CVE-2018-7082

A command injection vulnerability is present in Aruba Instant that permits an authenticated administrative user to execute arbitrary commands on the underlying operating system. A malicious administrator could use this ability to install backdoors or change system configuration in a way that woul...

Command injection

A command injection vulnerability is present in Aruba Instant that permits an authenticated administrative user to execute arbitrary commands on the underlying operating system. A malicious administrator could use this ability to install backdoors or change system configuration in a way that woul...

CVE-2018-7082

CVE-2018-7082 is a command injection vulnerability in Aruba Instant that allows an authenticated administrative user to execute arbitrary OS commands. The issue stems from insufficient input handling in the web-facing management path, enabling a malicious admin to install backdoors or modify conf...

CVE-2018-7082

A command injection vulnerability is present in Aruba Instant that permits an authenticated administrative user to execute arbitrary commands on the underlying operating system. A malicious administrator could use this ability to install backdoors or change system configuration in a way that woul...

CVE-2019-4071

IBM Tivoli Storage Productivity Center IBM Spectrum Control Standard Edition 5.2.1 through 5.2.17 could allow a remote attacker to execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 157063...

CVE-2019-4071

IBM Tivoli Storage Productivity Center IBM Spectrum Control Standard Edition 5.2.1 through 5.2.17 could allow a remote attacker to execute arbitrary commands on the system, caused by improper validation of csv file contents. IBM X-Force ID: 157063...

D-Link DWL-2600AP Upgrade Firmware Command Execution Vulnerability

The D-Link DWL-2600AP is a wireless accessor. A command injection vulnerability exists in the D-Link DWL-2600AP Upgrade Firmware, which can be exploited by an attacker to execute arbitrary operating system commands on the device...

runc: Execution of malicious containers allows for container escape and access to host filesystem

A flaw was found in the way runc handled system file descriptors when running containers. A malicious container could use this flaw to overwrite contents of the runc binary and consequently run arbitrary commands on the container host system...

Ubuntu 16.04 LTS : Sudo vulnerabilities (USN-3968-1)

The remote Ubuntu 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3968-1 advisory. Florian Weimer discovered that Sudo incorrectly handled the noexec restriction when used with certain applications. A local attacker could possibly use...

Privilege Escalation

sudo is vulnerable to privilege escalation vulnerability. sudo noexec restriction could have been bypassed if application run via sudo executed wordexp C library function with a user supplied argument which allow local users to inject arbitrary commands with elevated privileges...

Apache Pluto Chat Room Demo Portlet Persistent Cross-Site Scripting (CVE-2019-0186)

A cross site scripting vulnerability exists in Apache Pluto. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary commands on the affected system...

CVE-2018-16660

A command injection vulnerability in PWS in Imperva SecureSphere 13.0.0.10 and 13.1.0.10 Gateway allows an attacker with authenticated access to execute arbitrary OS commands on a vulnerable installation...

Input validation

The ASUS Zenfone V Live Android device with a build fingerprint of asus/VZWASUSA009/ASUSA009:7.1.1/NMF26F/14.0610.1802.78-20180313:user/release-keys and the Asus ZenFone 3 Max Android device with a build fingerprint of...

CVE-2018-14993

The ASUS Zenfone V Live Android device with a build fingerprint of asus/VZWASUSA009/ASUSA009:7.1.1/NMF26F/14.0610.1802.78-20180313:user/release-keys and the Asus ZenFone 3 Max Android device with a build fingerprint of...

CVE-2018-14996

CVE-2018-14996 affects the Oppo F5 on OPPO/CPH1723 running Android 7.1.1, where a pre-installed platform app with package name com.dropboxchmod exposes an exported service DropboxChmodService . This service allows a co-located app with zero permissions to supply arbitrary commands to be executed ...

CVE-2018-14993

The CVE-2018-14993 issue affects ASUS Zenfone V Live (build asus/VZW_ASUS_A009/ASUS_A009:7.1.1) and Asus ZenFone 3 Max (build asus/US_Phone/ASUS_X008_1:7.0). A pre-installed platform app, com.asus.splendidcommandagent (versionCode 1510200090, versionName 1.2.0.18_160928), contains an exported ser...

CVE-2018-14993

The ASUS Zenfone V Live Android device with a build fingerprint of asus/VZWASUSA009/ASUSA009:7.1.1/NMF26F/14.0610.1802.78-20180313:user/release-keys and the Asus ZenFone 3 Max Android device with a build fingerprint of...

Design/Logic Flaw

The GitController in Jakub Chodounsky Bonobo Git Server before 6.5.0 allows execution of arbitrary commands in the context of the web server via a crafted http request...

CVE-2019-11217

The GitController in Jakub Chodounsky Bonobo Git Server before 6.5.0 allows execution of arbitrary commands in the context of the web server via a crafted http request...

CVE-2019-11217

The CVE-2019-11217 issue affects Bonobo Git Server: GitController before 6.5.0 allows arbitrary command execution in the web server context via a crafted HTTP request. The root cause is exposed in the GitController handling, enabling an attacker to run commands with server privileges. Impact is h...