156 matches found
Visual Studio Code Remote Code Execution Vulnerability
...
CVE-2020-7777 Arbitrary Code Execution
This affects all versions of package jsen. If an attacker can control the schema file, it could run arbitrary JavaScript code on the victim machine. In the module description and README file there is no mention about the risks of untrusted schema files, so I assume that this is applicable. In...
CVE-2020-9656
CVE-2020-9656 affects Adobe Premiere Rush
CVE-2020-6418
Type confusion in V8 in Google Chrome prior to 80.0.3987.122 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Recent assessments: J3rryBl4nks at March 04, 2020 4:42pm UTC reported: You would have to chain this vulnerability with a working sandbox escape in...
CredSSP Remote Code Execution Vulnerability March 2018 Security Update
The remote Windows host allows fallback to insecure versions of Credential Security Support Provider protocol CredSSP. It is therefore, affected by a remote code execution vulnerability. An attacker who successfully exploited this vulnerability could relay user credentials and use them to execute...
Remote code execution
A remote code execution vulnerability exists in Microsoft Windows that could allow remote code execution if a .LNK file is processed.An attacker who successfully exploited this vulnerability could gain the same user rights as the local user, aka 'LNK Remote Code Execution Vulnerability'...
Microsoft SharePoint Server Remote Code Execution Vulnerability
A remote code execution vulnerability exists in Microsoft SharePoint Server when it fails to properly identify and filter unsafe ASP.Net web controls. An authenticated attacker who successfully exploited the vulnerability could use a specially crafted page to perform actions in the security conte...
Design/Logic Flaw
baigoStudio baigoSSO v3.0.1 allows remote attackers to execute arbitrary PHP code via the first form field of a configuration screen, because this code is written to the BGSITENAME field in the optbase.inc.php file...
KLA11884 Multiple vulnerability in Microsoft Products (ESU)
Multiple vulnerabilities were found in Microsoft Products Extended Support Update. Malicious users can exploit these vulnerabilities to gain privileges, obtain sensitive information, execute arbitrary code. Below is a complete list of vulnerabilities: 1. An elevation of privilege vulnerability in...
CVE-2018-1840
CVE-2018-1840 affects IBM WebSphere Application Server (WAS) 8.5/9.0. The root cause is a privilege-escalation risk when a security domain uses a federated repository other than the global federated repository and the WAS version is migrated to a newer release. Affected products and versions appe...
Chrome OS /sbin/crash_reporter Symlink Traversal Vulnerability
Exploit for windows platform in category dos / poc Chrome OS: symlink traversal issue in /sbin/crashreporter Tested on: Version 69.0.3473.0 Official Build dev 64-bit CreateDirectoryWithSettings in https://chromium.googlesource.com/chromiumos/platform2/+/master/crash-reporter/crashcollector.cc107 ...
Chrome OS /sbin/crash_reporter Symlink Traversal
Chrome OS: symlink traversal issue in /sbin/crashreporter Tested on: Version 69.0.3473.0 Official Build dev 64-bit CreateDirectoryWithSettings in https://chromium.googlesource.com/chromiumos/platform2/+/master/crash-reporter/crashcollector.cc107 is executed by /sbin/crashreporter every time a...
Adobe Reader DC 2015 Security Updates (APSB18-30) - Mac OS X
Adobe Reader DC 2015 is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
Automattic: Authenticated Code Execution through Phar deserialization in CSV Importer as Shop manager in WooCommerce
This vulnerability is based on the following exploitation technique: https://blog.ripstech.com/2018/new-php-exploitation-technique/ It is easier to explain this vulnerability by having watched the PoC first: https://www.youtube.com/watch?v=mr3bAOIUwd4 Here is what's happening: 1. Since a valid ph...
CVE-2016-4398
HP Network Node Manager i (NNMi) Software versions 10.00, 10.01 (patch1), 10.01 (patch 2), and 10.10 are affected by a remote arbitrary code execution vulnerability due to Java deserialization. The CVE-2016-4398 weakness enables an attacker to potentially run arbitrary code on a vulnerable host v...
CVE-2018-1000525
OpenPSA is affected by a PHP Object Injection vulnerability in form data passed as GET variables, allowing a crafted GET request to serialize a PHP object and potentially disclose information or achieve remote code execution. The issue arises from unsafe deserialization, enabling arbitrary code e...
Security Bulletin: Multiple Mozilla Firefox vulnerability issues in IBM Storwize V7000 Unified
Summary There are security vulnerabilities in versions of Mozilla Firefox that are shipped with versions 1.5.1.0 to 1.5.2.5 of IBM Storwize V7000 Unified Vulnerability Details IBM Storwize V7000 Unified is shipped with Mozilla Firefox. There are vulnerabilities in certain versions of Mozilla...
Drupal Remote Code Execution Vulnerability (SA-CORE-2018-002) (exploit)
Binary data drupalCVE-2018-7600rce.nbin...
CVE-2018-4088
The CVE-2018-4088 entry maps to memory-corruption flaws in WebKit that could allow remote code execution via crafted web content in Apple platforms. Affected products include iOS before 11.2.5, macOS before 10.13.3, Safari before 11.0.3, iCloud/iTunes on Windows, tvOS before 11.2.5, and watchOS b...