Trend Micro SafeSync for Enterprise ad.pm id Remote Command Execution

A remote command execution vulnerability exists in Trend Micro Safe Sync for Enterprise ad.pm page. The vulnerability is due to insufficient validation of the user-supplied id parameter. A remote, authenticated attacker could exploit this vulnerability by sending a crafted input to the vulnerable...

SUSE SLED12 / SLES12 Security Update : tiff (SUSE-SU-2016:2508-1)

This update for tiff fixes the following security issues : - CVE-2016-3622: Specially crafted TIFF images could trigger a crash in tiff2rgba bsc974449 - Various out-of-bound write vulnerabilities with unspecified impact MSVR 35093, MSVR 35094, MSVR 35095, MSVR 35096, MSVR 35097, MSVR 35098 -...

Red Hat CloudForms Management Engine Arbitrary Command Execution Vulnerability

The Red Hat CloudForms Management Engine CFME is a management engine for IaaS Infrastructure as a Service cloud services solutions from Red Hat, Inc. An arbitrary command execution vulnerability exists in Red Hat CFME version 4.1, which can be exploited by remote attackers to execute arbitrary...

Arbitrary File Download Vulnerability in ZTE Network Sentinel

Shenzhen Zhongke Xinye Information Technology Development Co., Ltd. was registered on September 28, 2002 in Nanshan Bureau of Shenzhen Municipal Market Supervision Administration. The company's business scope includes the development of information and computer technology, technical services;...

PT-2016-7022

Name of the Vulnerable Software and Affected Versions Pivotal Spring Data JPA versions prior to 1.9.6 Gosling SR6 Pivotal Spring Data JPA versions 1.10.x prior to 1.10.4 Hopper SR4 Description The issue allows attackers to execute arbitrary JPQL commands via a sort instance with a function call,...

PT-2016-3227

Name of the Vulnerable Software and Affected Versions Veritas NetBackup Appliance versions 2.6.0.x through 2.6.0.4 Veritas NetBackup Appliance versions 2.6.1.x through 2.6.1.2 Veritas NetBackup Appliance versions 2.7.x through 2.7.3 Veritas NetBackup Appliance versions 3.0.x Description The issue...

Nagios Network Analyzer < 2.2.2 Multiple Vulnerabilities

Binary data 9602.prm...

IBM Security Access Manager for Web Remote Command Injection Vulnerability

IBM Security Access Manager ISAM for Web formerly known as IBM Tivoli Access Manager for e-business is a suite of IBM products for user authentication, authorization, and Web single sign-on solutions that provide user access management and Web application protection Functions. A remote command...

Cisco Cloud Services Platform Command Injection Vulnerability (CNVD-2016-08195)

Cisco Cloud Services Platform CSP is the U.S. Cisco Cisco company's set of hardware and software platforms for data center network function virtualization. A remote command injection vulnerability exists in Cisco CSP 2100 version 2.0. A remote attacker can exploit this vulnerability by sending a...

SugarCRM REST deserialization vulnerability

Added: 09/23/2016 BID: 91413 Background SugarCRM is customer relationship management software written in PHP. Problem Improper use of the unserialize function inside the SugarRestSerialize.php script allows remote attackers to inject PHP objects, leading to arbitrary command execution. Resolution...

SugarCRM REST deserialization vulnerability

Added: 09/23/2016 BID: 91413 Background SugarCRM is customer relationship management software written in PHP. Problem Improper use of the unserialize function inside the SugarRestSerialize.php script allows remote attackers to inject PHP objects, leading to arbitrary command execution. Resolution...

ImageMagick bmp.c Buffer Overflow Vulnerability

ImageMagick is a set of open-source image processing software from the U.S. company ImageMagick Studio. The software can read, convert and write pictures in a variety of formats. ImageMagick in the processing of other formats of image files into bmp when the conversion of buffer overflow...

Arbitrary Command Execution Vulnerability in Intelligent Traffic Optimization System of Zhengzhou Glacier Network Technology Co.

Zhengzhou Glacier Networks Technology Co., Ltd Glacier Networks is a provider of embedded software product development and network application layer management equipment. An arbitrary command execution vulnerability exists in the Intelligent Traffic Optimization System of Zhengzhou Glacier Networ...

Arbitrary Command Execution Vulnerability in Intelligent DNS System of Zhengzhou Glacier Network Technology Co.

Zhengzhou Glacier Networks Technology Co., Ltd Glacier Networks is a provider of embedded software product development and network application layer management equipment. An arbitrary command execution vulnerability exists in the Intelligent DNS system of Zhengzhou Glacier Network Technology Co. ...

Arbitrary Command Execution Vulnerability in Integration Access Controller of Zhengzhou Glacier Network Technology Co.

Zhengzhou Glacier Networks Technology Co., Ltd Glacier Networks is a provider of embedded software product development and network application layer management equipment. An arbitrary command execution vulnerability exists in the Integrated Access Controller of Zhengzhou Glacier Network Technolog...

Arbitrary Command Execution Vulnerability in Load Balancing System of Zhengzhou Glacier Network Technology Co.

Zhengzhou Glacier Networks Technology Co., Ltd Glacier Networks is a provider of embedded software product development and network application layer management equipment. An arbitrary command execution vulnerability exists in the load balancing system of Zhengzhou Glacier Network Technology Co. A...

Apache Mina 2.0.13 - Remote Command Execution

Source: https://remoteawesomethoughts.blogspot.com/2016/09/apache-mina-2013-remote-command.html Apache Mina 2.0.13 uses the OGNL library in the “IoSessionFinder” class. Its constructor takes into parameter one OGNL expression. Then this expression is executed when the method “find” is called. Thi...

Enterprise Routing Product iKuai Xiaobai Command Injection Vulnerability

Enterprise Router ikuai Xiaobai is an enterprise router from China's All Access Convergence Network Technology. A command injection vulnerability exists in the enterprise router product iKuai Xiaobai 1.3.1 and historical versions. An attacker can exploit this vulnerability to inject arbitrary...

WatchGuard RapidStream Elevation of Privilege Vulnerability

WatchGuard RapidStream is a firewall appliance from WatchGuard USA. An elevation of privilege vulnerability exists in the WatchGuard RapidStream appliance. A local attacker can exploit this vulnerability with a specially crafted ifconfig command to gain privileges and execute arbitrary commands...

CVE-2016-7089: Undefined Security Weakness

WatchGuard RapidStream appliances allow local users to gain privileges and execute arbitrary commands via a crafted ifconfig command, aka ESCALATEPLOWMAN...