tnftp "savefile" Arbitrary Command Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'tnftp "savefile" Arbitrary Command Execution', 'Description' = %q This module exploits an arbitrary command execution vulnerability in tnftp's...

Ansible Tower Arbitrary Command Execution Vulnerability

Ansible is a computer system configuration manager from Ansible, Inc. that can be used to publish, manage, and orchestrate computer systems.Ansible Tower a.k.a. Ansible UI is one of the task control applications that provides a user interface UI, dashboard, and REST API. An arbitrary command...

devscripts script Shell Command Execution

The vulnerability of the devscripts script scripts/licensecheck.pl for the Fedora operating system is related to the lack of measures taken to neutralize the special elements used in the command. Exploiting this vulnerability could allow a local attacker to execute arbitrary shell commands...

tnftp - 'savefile' Arbitrary Command Execution (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'tnftp "savefile" Arbitrary Command Execution', 'Description' = %q This module exploits an arbitrary command execution vulnerability in tnftp's...

Arbitrary Command Execution

Dulwich is vulnerable to arbitrary command execution. When using the SSH subprocess, an attacker can use an ssh URL with the - dash character in the hostname.This is related to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-1000116, and CVE-2017-1000117...

D-Link TRENDnet Router Firmware Command Execution Authentication Bypass

The vulnerability of D-Link and TRENDnet’s microprogrammed router software services is related to deficiencies in the authentication process when processing the ping command. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using the pingaddr parameter...

GHSA-RFMF-RX8W-935W Sounder Contains Arbitrary Command Execution Vulnerability

lib/sounder/sound.rb in the sounder gem 1.0.1 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a filename...

GHSA-G266-3CRH-H7GJ ldoce Gem Arbitrary Command Execution

lib/ldoce/word.rb in the ldoce 0.0.2 gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in 1 an mp3 URL or 2 file name...

Apache James Deserialization RCE(CVE-2017-12628)

Analysis of CVE-2017-12628 This morning I spotted a tweet mentioning an “Apache James 3.0.1 JMX Server Deserialization” vulnerability, CVE-2017-12628, which caught my eye because I wrote a generic JMX deserialization exploit which is included in my RMI attack tool BaRMIe. A quick search for more...

CVE-2014-3741

The printDirect function in lib/printer.js in the node-printer module 0.0.1 and earlier for Node.js allows remote attackers to execute arbitrary commands via unspecified characters in the lpr command...

Arbitrary Command Execution Through Java Deserialization Flaw

james-server is vulnerable to arbitrary command execution. The vulnerability exists due to a Java deserialization issue through the command line client introduced by an embedded JMX Server in james-server...

CVE-2017-12628

The JMX server embedded in Apache James, also used by the command line client is exposed to a java de-serialization issue, and thus can be used to execute arbitrary commands. As James exposes JMX socket by default only on local-host, this vulnerability can only be used for privilege escalation...

CVE-2017-12628: Deserialization of Untrusted Data

The JMX server embedded in Apache James, also used by the command line client is exposed to a java de-serialization issue, and thus can be used to execute arbitrary commands. As James exposes JMX socket by default only on local-host, this vulnerability can only be used for privilege escalation...

PT-2017-12610

Name of the Vulnerable Software and Affected Versions Apache James versions prior to 3.0.1 Description The issue concerns a java de-serialization problem in the JMX server embedded in Apache James, which can be exploited to execute arbitrary commands. This can be used for privilege escalation, as...

Cross site request forgery (csrf)

CSRF exists in Webmin 1.850. By sending a GET request to at/createjob.cgi containing dir=/&cmd= in the URI, an attacker to execute arbitrary commands...

CVE-2017-15645

CVE-2017-15645 : Webmin 1.850 is vulnerable to CSRF via a crafted GET request to at/create_job.cgi containing dir=/&cmd= in the URI, enabling an attacker to execute arbitrary commands. Multiple connected sources corroborate the vulnerability, including Red Hat and CVE registries; the attack vecto...

CVE-2017-15645

CSRF exists in Webmin 1.850. By sending a GET request to at/createjob.cgi containing dir=/&cmd= in the URI, an attacker to execute arbitrary commands...

CVE-2017-12301: Improper Input Validation

A vulnerability in the Python scripting subsystem of Cisco NX-OS Software could allow an authenticated, local attacker to escape the Python parser and gain unauthorized access to the underlying operating system of the device. The vulnerability exists due to insufficient sanitization of...

PT-2017-14137

Name of the Vulnerable Software and Affected Versions Webmin version 1.850 Description A CSRF issue exists, allowing an attacker to execute arbitrary commands by sending a GET request to the "at/create job.cgi" endpoint with specific parameters in the URI, such as dir=/ and cmd=. Recommendations...

SUSE-SU-2017:2747-1 Security update for git

This update for git fixes the following issues: This security issue was fixed: - CVE-2017-14867: Git used unsafe Perl scripts to support subcommands such as cvsserver, which allowed attackers to execute arbitrary OS commands via shell metacharacters in a module name bsc1061041...