EulerOS Virtualization for ARM 64 3.0.2.0 : git (EulerOS-SA-2020-1537)

According to the versions of the git packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - Arbitrary command execution is possible in Git before 2.20.2, 2.21.x before 2.21.1, 2.22.x before 2.22.2, 2.23.x before...

CVE-2020-5873

On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.6.1-11.6.5 and BIG-IQ 5.2.0-7.1.0, a user associated with the Resource Administrator role who has access to the secure copy scp utility but does not have access to Advanced Shell bash can execute arbitrary commands...

CVE-2020-5873: Undefined Security Weakness

On BIG-IP 15.0.0-15.0.1, 14.1.0-14.1.2.3, 13.1.0-13.1.3.1, 12.1.0-12.1.5, and 11.6.1-11.6.5 and BIG-IQ 5.2.0-7.1.0, a user associated with the Resource Administrator role who has access to the secure copy scp utility but does not have access to Advanced Shell bash can execute arbitrary commands...

CVE-2020-11651: Undefined Security Weakness

An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate method calls. This allows a remote user to access some methods without authentication. These methods can be used to retrieve user tokens from the...

Huawei EulerOS: Security Advisory for git (EulerOS-SA-2020-1537)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2020-7804

ActiveX ControlHShell.dll in Handy Groupware 1.7.3.1 for Windows 7, 8, and 10 allows an attacker to execute arbitrary command via the ShellExec method...

Design/Logic Flaw

ActiveX ControlHShell.dll in Handy Groupware 1.7.3.1 for Windows 7, 8, and 10 allows an attacker to execute arbitrary command via the ShellExec method...

CVE-2020-7804

ActiveX ControlHShell.dll in Handy Groupware 1.7.3.1 for Windows 7, 8, and 10 allows an attacker to execute arbitrary command via the ShellExec method...

CVE-2020-7804

ActiveX ControlHShell.dll in Handy Groupware 1.7.3.1 for Windows 7, 8, and 10 allows an attacker to execute arbitrary command via the ShellExec method...

CVE-2019-16652: Undefined Security Weakness

The BPM component in Genius Bytes Genius Server Genius CDDS 3.2.2 allows remote authenticated users to execute arbitrary commands...

PT-2020-19801

Name of the Vulnerable Software and Affected Versions Handy Groupware version 1.7.3.1 Description The issue allows an attacker to execute arbitrary commands via the ShellExec method in the ActiveX Control HShell.dll. Recommendations For Handy Groupware version 1.7.3.1, consider disabling the...

TrixBox CE endpoint_devicemap.php Authenticated Command Execution

This module exploits an authenticated OS command injection vulnerability found in Trixbox CE version 1.2.0 to 2.8.0.4 inclusive in the "network" POST parameter of the "/maint/modules/endpointcfg/endpointdevicemap.php" page. Successful exploitation allows for arbitrary command execution on the...

FreeBSD : py-yaml -- FullLoader (still) exploitable for arbitrary command execution (aae8fecf-888e-11ea-9714-08002718de91)

Riccardo Schirone https://github.com/ret2libc reports : In FullLoader python/object/new constructor, implemented by constructpythonobjectapply, has support for setting the state of a deserialized instance through the setpythoninstancestate method. After setting the state, some operations are...

Evince Arbitrary Command Execution

The vulnerability of the Evince document viewing software is related to the lack of measures taken to neutralize special elements. Exploiting this vulnerability can allow a perpetrator to execute arbitrary commands...

PT-2020-19676

Name of the Vulnerable Software and Affected Versions pixl-class versions prior to 1.0.3 Description The issue allows execution of arbitrary commands. The members argument of the create function can be controlled by users without any sanitization. Recommendations For versions prior to 1.0.3, upda...

Fedora 30 : rubygem-rake (2020-28e06b5f08)

A security flaw is found on rake which may case arbitrary command execution under file existence with crafted name. This new rpm will fix the issue CVE-2020-8130 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenabl...

Fedora 31 : rubygem-rake (2020-dc1ae17bb5)

A security flaw is found on rake which may case arbitrary command execution under file existence with crafted name. This new rpm will fix the issue CVE-2020-8130 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenabl...

PT-2020-8322

Name of the Vulnerable Software and Affected Versions: NETGEAR D6100 versions prior to V1.0.0.55 NETGEAR D7800 versions prior to V1.0.1.24 NETGEAR EX6150v2 versions prior to 1.0.0.48 NETGEAR R6100 versions prior to 1.0.1.14 NETGEAR R7500 versions prior to 1.0.0.110 NETGEAR R7500v2 versions prior ...

iCATCH DVR Input Validation Error Vulnerability

The iCATCH DVR is a digital video recorder DVR from China Desirable International iCATCH. An input validation error vulnerability exists in the firmware of iCATCH DVR prior to version 20200103, which arises from the program failing to properly validate the parameters of a function. An attacker...

CVE-2020-11811

In qdPM 9.1, an attacker can upload a malicious .php file to the server by exploiting the Add Profile Photo capability with a crafted content-type value. After that, the attacker can execute an arbitrary command on the server using this malicious file...