EulerOS 2.0 SP9 : net-snmp (EulerOS-SA-2020-2169)

According to the versions of the net-snmp packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - SNMP Simple Network Management Protocol is a protocol used for network management. The NET-SNMP project includes various SNMP tools: an...

EulerOS 2.0 SP9 : cifs-utils (EulerOS-SA-2020-2164)

According to the version of the cifs-utils package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - It was found that cifs-utils' mount.cifs was invoking a shell when requesting the Samba password, which could be used to inject arbitrary...

EulerOS 2.0 SP9 : net-snmp (EulerOS-SA-2020-2179)

According to the versions of the net-snmp packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - SNMP Simple Network Management Protocol is a protocol used for network management. The NET-SNMP project includes various SNMP tools: an...

CVE-2020-4280

IBM QRadar SIEM 7.3 and 7.4 could allow a remote attacker to execute arbitrary commands on the system, caused by insecure deserialization of user-supplied content by the Java deserialization function. By sending a malicious serialized Java object, an attacker could exploit this vulnerability to...

Deserialization of untrusted data

IBM QRadar SIEM 7.3 and 7.4 could allow a remote attacker to execute arbitrary commands on the system, caused by insecure deserialization of user-supplied content by the Java deserialization function. By sending a malicious serialized Java object, an attacker could exploit this vulnerability to...

EUVD-2020-25527

IBM QRadar SIEM 7.3 and 7.4 could allow a remote attacker to execute arbitrary commands on the system, caused by insecure deserialization of user-supplied content by the Java deserialization function. By sending a malicious serialized Java object, an attacker could exploit this vulnerability to...

CVE-2020-13347

A command injection vulnerability was discovered in Gitlab runner versions prior to 13.2.4, 13.3.2 and 13.4.1. When the runner is configured on a Windows system with a docker executor, which allows the attacker to run arbitrary commands on Windows host, via DOCKERAUTHCONFIG build variable...

Grandstream UCM6202 Command Injection (CVE-2020-5722)

A command injection vulnerability exists in Grandstream UCM6202. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

TP-LINK Cloud Cameras Command Injection (CVE-2020-12109)

A command injection vulnerability exists in TP-LINK Cloud Cameras. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

Fortify Software Security Center Command Injection (CVE-2018-12463)

A command injection vulnerability exists in Fortify Security Center. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

CVE-2020-26582

D-Link DAP-1360U before 3.0.1 devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in the IP JSON value for ping aka resconfigaction=3&resconfigid=18...

CVE-2020-26582

D-Link DAP-1360U before 3.0.1 devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in the IP JSON value for ping aka resconfigaction=3&resconfigid=18...

CVE-2020-26582

CVE-2020-26582 affects D-Link DAP-1360U (pre-3.0.1). The issue is a command-injection via shell metacharacters in the IP JSON value used for ping (res_config_action=3&res_config_id=18), allowing an authenticated remote user to execute arbitrary commands. Impact is remote code execution with high ...

CVE-2020-16226

CVE-2020-16226 affects Mitsubishi Electric PLCs (notably MELSEC iQ-F and numerous CPU/board variants). The root issue is a flaw in TCP session handling and predictable ACK sequence numbers, enabling remote execution of arbitrary commands via impersonation of a legitimate device. Affected products...

USN-4569-1: Yaws vulnerabilities

It was discovered that Yaws did not properly sanitize XML input. A remote attacker could use this vulnerability to execute an XML External Entity XXE injection attack. CVE-2020-24379 It was discovered that Yaws mishandled certain input when running CGI scripts. A remote attacker could use this...

Ubuntu 18.04 LTS : Yaws vulnerabilities (USN-4569-1)

The remote Ubuntu 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4569-1 advisory. It was discovered that Yaws did not properly sanitize XML input. A remote attacker could use this vulnerability to execute an XML External Entity XXE...

Checkmk 1.6.0p16 Local Privilege Escalation Vulnerability

Product: Checkmk Vendor: tribe29 GmbH CSNC ID: CSNC-2020-005 Subject: Local Privilege Escalation Risk: High Effect: Locally exploitable Authors: Thierry Viaccoz Date: 21.09.2020 Introduction: ------------- Checkmk 1 is an IT infrastructure monitoring software. It is consists of a management serve...

Design/Logic Flaw

confdatetime in Secudos DOMOS 5.8 allows remote attackers to execute arbitrary commands as root via shell metacharacters in the zone field obtained from the web interface...

CVE-2020-14293

confdatetime in Secudos DOMOS 5.8 allows remote attackers to execute arbitrary commands as root via shell metacharacters in the zone field obtained from the web interface...

Security Bulletin: IBM Resilient SOAR is Using Components with Known Vulnerabilities - Plexus-utils (CVE-2017-1000487)

Summary Plexus-utils could allow a remote attacker to execute arbitrary commands on the system, caused by improper validation of user-supplied input. By sending contents with double quoted strings, an attacker could exploit this vulnerability to execute arbitrary commands on the system...