Odoo CRM 10.0 - Code Execution

Odoo CRM 10.0 - Code Execution Vulnerability Summary The following advisory describe arbitrary Python code execution found in Odoo CRM version 10.0 Odoo is a suite of open source business apps that cover all your company needs: CRM, eCommerce, accounting, inventory, point of sale, project...

CVE-2017-2810

An exploitable vulnerability exists in the Databook loading functionality of Tablib 0.11.4. A yaml loaded Databook can execute arbitrary python commands resulting in command execution. An attacker can insert python into loaded yaml to trigger this vulnerability...

CVE-2015-6531: Improper Control of Generation of Code

Palo Alto Networks Panorama VM Appliance with PAN-OS before 6.0.1 might allow remote attackers to execute arbitrary Python code via a crafted firmware image file...

PT-2017-7032

Name of the Vulnerable Software and Affected Versions Palo Alto Networks Panorama VM Appliance versions prior to 6.0.1 Description The issue allows remote attackers to execute arbitrary Python code via a crafted firmware image file. Recommendations For versions prior to 6.0.1, update to version...

CVE-2017-7235

An issue was discovered in cloudflare-scrape 1.6.6 through 1.7.1. A malicious website owner could craft a page that executes arbitrary Python code against any cfscrape user who scrapes that website. This is fixed in 1.8.0...

CVE-2017-7235: Improper Input Validation

An issue was discovered in cloudflare-scrape 1.6.6 through 1.7.1. A malicious website owner could craft a page that executes arbitrary Python code against any cfscrape user who scrapes that website. This is fixed in 1.8.0...

PT-2017-17597

Name of the Vulnerable Software and Affected Versions cloudflare-scrape versions 1.6.6 through 1.7.1 Description A malicious website owner could craft a page that executes arbitrary Python code against any cfscrape user who scrapes that website. Recommendations For versions 1.6.6 through 1.7.1,...

CVE-2016-9950

An issue was discovered in Apport before 2.20.4. There is a path traversal issue in the Apport crash file "Package" and "SourcePackage" fields. These fields are used to build a path to the package specific hook files in the /usr/share/apport/package-hooks/ directory. An attacker can exploit this...

CVE-2016-9950: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in Apport before 2.20.4. There is a path traversal issue in the Apport crash file "Package" and "SourcePackage" fields. These fields are used to build a path to the package specific hook files in the /usr/share/apport/package-hooks/ directory. An attacker can exploit this...

CVE-2015-5306

OpenStack Ironic Inspector aka ironic-inspector or ironic-discoverd, when debug mode is enabled, might allow remote attackers to access the Flask console and execute arbitrary Python code by triggering an error...

CVE-2015-5306

OpenStack Ironic Inspector aka ironic-inspector or ironic-discoverd, when debug mode is enabled, might allow remote attackers to access the Flask console and execute arbitrary Python code by triggering an error...

CVE-2015-5306: Undefined Security Weakness

OpenStack Ironic Inspector aka ironic-inspector or ironic-discoverd, when debug mode is enabled, might allow remote attackers to access the Flask console and execute arbitrary Python code by triggering an error...

CVE-2014-2331

CheckMK 1.2.2p2, 1.2.2p3, and 1.2.3i5 allows remote authenticated users to execute arbitrary Python code via a crafted rules.mk file in a snapshot. NOTE: this can be exploited by remote attackers by leveraging CVE-2014-2330...

CVE-2014-2331: Improper Control of Generation of Code

CheckMK 1.2.2p2, 1.2.2p3, and 1.2.3i5 allows remote authenticated users to execute arbitrary Python code via a crafted rules.mk file in a snapshot. NOTE: this can be exploited by remote attackers by leveraging CVE-2014-2330...

CVE-2015-3446: Improper Control of Generation of Code

The Framework Daemon in AlienVault Unified Security Management before 4.15 allows remote attackers to execute arbitrary Python code via a crafted plugin configuration file .cfg...

PT-2015-4815

Name of the Vulnerable Software and Affected Versions Cisco Web Security Appliance WSA version 8.5.0-ise-147 Description The issue is related to the improper restriction of the pickle Python module during tunnel-status checks, allowing local users to execute arbitrary Python code and gain...

PT-2015-4814

Name of the Vulnerable Software and Affected Versions Cisco Web Security Appliance WSA version 8.5.0-ise-147 Description The issue is related to the improper restriction of the pickle Python module during tunnel-status checks, allowing local users to execute arbitrary Python code and gain...

PT-2014-5409 · Google +2 · Luci +2

Name of the Vulnerable Software and Affected Versions: luci version 0.26.0 Description: The issue allows remote authenticated users with certain permissions to execute arbitrary Python code via a crafted cluster configuration. Recommendations: For luci version 0.26.0, update to a version that fix...

CVE-2012-5493: Improper Control of Generation of Code

gtbn.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with certain permissions to bypass the Python sandbox and execute arbitrary Python code via unspecified vectors...

PT-2014-2320

Name of the Vulnerable Software and Affected Versions Plone versions prior to 4.2.3 Plone versions 4.3 before beta 1 Description The issue allows remote authenticated users with certain permissions to bypass the Python sandbox and execute arbitrary Python code via unspecified vectors. This is...