libvirt: arbitrary file read/exec via virDomainSaveImageGetXMLDesc API

It was discovered that libvirtd would permit read-only clients to use the virDomainSaveImageGetXMLDesc API, specifying an arbitrary path which would be accessed with the permissions of the libvirtd process. An attacker with access to the libvirtd socket could use this to probe the existence of...

libvirt: arbitrary file read/exec via virDomainSaveImageGetXMLDesc API

It was discovered that libvirtd would permit read-only clients to use the virDomainSaveImageGetXMLDesc API, specifying an arbitrary path which would be accessed with the permissions of the libvirtd process. An attacker with access to the libvirtd socket could use this to probe the existence of...

CVE-2019-10166

It was discovered that libvirtd would permit readonly clients to use the virDomainManagedSaveDefineXML API, which would permit them to modify managed save state files. If a managed save had already been created by a privileged user, a local attacker could modify this file such that libvirtd would...

CVE-2019-12137

Typora 0.9.9.24.6 on macOS is affected by CVE-2019-12137 (directory traversal) that allows execution of arbitrary programs via crafted file:/// or ../ substrings in a shared note. Root cause is path traversal through URI handling, enabling local code execution. Publicly documented impact is arbit...

Race condition

It is possible to exploit a Time of Check & Time of Use TOCTOU vulnerability by winning a race condition when Kaseya Virtual System Administrator agent 9.3.0.11 and earlier tries to execute its binaries from working and/or temporary folders. Successful exploitation results in the execution of...

CVE-2018-2363

SAP NetWeaver, SAP BASIS from 7.00 to 7.02, from 7.10 to 7.11, 7.30, 7.31, 7.40, from 7.50 to 7.52, contains code that allows you to execute arbitrary program code of the user's choice. A malicious user can therefore control the behaviour of the system or can potentially escalate privileges by...

BlueStacks App Player Privilege Escalation Vulnerability

BlueStacks App Player is prone to a privilege escalation vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2015-2114

HP Support Solution Framework before 11.51.0049 allows remote attackers to download an arbitrary program onto a client machine and execute this program via unspecified vectors...

Halloween Linux 4.0,S.u.S.E. Linux 6.0/6.1/6.2/6.3 kreatecd Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/1061/info A vulnerability exists in the kreatecd program for Linux. This program is a graphical front end to the cdrecord program, and is installed setuid root. This program will blindly trust the configuration of the pat...

MS Virtual Machine 2000/3100/3200/3300 Series com.ms.activeX.ActiveXComponent Arbitrary Program Execution

No description provided by source. source: http://www.securityfocus.com/bid/1754/info If a malicious website operator were to embed a specially crafted java object into a HTML document, it would be possible to execute arbitrary programs on a target host viewing the webpage through either Microsof...

FFFTP < 1.98b Untrusted Search Path Vulnerability - Windows

FFFTP is prone to untrusted search path vulnerability. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

DSquare Exploit Pack: D2SEC_CISCOANY

Name| d2secciscoany ---|--- CVE| CVE-2011-2040 Exploit Pack| D2ExploitPack Description| Cisco AnyConnect VPN Client Arbitrary Program Execution Vulnerability Notes|...

CVE-2011-0640

The default configuration of udev on Linux does not warn the user before enabling additional Human Interface Device HID functionality over USB, which allows user-assisted attackers to execute arbitrary programs via crafted USB data, as demonstrated by keyboard and mouse data sent by malware on a...

CVE-2011-0638

Microsoft Windows does not properly warn the user before enabling additional Human Interface Device HID functionality over USB, which allows user-assisted attackers to execute arbitrary programs via crafted USB data, as demonstrated by keyboard and mouse data sent by malware on a smartphone that...

Null pointer dereference

Apple Mac OS X does not properly warn the user before enabling additional Human Interface Device HID functionality over USB, which allows user-assisted attackers to execute arbitrary programs via crafted USB data, as demonstrated by keyboard and mouse data sent by malware on a smartphone that the...

CVE-2011-0639

CVE-2011-0639 affects Apple Mac OS X where enabling HID functionality over USB can be performed without user warning. The embedded issue allows user-assisted attackers to run arbitrary code via crafted USB data, demonstrated by keyboard/mouse data sent by malware on a smartphone connected to the ...

Foxit Reader < 3.2.1 Arbitrary Program Execution

The version of Foxit Reader installed on the remote Windows host is prior to 3.2.1. It is, therefore, affected by an arbitrary program execution vulnerability related to certain '/Type /Action /S /Launch' or '/Launch /Action' sequences. An attacker can exploit these, by tricking a user into openi...

Office OCX Multiple ActiveX Controls OpenWebFile Arbitrary Program Execution

Office OCX provides multiple software products that parse various Microsoft Office documents. Some of these products include Word Viewer OCX, Excel Viewer OCX, PowerPoint Viewer OCX, and Office Viewer OCX. These products act as ActiveX document containers to create, open, edit, and print...

Ubuntu 8.04 LTS / 8.10 / 9.04 : nagios2, nagios3 vulnerability (USN-795-1)

It was discovered that Nagios did not properly parse certain commands submitted using the WAP web interface. An authenticated user could exploit this flaw and execute arbitrary programs on the server. Note that Tenable Network Security has extracted the preceding description block directly from t...

Symantec Alert Management System 2 multiple vulnerabilities

SUMMARY The version of Alert Management System 2 AMS2 used by some versions of Symantec System Center, Symantec Antivirus Server, and Symantec AntiVirus Central Quarantine Server contains four vulnerabilities. AFFECTED PRODUCTS Product | Version | Solution ---|---|--- Symantec AntiVirus Corporate...