RHEL 8 : virt:8.0.0 (RHSA-2019:1762)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:1762 advisory. The Advanced Virtualization module provides the user-space component for running virtual machines that use KVM in environments managed by Re...

libvirt: arbitrary command execution via virConnectGetDomainCapabilities API

The virConnectGetDomainCapabilities libvirt API accepts an "emulatorbin" argument to specify the program providing emulation for a domain. Since v1.2.19, libvirt will execute that program to probe the domain's capabilities. Read-only clients could specify an arbitrary path for this argument,...

TRENDnet TEW-827DRU Command Injection Vulnerability (CNVD-2019-22209)

The TRENDnet TEW-827DRU is a wireless router from TRENDnet. A security vulnerability exists in the TRENDnet TEW-827DRU using firmware version 2.04B03 and earlier. An attacker can exploit the vulnerability to execute arbitrary commands on the device...

Arbitrary Command Execution

libvirt is vulnerable to Arbitrary Command Execution. The virConnectBaselineHypervisorCPU and virConnectCompareHypervisorCPU libvirt APIs accept an "emulator" argument to specify the program providing emulation for a domain. An attacker could specify an arbitrary path for this argument, causing...

Fedora 30 : libvirt (2019-b2dfb13daf)

CVE-2019-10161: arbitrary file read/exec via virDomainSaveImageGetXMLDesc API bz 1722463, bz 1720115 - CVE-2019-10166: virDomainManagedSaveDefineXML API exposed to readonly clients bz 1722462, bz 1720114 - CVE-2019-10167: arbitrary command execution via virConnectGetDomainCapabilities API bz...

The vulnerability of FortiWeb web applications’ network firewalls stems from the lack of protective measures for the website structure. This allows attackers to execute arbitrary code or perform arbitrary commands.

The vulnerability of FortiWeb web applications’ network firewalls exists due to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability allows a malicious actor to execute arbitrary code or issue arbitrary commands using attack reports generated in HTML...

TRENDnet TEW-827DRU Command Injection Vulnerability

The TRENDnet TEW-827DRU is a wireless router from TRENDnet. A command injection vulnerability exists in the apply.cgi file in the TRENDnet TEW-827DRU using firmware prior to version 2.05B11. The vulnerability stems from a network system or product not properly filtering specific elements of...

EulerOS 2.0 SP5 : vim (EulerOS-SA-2019-1690)

According to the version of the vim packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - It was found that the :source! command was not restricted by the sandbox mode. If modeline was explicitly enabled, opening a specially crafted text fi...

D-Link DIR-823G Command Injection Vulnerability (CNVD-2019-20996)

The D-Link DIR-823G is a wireless router from AUO D-Link of Taiwan, China. A command injection vulnerability exists in HNAP1 in the D-Link DIR-823G using firmware version 1.02B03. The vulnerability stems from a network system or product not properly filtering specific elements of externally input...

F5 Networks BIG-IP : BIG-IP AFM and PEM TMUI XSS vulnerability (K61002104)

Undisclosed TMUI pages for AFM and PEM Subscriber management are vulnerable to a stored cross-site scripting XSS issue. This is a control plane issue only and is not accessible from the data plane. The attack requires a malicious resource administrator to store the XSS. CVE-2019-6639 Impact A...

Centreon Arbitrary System Command Execution Vulnerability

Centreon is a free and open source IT and application monitoring software. An arbitrary system command execution vulnerability exists in Centreon 19.04. An attacker can insert arbitrary commands into the database using the "initscript"-"Monitoring Engine Binary" value in main.get.php and execute...

CentOS Update for vim-common CESA-2019:1619 centos7

The remote host is missing an update for the SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2019-13024

Centreon 18.x before 18.10.6, 19.x before 19.04.3, and Centreon web before 2.8.29 allows the attacker to execute arbitrary system commands by using the value "initscript"-"Monitoring Engine Binary" in main.get.php to insert a arbitrary command into the database, and execute it by calling the...

CVE-2019-13024

Centreon 18.x before 18.10.6, 19.x before 19.04.3, and Centreon web before 2.8.29 allows the attacker to execute arbitrary system commands by using the value "initscript"-"Monitoring Engine Binary" in main.get.php to insert a arbitrary command into the database, and execute it by calling the...

CVE-2019-13024

Centreon 18.x before 18.10.6, 19.x before 19.04.3, and Centreon web before 2.8.29 allows the attacker to execute arbitrary system commands by using the value "initscript"-"Monitoring Engine Binary" in main.get.php to insert a arbitrary command into the database, and execute it by calling the...

CVE-2019-13024

Centreon 18.x up to 18.10.5, 19.x up to 19.04.2, and Centreon web prior to 2.8.29 are affected by CVE-2019-13024, a remote command-injection vulnerability. The flaw lets an attacker insert an arbitrary command into the database via the value pair "init_script"-"Monitoring Engine Binary" in main.g...

vim security update

CentOS Errata and Security Advisory CESA-2019:1619 An update for vim is now available for Red Hat Enterprise Linux 7 and Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, whic...

McAfee Enterprise Security Manager Command Injection Vulnerability

McAfee Enterprise Security Manager ESM is a suite of security information and event management SIEM solutions from McAfee, USA. The solution supports viewing and analyzing threat intelligence as well as rapid threat prioritization and security response, and has a built-in embedded compliance...

Important: Red Hat Security Advisory: vim security update

An update for vim is now available for Red Hat Enterprise Linux 7 and Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available fo...

D-Link DCS-1130 Network Camera Command Injection (CVE-2017-8408)

A Command Injection vulnerability exists in D-Link DCS 1130. An authenticated attacker can send a specially crafted HTTP request to the affected target host and trigger arbitrary command execution...