project is a nodejs...
CVE-2020-10786
A remote command execution in Vesta Control Panel through 0.9.8-26 allows any authenticated user to execute arbitrary commands on the system via cron jobs...
Command injection
A remote command execution in Vesta Control Panel through 0.9.8-26 allows any authenticated user to execute arbitrary commands on the system via cron jobs...
Command Injection Vulnerability in SeaCMS V10.1
Ocean Movie Management System SeaCMS, Ocean CMS is a content management system designed to address the core needs of webmasters. SeaCMS V10.1 suffers from a command injection vulnerability that can be exploited by attackers to execute arbitrary commands...
CVE-2020-4428
IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to execute arbitrary commands on the system. IBM X-Force ID: 180533. Recent assessments: wvu-r7 at May 08, 2020 4:04pm UTC reported: Assessment for the related CVEs here:...
QRadar Community Edition 7.3.1.6 PHP Object Injection
------------------------------------------------------------------------ PHP object injection vulnerability in QRadar Forensics web application ------------------------------------------------------------------------ Yorick Koster, September 2019...
Command Execution Vulnerability in Beijing Jiezhong FameView Configuration Software
FameView configuration software is a high-performance configuration and monitoring software independently developed by Beijing Jiezhong Company based on the Windows operating system with many years of experience in engineering applications and services, providing economical and perfect automation...
Advantech WISE-PaaS/RMM SQL Injection (CVE-2019-18229)
An SQL injection vulnerability exists in Advantech WISE-PaaS/RMM. Successful exploitation of this vulnerability could result in the execution of arbitrary SQL commands against the database on the target server...
Continued Exploitation of Pulse Secure VPN Vulnerability
Summary Unpatched Pulse Secure VPN servers continue to be an attractive target for malicious actors. Affected organizations that have not applied the software patch to fix an arbitrary file reading vulnerability, known as CVE-2019-11510, can become compromised in an attack. 1 Although Pulse Secur...