Code injection

pixl-class prior to 1.0.3 allows execution of arbitrary commands. The members argument of the create function can be controlled by users without any sanitization...

CVE-2020-7640

CVE-2020-7640 describes an OS command injection in pixl-class prior to version 1.0.3. The vulnerability arises because the members parameter of the create function is not sanitized, allowing an attacker to execute arbitrary commands. Affected: pixl-class (Node.js module) before 1.0.3. Impact per ...

CVE-2020-11817

The CVE describes a vulnerability in Rukovoditel V2.5.2 where an attacker can upload an arbitrary file by altering the Content-Type, leading to command execution on the server. This occurs in Maintenance Mode and is exposed via a network attack vector with high impact to confidentiality, integrit...

Node.js third-party modules: [wireguard-wrapper] Command Injection via insecure command concatenation

I would like to report a Command Injection issue in the wireguard-wrapper module. It allows to execute arbitrary commands on the victim's PC. Module module name: wireguard-wrapper version: 1.0.2 npm page: https://www.npmjs.com/package/wireguard-wrapper Module Description This project is a nodejs...

CVE-2020-10786

A remote command execution in Vesta Control Panel through 0.9.8-26 allows any authenticated user to execute arbitrary commands on the system via cron jobs...

Command injection

A remote command execution in Vesta Control Panel through 0.9.8-26 allows any authenticated user to execute arbitrary commands on the system via cron jobs...

Command Injection Vulnerability in SeaCMS V10.1

Ocean Movie Management System SeaCMS, Ocean CMS is a content management system designed to address the core needs of webmasters. SeaCMS V10.1 suffers from a command injection vulnerability that can be exploited by attackers to execute arbitrary commands...

QRadar Community Edition 7.3.1.6 PHP Object Injection

------------------------------------------------------------------------ PHP object injection vulnerability in QRadar Forensics web application ------------------------------------------------------------------------ Yorick Koster, September 2019...

CVE-2020-4428

IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to execute arbitrary commands on the system. IBM X-Force ID: 180533. Recent assessments: wvu-r7 at May 08, 2020 4:04pm UTC reported: Assessment for the related CVEs here:...

Command Execution Vulnerability in Beijing Jiezhong FameView Configuration Software

FameView configuration software is a high-performance configuration and monitoring software independently developed by Beijing Jiezhong Company based on the Windows operating system with many years of experience in engineering applications and services, providing economical and perfect automation...

Advantech WISE-PaaS/RMM SQL Injection (CVE-2019-18229)

An SQL injection vulnerability exists in Advantech WISE-PaaS/RMM. Successful exploitation of this vulnerability could result in the execution of arbitrary SQL commands against the database on the target server...

Continued Exploitation of Pulse Secure VPN Vulnerability

Summary Unpatched Pulse Secure VPN servers continue to be an attractive target for malicious actors. Affected organizations that have not applied the software patch to fix an arbitrary file reading vulnerability, known as CVE-2019-11510, can become compromised in an attack. 1 Although Pulse Secur...

CVE-2020-10514

iCatch DVR firmware before 20200103 do not validate function parameter properly, resulting attackers executing arbitrary command...

SAP Business Objects Business Intelligence Platform Code Issue Vulnerability

SAP Business Objects Business Intelligence Platform is a suite of business intelligence software and enterprise performance solutions from SAP, Germany. The product features report generation, analytics, and data visualization. A vulnerability in the SAP Business Objects Business Intelligence...

Command Execution Vulnerability in Focused Notes

Focus Notes is a study notes software developed by Guangzhou Fenghe Technology Co. Focus Notes has a command execution vulnerability that can be exploited by an attacker to execute arbitrary commands...

CVE-2020-6219

SAP Business Objects Business Intelligence Platform CrystalReports WebForm Viewer, versions 4.1, 4.2, and Crystal Reports for VS version 2010, allows an attacker with basic authorization to perform deserialization attack in the application, leading to service interruptions and denial of service a...

CVE-2020-6219

SAP Business Objects Business Intelligence Platform CrystalReports WebForm Viewer, versions 4.1, 4.2, and Crystal Reports for VS version 2010, allows an attacker with basic authorization to perform deserialization attack in the application, leading to service interruptions and denial of service a...

CRLF Injection

Xterm is vulnerable to CRLF Injection. A flaw was found in the xterm handling of Device Control Request Status String DECRQSS escape sequences. An attacker could create a malicious text file or log entry, if unfiltered that could run arbitrary commands if read by a victim inside an xterm window...

Cisco FTD Software Command Injection (cisco-sa-20191002-fxos-cmd-inject)

According to its self-reported version, Cisco Firepower Threat Defense FTD Software is affected by multiple vulnerabilities in the CLI due to insufficient input validation. An unauthenticated, local attacker can exploit this, by including crafted arguments to specific commands, in order to execut...

Gila CMS Local File Inclusion (CVE-2020-5513)

A local file inclusion vulnerability exists in Gila CMS. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...