PT-2020-15327 · Jenkins · Jenkins Fitnesse Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins FitNesse Plugin versions 1.30 and earlier Description: The issue allows a user who can control the input files for the post-build step to have Jenkins parse a crafted file that uses external entities for extraction of secrets from the...

Command Injection

Overview lsof is a lsof processor for node. Affected versions of this package are vulnerable to Command Injection. Multiple areas of the package is vulnerable to command injection. Every exported method used by the packages uses the exec function to parse user input. PoC by JHU System Security La...

CVE-2011-4558

Tiki 8.2 and earlier allows remote administrators to execute arbitrary PHP code via crafted input to the regexres and regex parameters...

Input validation

Tiki 8.2 and earlier allows remote administrators to execute arbitrary PHP code via crafted input to the regexres and regex parameters...

CVE-2011-4558

Tiki 8.2 and earlier allows remote administrators to execute arbitrary PHP code via crafted input to the regexres and regex parameters...

CVE-2019-12619

A vulnerability in the web interface for Cisco SD-WAN Solution vManage could allow an authenticated, remote attacker to impact the integrity of an affected system by executing arbitrary SQL queries. The vulnerability is due to insufficient validation of user-supplied input. An attacker could...

Sql injection

A vulnerability in the web interface for Cisco SD-WAN Solution vManage could allow an authenticated, remote attacker to impact the integrity of an affected system by executing arbitrary SQL queries. The vulnerability is due to insufficient validation of user-supplied input. An attacker could...

CVE-2019-12619 Cisco SD-WAN Solution SQL Injection Vulnerability

A vulnerability in the web interface for Cisco SD-WAN Solution vManage could allow an authenticated, remote attacker to impact the integrity of an affected system by executing arbitrary SQL queries. The vulnerability is due to insufficient validation of user-supplied input. An attacker could...

UBUNTU-CVE-2020-7058

DISPUTED datainput.php in Cacti 1.2.8 allows remote code execution via a crafted Input String to Data Collection - Data Input Methods - Unix - Ping Host. NOTE: the vendor has stated "This is a false alarm."...

Design/Logic Flaw

datainput.php in Cacti 1.2.8 allows remote code execution via a crafted Input String to Data Collection - Data Input Methods - Unix - Ping Host. NOTE: the vendor has stated "This is a false alarm...

CVE-2020-7058

CVE-2020-7058 affects Cacti 1.2.8; data_input.php can lead to remote code execution via a crafted Input String to Data Collection → Data Input Methods → Unix → Ping Host. Multiple connected sources note the vendor’s statement that this is a false alarm, with no public exploit details or patch inf...

CVE-2020-7058

datainput.php in Cacti 1.2.8 allows remote code execution via a crafted Input String to Data Collection - Data Input Methods - Unix - Ping Host. NOTE: the vendor has stated "This is a false alarm...

PT-2020-19364 · Cacti +1 · Cacti +1

Name of the Vulnerable Software and Affected Versions: Cacti version 1.2.8 Description: The issue concerns remote code execution via a crafted Input String to Data Collection - Data Input Methods - Unix - Ping Host in the data input.php file. However, the vendor has stated that this is a false...

The vulnerability of the Apache Thrift interface description language lies in the possibility of entering an infinite loop when processing certain input data. This allows attackers to cause service failures.

The vulnerability of the Apache Thrift interface description language is related to entering an infinite loop when certain input data is provided. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

UBUNTU-CVE-2019-13445

An issue was discovered in the ROS communications-related packages aka roscomm or ros-melodic-ros-comm through 1.14.3. parseOptions in tools/rosbag/src/record.cpp has an integer overflow when a crafted split option can be entered on the command line...

CVE-2019-20012

An issue was discovered in GNU LibreDWG 0.92. Crafted input will lead to an attempted excessive memory allocation in dwgdecodeHATCHprivate in dwg.spec...

GNU LibreDWG Excessive Memory Allocation Vulnerability

GNU LibreDWG is a GNU Project C library for working with DWG files. A security vulnerability exists in the 'dwgdecodeLWPOLYLINEprivate' function of dwg.spec in GNU LibreDWG version 0.92. An attacker can exploit this vulnerability to cause a denial of service large memory consumption with the help...

EulerOS 2.0 SP5 : exiv2 (EulerOS-SA-2019-2710)

According to the versions of the exiv2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Exiv2::Internal::PngChunk::parseTXTChunk in Exiv2 v0.26 allows remote attackers to cause a denial of service heap-based buffer over-read via a...

The vulnerability of the implementation of the polymorphic data typing mechanism in the jackson-databind library allows a attacker to execute malicious loads.

The vulnerability of the Jackson-Databind library’s polymorphic data typing mechanism is related to deficiencies in input data processing. Exploiting this vulnerability could allow a malicious actor to execute malicious operations by processing classes such as...

EulerOS 2.0 SP3 : shadow-utils (EulerOS-SA-2019-2662)

According to the version of the shadow-utils package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Integer overflow in shadow 4.2.1 allows local users to gain privileges via crafted input to newuidmap.CVE-2016-6252 Note that Tenable Network...