1489 matches found
CVE-2016-7071
It was found that the CloudForms before 5.6.2.2, and 5.7.0.7 did not properly apply permissions controls to VM IDs passed by users. A remote, authenticated attacker could use this flaw to execute arbitrary VMs on systems managed by CloudForms if they know the ID of the VM...
Node.js third-party modules: [apex-publish-static-files] Command Injection on connectString
I would like to report a command injection vulnerability in the apex-publish-static-files npm module. It allows arbitrary shell command execution through a maliciously crafted argument. Module module name: apex-publish-static-files version: 2.0.0 npm page:...
CVE-2018-0674
AttacheCase ver.2.8.4.0 and earlier allows an arbitrary script execution via unspecified vectors...
CVE-2018-0675
AttacheCase ver.3.3.0.0 and earlier allows an arbitrary script execution via unspecified vectors...
A10 ACOS Web Application Firewall SQL Injection Vulnerability
A10 ACOS Web Application Firewall WAF is a web application firewall from A10 Networks that protects against vulnerabilities such as injection, cross-site scripting, and cross-site request forgery. An SQL injection vulnerability exists in the A10 ACOS WAF that stems from the program failing to...
egg-scripts command injection vulnerability
egg-scripts is a deployment tool for deploying, running and managing egg projects. A command injection vulnerability exists in egg-scripts versions prior to 2.8.1. The vulnerability can be exploited to execute arbitrary shell commands with the help of maliciously crafted command line arguments...
CVE-2011-2767
modperl 2.0 through 2.0.10 allows attackers to execute arbitrary Perl code by placing it in a user-owned .htaccess file, because contrary to the documentation there is no configuration option that permits Perl code for the administrator's control of HTTP request processing without also permitting...
CVE-2018-3786
A command injection vulnerability in egg-scripts v2.8.1 allows arbitrary shell command execution through a maliciously crafted command line argument...
Command injection
A command injection vulnerability in egg-scripts v2.8.1 allows arbitrary shell command execution through a maliciously crafted command line argument...
WordPress Plugin Chained Quiz SQL Injection Vulnerability
WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A SQL injection vulnerability exists in the WordPress plugin Chained Quiz, which can be exploited by attackers to execute...
CVE-2018-3784
A code injection in cryo 0.0.6 allows an attacker to arbitrarily execute code due to insecure implementation of deserialization...
PHP Configuration - Critical - Arbitrary PHP code execution - SA-CONTRIB-2018-055
This module enables you to add or overwrite PHP configuration on a drupal website. The module doesn't sufficiently allow access to set these configurations, leading to arbitrary PHP configuration execution by an attacker. This vulnerability is mitigated by the fact that an attacker must have a ro...
Insecure Deserialization & Arbitrary Code Execution in TYPO3 CMS
More info at https://typo3.org/security/advisory/typo3-core-sa-2018-002...
Design/Logic Flaw
onefilecms.php in OneFileCMS through 2012-04-14 might allow attackers to execute arbitrary PHP code via a .php filename on the Upload screen...
CVE-2018-12995
onefilecms.php in OneFileCMS through 2012-04-14 might allow attackers to execute arbitrary PHP code via a .php filename on the Upload screen...
KYOCERA Net Admin 3.4 Multiple XSS Vulnerabilities
Summary KYOCERA Net Admin is Kyocera's unified device management software that uses a web-based platform to give network administrators easy and uncomplicated control to handle a fleet for up to 10,000 devices. Tasks that used to require multiple programs or walking to each printer can now be...
Intex Router N-150 - Cross-Site Request Forgery (Add Admin)
Intex Router N-150 - Cross-Site Request Forgery Add Admin Exploit Title: Intex Router N-150 - Cross-Site Request Forgery Add Admin Date: 2018-06-23 Exploit Author: Navina Asrani Version: N-150 CVE : N/A Category: Router Firmware 1. Description The firmware allows malicious request to be execute...
Command injection
The '/common/ajaxemailconnectiontest.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by any authenticated user and can be abused to execute arbitrary commands on the system. This script is vulnerable to command injection via the unsanitized user input 'TESTSERVER'...