4372 matches found
PT-2019-14226
Name of the Vulnerable Software and Affected Versions Vera Edge Home Controller version 1.7.4452 Description The issue allows remote unauthenticated users to execute arbitrary OS commands. This is achieved through argument injection in the username parameter to the "/cgi-bin/cmh/webcam.sh" API...
CVE-2019-15498: Improper Neutralization of Argument Delimiters in a Command
cgi-bin/cmh/webcam.sh in Vera Edge Home Controller 1.7.4452 allows remote unauthenticated users to execute arbitrary OS commands via --output argument injection in the username parameter to /cgi-bin/cmh/webcam.sh...
Linux/x86_64 - AVX2 XOR Decoder + execve(/bin/sh) Shellcode (62 bytes)
/ ; Title : Linux/x8664 - AVX2 XOR Decoder + execve"/bin/sh" 62 bytes ; Author : Gonçalo Ribeiro @goncalor ; Website : goncalor.com ; SLAE64-ID : 1635 ; this only works on machines with a CPU that supports AVX2 instructions global start start: jmp calldecoder decoder: pop rsi lea rdi, rsi+1 ;...
CVE-2019-15119
lib/install/install.go in cnlh nps through 0.23.2 uses 0777 permissions for /usr/local/bin/nps and/or /usr/bin/nps, leading to a file overwrite by a local user...
PT-2019-13998 · Cnlh · Nps
Name of the Vulnerable Software and Affected Versions: cnlh nps versions 0.23.2 and earlier Description: The issue arises from the use of 0777 permissions for /usr/local/bin/nps and/or /usr/bin/nps in lib/install/install.go, allowing a local user to overwrite files. Recommendations: For versions...
The vulnerability of the FortiOS operating system, related to access control errors, allows a perpetrator to execute arbitrary code.
The vulnerability of the FortiOS operating system is related to access control errors. Exploiting this vulnerability allows a person with administrator privileges to execute arbitrary code by creating a symbolic link to an executable file in the “/bin/” directory...
radare2 Command Injection Vulnerability
radare2 is a set of libraries and tools for working with binary files. A command injection vulnerability exists in the 'binsymbols' function in the libr/core/cbin.c file in versions of radare2 prior to 3.7.0, which arises from a networked system or product that does not correctly filter special...
CVE-2019-14745
In radare2 before 3.7.0, a command injection vulnerability exists in binsymbols in libr/core/cbin.c. By using a crafted executable file, it's possible to execute arbitrary shell commands with the permissions of the victim. This vulnerability is due to improper handling of symbol names embedded in...
CVE-2019-14745
In radare2 before 3.7.0, a command injection vulnerability exists in binsymbols in libr/core/cbin.c. By using a crafted executable file, it's possible to execute arbitrary shell commands with the permissions of the victim. This vulnerability is due to improper handling of symbol names embedded in...
DEBIAN-CVE-2019-10167
The virConnectGetDomainCapabilities libvirt API, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accepts an "emulatorbin" argument to specify the program providing emulation for a domain. Since v1.2.19, libvirt will execute that program to probe the domain's capabilities. Read-only clients...
CVE-2016-10838
cPanel before 11.54.0.4 allows arbitrary file-read operations via the bin/fmq script SEC-70...
CVE-2016-10838
cPanel before 11.54.0.4 allows arbitrary file-read operations via the bin/fmq script SEC-70...
Sql injection
cPanel before 11.54.0.4 allows SQL injection in bin/hordeupdateusernames SEC-71...
CVE-2016-10838
cPanel before 11.54.0.4 allows arbitrary file-read operations via the bin/fmq script SEC-70...
CVE-2016-10841
The bin/mkvhostspasswd script in cPanel before 11.54.0.4 discloses password hashes SEC-73...
CVE-2016-10838: Improper Access Control
cPanel before 11.54.0.4 allows arbitrary file-read operations via the bin/fmq script SEC-70...
CVE-2016-10842: Improper Input Validation
cPanel before 11.54.0.4 allows certain file-read operations in bin/setupglobalspamfilter.pl SEC-74...
PT-2019-7635
Name of the Vulnerable Software and Affected Versions cPanel versions prior to 11.54.0.4 Description The issue allows SQL injection in the bin/horde update usernames script. Recommendations For versions prior to 11.54.0.4, update to version 11.54.0.4 or later to resolve the issue...
PT-2019-13619
Name of the Vulnerable Software and Affected Versions D-Link 6600-AP and DWL-3600AP Ax version 4.2.0.14 Description An issue was discovered that allows escaping to a shell in the restricted command line interface. This can be achieved by using the sequence /bin/sh -c wget. Recommendations For...