PT-2020-19645

Name of the Vulnerable Software and Affected Versions codecov-node versions prior to 3.6.5 Description The issue allows remote attackers to execute arbitrary commands due to an incomplete fix of a previous problem. The value provided as part of the gcov-root argument is executed by the exec...

CVE-2020-7597: Improper Neutralization of Special Elements used in an OS Command

codecov-node npm module before 3.6.5 allows remote attackers to execute arbitrary commands.The value provided as part of the gcov-root argument is executed by the exec function within lib/codecov.js. This vulnerability exists due to an incomplete fix of CVE-2020-7596...

CVE-2013-1400

Multiple SQL injection vulnerabilities in CWPPoll.js in WordPress Poll Plugin 34.5 for WordPress allow attackers to execute arbitrary SQL commands via the pollid or pollid parameter in a viewPollResults or userlogs action...

TrendMicro Password Manager node.js Unsafe API Calls

When you install TrendMicro Antivirus on Windows, by default a component called Password Manager is also installed and automatically launched on startup. This product is primarily written in JavaScript with node.js, and opens multiple HTTP RPC ports for handling API requests. It took about 30...

PT-2020-7577

Name of the Vulnerable Software and Affected Versions Hubot Scripts versions prior to 2.4.4 Description The issue allows remote attackers to execute arbitrary commands due to a command injection vulnerability in the hubot-scripts/package/src/scripts/email.coffee module. The email script is not...

CVE-2019-14514

An issue was discovered in Microvirt MEmu all versions prior to 7.0.2. A guest Android operating system inside the MEmu emulator contains a /system/bin/systemd binary that is run with root privileges on startup this is unrelated to Red Hat's systemd init program, and is a closed-source proprietar...

CVE-2019-14514

An issue was discovered in Microvirt MEmu all versions prior to 7.0.2. A guest Android operating system inside the MEmu emulator contains a /system/bin/systemd binary that is run with root privileges on startup this is unrelated to Red Hat's systemd init program, and is a closed-source proprietar...

Participants Database Temporal SQL Injection Vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A SQL injection vulnerability exists in the WordPress Participants Database plugin prior to version 1.9.5.5. T...

ajaxArchiveFiles.php Command Execution

The vulnerability of the ajaxArchiveFiles.php component, a utility for managing the configuration of rConfig network devices, is related to errors in handling HTTP requests. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands on the target system by sending...

CVE-2019-14514

An issue was discovered in Microvirt MEmu all versions prior to 7.0.2. A guest Android operating system inside the MEmu emulator contains a /system/bin/systemd binary that is run with root privileges on startup this is unrelated to Red Hat's systemd init program, and is a closed-source proprietar...

PT-2020-9575

Name of the Vulnerable Software and Affected Versions: Microvirt MEmu versions prior to 7.0.2 Description: An issue was discovered in Microvirt MEmu where a guest Android operating system contains a /system/bin/systemd binary that runs with root privileges on startup. This binary opens TCP port...

[ASA-202002-4] ksh: arbitrary command execution

Arch Linux Security Advisory ASA-202002-4 ========================================= Severity: High Date : 2020-02-08 CVE-ID : CVE-2019-14868 Package : ksh Type : arbitrary command execution Remote : No Link : https://security.archlinux.org/AVG-1095 Summary ======= The package ksh before version...

CVE-2013-3628

Zabbix 2.0.9 has an Arbitrary Command Execution Vulnerability...

CVE-2013-3628

Zabbix 2.0.9 has an Arbitrary Command Execution Vulnerability...

CVE-2013-3628: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Zabbix 2.0.9 has an Arbitrary Command Execution Vulnerability...

USN-4268-1: OpenSMTPD vulnerability

It was discovered that OpenSMTPD incorrectly verified the sender's or receiver's e-mail addresses under certain conditions. An attacker could use this vulnerability to execute arbitrary commands as root...

Ghostscript access restriction bypass vulnerability

Overview Ghostscript provided by Artifex Software Inc. contains an access restriction bypass vulnerability CWE-284. Hiroki MATSUKUMA of Cyber Defense Institute, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership...

Arbitrary Command Execution

im-metadata is vulnerable to arbitrary command execution. The vulnerability is possible because the metadata options and arguments to the exec command was not filtered and directly processed...

PT-2020-9139

Name of the Vulnerable Software and Affected Versions im-metadata versions 3.0.1 and earlier Description The issue allows remote attackers to execute arbitrary commands via the exec argument. It is possible to inject arbitrary commands as part of the metadata options which is given to the exec...

D-Link DIR-859 ssdpcgi() M-SEARCH Arbitrary Command Execution Vulnerability

The D-Link DIR-859 is a router device. A security vulnerability exists in the D-Link DIR-859 ssdpcgi M-SEARCH method handling, which can be exploited by remote attackers to submit a special request to execute arbitrary commands...