PT-2018-2283 · Cisco · Cisco Small Business Routers

Name of the Vulnerable Software and Affected Versions: Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers affected versions not specified Description: A vulnerability in the web-based management interface of Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could...

Default credentials

Bypassing password security vulnerability in McAfee Application and Change Control MACC 7.0.1 and 6.2.0 allows authenticated users to perform arbitrary command execution via a command-line utility...

CVE-2017-3912

Bypassing password security vulnerability in McAfee Application and Change Control MACC 7.0.1 and 6.2.0 allows authenticated users to perform arbitrary command execution via a command-line utility...

CVE-2017-3912 McAfee Application Control and Change Control (MACC) - password management security feature bypass (SFB) leading to an authentication bypass

Bypassing password security vulnerability in McAfee Application and Change Control MACC 7.0.1 and 6.2.0 allows authenticated users to perform arbitrary command execution via a command-line utility...

CVE-2017-3912: Improper Handling of Insufficient Privileges

Bypassing password security vulnerability in McAfee Application and Change Control MACC 7.0.1 and 6.2.0 allows authenticated users to perform arbitrary command execution via a command-line utility...

PT-2018-2013

Name of the Vulnerable Software and Affected Versions Logitech Options affected versions not specified Description The issue is related to the lack of authentication attempt limits in the Logitech Options utility's WebSocket server. This could allow a remote attacker to execute arbitrary commands...

Information Builders WebFOCUS Business Intelligence Portal Command Injection Vulnerability

Information Builders WebFOCUS Business Intelligence Portal is a Business Intelligence Portal system from Information Builders USA. A command injection vulnerability exists in Information Builders WebFOCUS Business Intelligence Portal version 8.1, which can be exploited by sending a specially...

PT-2018-13159

Name of the Vulnerable Software and Affected Versions IBM QRadar versions 7.2 through 7.3 Description The issue allows a remote authenticated attacker to execute arbitrary commands on the system by sending a specially-crafted request. This enables the attacker to exploit the system and execute...

CVE-2018-1571: Undefined Security Weakness

IBM QRadar 7.2 and 7.3 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary commands on the system. IBM X-Force ID: 143121...

CVE-2018-16460

A command Injection in ps package versions 1.0.0 for Node.js allowed arbitrary commands to be executed when attacker controls the PID...

CVE-2018-4010: Improper Neutralization of Special Elements used in an OS Command

An exploitable code execution vulnerability exists in the connect functionality of ProtonVPN VPN client 1.5.1. A specially crafted configuration file can cause a privilege escalation, resulting in the ability to execute arbitrary commands with the system's privileges...

CVE-2018-16460: Improper Neutralization of Special Elements used in a Command

A command Injection in ps package versions 1.0.0 for Node.js allowed arbitrary commands to be executed when attacker controls the PID...

Debian DLA-1495-1 : git-annex security update

The git-annex package was found to have multiple vulnerabilities when operating on untrusted data that could lead to arbitrary command execution and encrypted data exfiltration. CVE-2017-12976 git-annex before 6.20170818 allows remote attackers to execute arbitrary commands via an ssh URL with an...

PT-2018-13424

Name of the Vulnerable Software and Affected Versions Opsview Monitor versions 5.4.x through 5.4.1 Description The issue affects the web management console, where an authenticated administrator can exploit a command injection flaw due to improper sanitization of the value parameter. This allows f...

OpenEMR Remote Code Execution Vulnerability

OpenEMR is the open source electronic health record and medical practice management solution. OpenEMR suffers from a remote code execution vulnerability. Due to the failure to strictly filter incoming parameters when modifying configurations in the background, an attacker can exploit the...

Debian: Security Advisory (DLA-1455-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2018-13299

Name of the Vulnerable Software and Affected Versions IBM Spectrum Symphony and Platform Symphony versions 7.1.2 through 7.2.0.2 Description The issue allows an authenticated user to execute arbitrary commands due to improper handling of user-supplied input. Recommendations For versions 7.1.2...

CVE-2018-1595: Undefined Security Weakness

IBM Spectrum Symphony and Platform Symphony 7.1.2 and 7.2.0.2 could allow an authenticated user to execute arbitrary commands due to improper handling of user supplied input. IBM X-Force ID: 143622...

CVE-2016-8628

Ansible before version 2.2.0 fails to properly sanitize fact variables sent from the Ansible controller. An attacker with the ability to create special variables on the controller could execute arbitrary commands on Ansible clients as the user Ansible runs as...

Design/Logic Flaw

Concatenating unsanitized user input in the whereis npm module 0.4.1 allowed an attacker to execute arbitrary commands. The whereis module is deprecated and it is recommended to use the which npm module instead...