Command injection

ActiveX Control in MyBuilder before 6.2.2019.814 allow an attacker to execute arbitrary command via the ShellOpen method. This can be leveraged for code execution...

CVE-2019-12812

MyBuilder Viewer prior to version 6.2.2019.814 is vulnerable to arbitrary command execution via a specially crafted configuration file, enabling code execution. This is documented across multiple connected sources (e.g., RH-CVE-2019-12812, NVD entry). The exact root cause is described as insecure...

CVE-2019-12811

CVE-2019-12811 affects the ActiveX Control in MyBuilder prior to version 6.2.2019.814. The underlying issue is that the ShellOpen method can be abused to execute arbitrary commands, enabling code execution. The Red Hat entry reiterates the same flaw and impacts, but the provided documents do not ...

CVE-2019-12812: Improper Neutralization of Special Elements used in an OS Command

MyBuilder viewer before 6.2.2019.814 allow an attacker to execute arbitrary command via specifically crafted configuration file. This can be leveraged for code execution...

CVE-2019-12688: Improper Restriction of Operations within the Bounds of a Memory Buffer

A vulnerability in the web UI of the Cisco Firepower Management Center FMC could allow an authenticated, remote attacker to execute arbitrary commands on an affected device. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted...

CVE-2019-12687: Improper Restriction of Operations within the Bounds of a Memory Buffer

A vulnerability in the web UI of the Cisco Firepower Management Center FMC could allow an authenticated, remote attacker to execute arbitrary commands on an affected device. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted...

CVE-2019-13658: Use of Hard-coded Credentials

CA Network Flow Analysis 9.x and 10.0.x have a default credential vulnerability that can allow a remote attacker to execute arbitrary commands and compromise system security...

Command Injection in Zingbox Inspector

A command injection vulnerability exists in the Zingbox Inspector CLI that allows for an authenticated user to execute arbitrary system commands. Ref: CVE-2019-15014 The vulnerability allows for authenticated users to execute arbitrary commands within the product CLI console. This issue affects...

HPESBST03956 rev.2 - HPE SimpliVity OmniStack, Local and Remote Arbitrary Command Execution

Potential Security Impact: Local: Arbitrary Command Execution; Remote: Arbitrary Command Execution SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE SimpliVity 380 Gen9 releases from 3.6.2 to 3.7.9 HPE SimpliVity 380 Gen10 releases from 3.7.1 to 3.7.9 HPE SimpliVity 380 Gen10 G...

PT-2019-13945

Name of the Vulnerable Software and Affected Versions JetBrains TeamCity versions prior to 2018.2.5 JetBrains TeamCity versions prior to 2019.1 Description An issue was discovered that allows a TeamCity Project administrator to execute any command on the server machine. Recommendations For versio...

PT-2019-3335

Name of the Vulnerable Software and Affected Versions Cisco NX-OS Software affected versions not specified Cisco IOS XE affected versions not specified Description The issue exists due to insufficient validation of arguments passed to a specific command related to the virtualization manager VMAN ...

EulerOS 2.0 SP3 : libvirt (EulerOS-SA-2019-2020)

According to the versions of the libvirt packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - libvirt: arbitrary file read/exec via virDomainSaveImageGetXMLDesc API CVE-2019-10161 - libvirt: arbitrary command execution via...

EulerOS 2.0 SP3 : vim (EulerOS-SA-2019-1997)

According to the version of the vim packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - It was found that the :source! command was not restricted by the sandbox mode. If modeline was explicitly enabled, opening a specially crafted text fi...

Cisco Webex Teams Command Execution

The vulnerability in the client application of the Cisco Webex Teams software exists because measures to neutralize specific elements have not been taken. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely by guiding users through a specially crafted lin...

CVE-2019-6840

A Format String: CWE-134 vulnerability exists in U.motion Server MEG6501-0001 - U.motion KNX server, MEG6501-0002 - U.motion KNX Server Plus, MEG6260-0410 - U.motion KNX Server Plus, Touch 10, MEG6260-0415 - U.motion KNX Server Plus, Touch 15, which could allow an attacker to send a crafted messa...

CVE-2019-6840: Use of Externally-Controlled Format String

A Format String: CWE-134 vulnerability exists in U.motion Server MEG6501-0001 - U.motion KNX server, MEG6501-0002 - U.motion KNX Server Plus, MEG6260-0410 - U.motion KNX Server Plus, Touch 10, MEG6260-0415 - U.motion KNX Server Plus, Touch 15, which could allow an attacker to send a crafted messa...

PT-2019-18375 · U.Motion · U.Motion Server

Name of the Vulnerable Software and Affected Versions: U.motion Server affected versions not specified Description: A Format String vulnerability exists in the U.motion Server, which could allow an attacker to send a crafted message to the target server, thereby causing arbitrary commands to be...

FortiManager VM Code Execution

The vulnerability of the software for centralized device management in Fortinet FortiManager VM exists due to insufficient verification of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code or perform arbitrary commands remotely...

CVE-2019-14813: Incorrect Use of Privileged APIs

A flaw was found in ghostscript, versions 9.x before 9.50, in the setsystemparams procedure where it did not properly secure its privileged calls, enabling scripts to bypass -dSAFER restrictions. A specially crafted PostScript file could disable security protection and then have access to the fil...

CVE-2019-15029

FusionPBX 4.4.8 allows an attacker to execute arbitrary system commands by submitting a malicious command to the serviceedit.php file which will insert the malicious command into the database. To trigger the command, one needs to call the services.php file via a GET request with the service id...