Applications Manager 12.5 Arbitrary Command Execution Exploit

Summary ManageEngine Applications Manager is an application performance monitoring solution that proactively monitors business applications and help businesses ensure their revenue-critical applications meet end user expectations. Applications Manager offers out-of-the-box monitoring support for...

Trend Micro - node.js HTTP Server Listening on localhost Can Execute Commands

Trend Micro - node.js HTTP Server Listening on localhost Can Execute Commands Trend Micro Maximum Security 10 Exploit Sample exploit for Trend Micro Maximum Security 10. -- Tavis Ormandy. Command: Click Here to run the command above the default will uninstall Trend Micro Maximum. img...

Furuno Voyage Data Recorder (VDR) moduleserv firmware update utility fails to properly sanitize user-provided input

Overview Furuno Voyage Data Recorder VDR VR-3000/VR-3000S and VR-7000 moduleserv firmware update utility fails to properly sanitize user-provided input and is vulnerable to arbitrary command execution with root privileges. Description According to the Furuno VDR product page, the VDR "records all...

CVE-2015-5003

The portal in IBM Tivoli Monitoring ITM 6.2.2 through FP9, 6.2.3 through FP5, and 6.3.0 before FP7 allows remote authenticated users to execute arbitrary commands by leveraging Take Action view authority and providing crafted input...

CVE-2015-7450

Serialized-object interfaces in certain IBM analytics, business solutions, cognitive, IT infrastructure, and mobile and social products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the InvokerTransformer class in the Apache Commons...

VMware vRealize Orchestrator Arbitrary Command Execution Vulnerability

VMware vRealize Orchestrator is a suite of IT process automation engines for integrating with VMware vCloud Suite components to align and extend service delivery and operations management. VMware vRealize Orchestrator 6.x, vCenter Orchestrator 5.x, vRealize Operations 6.x, vCenter Operations...

Cisco Prime Network Services Controller Arbitrary Command Execution Vulnerability

Cisco Prime Network Services Controller is a set of cloud automation network management software from Cisco Cisco. An arbitrary command execution vulnerability exists in Cisco Prime Network Services Controller 3.0. It allows a local user to bypass predefined access restrictions and execute...

Joomla User-Agent PHP object injection

Added: 12/17/2015 CVE: CVE-2015-8562 BID: 79195 Background Joomla is a content management system written in PHP. Problem A vulnerability which occurs when Joomla saves browser session information could allow a remote, unauthenticated attacker to inject PHP objects via the User-Agent header, leadi...

Cambium Networks ePMP 1000 Command Injection Vulnerability

Cambium Networks ePMP 1000 is a suite of wireless network access platforms from Cambium Networks, USA. The platform provides video surveillance, Wi-Fi hotspot and sensor connectivity. A command injection vulnerability exists in the Cambium Networks ePMP 1000. An attacker can exploit the...

Square Open Source: git-fastclone allows arbitrary command execution through usage of ext remote URLs in submodules

I recently discovered a security vulnerability in git that also affects other programs that manually reimplement submodule-like operations. The recent security update to git0 concerning git-remote-ext URLs in submodules affects git-fastclone similarly. This bug was patched in Git v2.6.1, v2.5.4,...

MGASA-2015-0465 Updated cups-filters packages fix security vulnerability

Michal Kowalczyk discovered that missing input sanitising in the foomatic-rip print filter might result in the execution of arbitrary commands CVE-2015-8327...

Zhongkexinye Network Sentinel Arbitrary Command Execution Vulnerability

ZKXY Network Sentinel is an Internet security auditing system that integrates behavioral auditing and content auditing, and is deployed as a bypass at the network egress. An arbitrary command execution vulnerability exists in ZKXN Network Sentry. The vulnerability exists in the file:...

Multiple Vulnerabilities in ZKN Cyber Sentinel

ZKXY Network Sentinel is an Internet security auditing system that integrates behavioral auditing and content auditing, and is deployed as a bypass at the network egress. ZKXN Network Sentry suffers from arbitrary file inclusion and arbitrary command execution vulnerabilities. The vulnerability...

Use the F5 ICall scripting mention the right vulnerability analysis(CVE-2 0 1 5-3 6 2 8)-vulnerability warning-the black bar safety net

Earlier this year, GDS in F5 BIG-IP LTM found a loophole, this loophole allows limited user access to the system after the extraction and at the mention of the right after the successful remote execution of the command. This article will show you how to manually take advantage of this...

Lenovo System Update Competitive Conditions Vulnerability

Lenovo System Update formerly known as ThinkVantage System Update is a set of automatic system update tools from the Chinese company Lenovo. A competitive condition vulnerability exists in Lenovo System Update versions prior to 5.06.0043. The vulnerability can be exploited by an attacker to run...

Debian DSA-3411-1 : cups-filters - security update

Michal Kowalczyk discovered that missing input sanitising in the foomatic-rip print filter might result in the execution of arbitrary commands. The oldstable distribution wheezy is not affected. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this...

CSL DualCom GPRS CS2300-R SPT Arbitrary Command Execution Vulnerability

The CSL DualCom GPRS CS2300-R SPT is an alarm signaling board from CSL DualCom, UK, which provides a communication link between the burglar alarm and the monitoring center, allowing signals to be sent to the monitoring center when the alarm goes off, via the mobile network, ordinary phone lines o...

IBM Installation Manager '/tmp' Local Command Injection Vulnerability

IBM Installation Manager is a set of IBM's general software management tools that can run on multiple platforms e.g., IBM i, OS, Windows, Linux, Unix. A command injection vulnerability exists in IBM Installation Manager version 1.8.1. A local attacker can exploit this vulnerability to execute...

The vulnerability of the CommVault Edge data archiving and restoration software allows a hacker to execute arbitrary commands.

The vulnerability of the CommVault Edge data archiving and recovery program exists due to the lack of measures taken to neutralize special elements used in the operating system’s command set. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands using a specially...

IBM Tivoli Storage Manager FastBack Server Opcode 1330 Command Injection (CVE-2015-1949)

A command injection vulnerability exists in IBM Tivoli Storage Manager FastBack Server. The vulnerability is due to insufficient input validation of parameters in opcode 1330 requests. A remote unauthenticated attacker could exploit this vulnerability by sending crafted requests to port 11460/TCP...