CVE-2020-3177 Cisco Unified Communications Manager Path Traversal Vulnerability

A vulnerability in the Tool for Auto-Registered Phones Support TAPS of Cisco Unified Communications Manager UCM and Cisco Unified Communications Manager Session Management Edition SME could allow an unauthenticated, remote attacker to conduct directory traversal attacks on an affected device. The...

Code injection

IBM QRadar 7.3.0 to 7.3.3 Patch 2 could allow a remote attacker to include arbitrary files. A remote attacker could send a specially-crafted request specify a malicious file from a remote system, which could allow the attacker to execute arbitrary code on the vulnerable server. IBM X-ForceID:...

Information disclosure

Dell EMC Networking X-Series firmware versions 3.0.1.2 and older, Dell EMC Networking PC5500 firmware versions 4.1.0.22 and older and Dell EMC PowerEdge VRTX Switch Modules firmware versions 2.0.0.77 and older contain an information disclosure vulnerability. A remote unauthenticated attacker coul...

Denial Of Service (DoS)

krb5 is vulnerable to denial of service DoS. The vulnerability exists through the way MIT Kerberos KDC processed certain principal names when the KDC was configured to use an LDAP back end. A remote attacker could use this flaw to cause the KDC to hang via a specially-crafted request...

Denial Of Service (DoS)

Python is vulnerable to denial of serviceDoS. Due to a flaw found in the way the Python CGIHTTPServer module processed certain HTTP GET requests, a remote attacker could use a specially-crafted request to obtain the CGI script's source code...

Directory Traversal

MySQL is vulnerable to directory traversal. Due to the way MySQL handled the parameters of the MySQL COMFIELDLIST network protocol command, an authenticated database user could use this flaw to obtain descriptions of the fields of an arbitrary table using a request with a specially-crafted table...

Denial Of Service (DoS)

The kernel is vulnerable to Denial Of Service DoS. An array index error was found in the gdth driver. A local user could send a specially-crafted IOCTL request that would cause a denial of service or, possibly, privilege escalation...

Denial Of Service (DoS)

httpd is vulnerable to denial of service. A flaw was found in the Apache HTTP Server modproxy module. On sites where a reverse proxy is configured, a remote attacker could send a carefully crafted request that would cause the Apache child process handling that request to crash. On sites where a...

Argo Authorization Issues Vulnerability

Argo is an open source container native workflow engine. Argo suffers from an authorization issue vulnerability that stems from the program setting the default administrator password to the argocd-server container group name. An attacker can exploit this vulnerability to gain administrator...

Samsung Mobile Device Input Validation Error Vulnerability (CNVD-2020-30780)

Android is a Linux-based open source operating system jointly developed by Google Inc. and the Open Handheld Alliance OHA for short. Samsung mobile devices suffer from an input validation error vulnerability that can be exploited by an attacker to execute arbitrary code on the system with the hel...

Samsung Mobile Device Digital Error Vulnerability

Android is a Linux-based open source operating system jointly developed by Google Inc. and the Open Handheld Alliance OHA for short. Samsung mobile devices suffer from a numeric error vulnerability that can be exploited by an attacker to execute arbitrary code on the system with the help of a...

Samsung Competitive Conditions for Mobile Devices Issue Vulnerability

Android is a Linux-based open source operating system jointly developed by Google Inc. and the Open Handheld Alliance OHA for short. Samsung mobile devices are vulnerable to a competitive conditions issue, which can be exploited by attackers with the help of a specially crafted request to execute...

Samsung Mobile Device Buffer Overflow Vulnerability (CNVD-2020-40817)

Android is a Linux-based open source operating system jointly developed by Google Inc. and the Open Handheld Alliance OHA for short. Samsung mobile devices have a security vulnerability that can be exploited by an attacker to execute arbitrary code on the system with the help of a specially craft...

Samsung Mobile Device Buffer Overflow Vulnerability (CNVD-2020-33715)

Android is a Linux-based open source operating system jointly developed by Google Inc. and the Open Handheld Alliance OHA for short. Samsung mobile devices suffer from a buffer overflow vulnerability that can be exploited by an attacker with the help of a specially crafted request to cause a deni...

Samsung Mobile Device Buffer Overflow Vulnerability (CNVD-2020-32809)

Android is a Linux-based open source operating system jointly developed by Google Inc. and the Open Handheld Alliance OHA for short. Samsung mobile devices suffer from a buffer overflow vulnerability that can be exploited by an attacker to execute arbitrary code on the system with the help of a...

Samsung Competitive Conditions for Mobile Devices Vulnerability (CNVD-2020-32821)

Android is a Linux-based open source operating system jointly developed by Google Inc. and the Open Handheld Alliance OHA for short. Samsung mobile devices suffer from a competitive conditions issue vulnerability that can be exploited by attackers to execute arbitrary code on the system with the...

Samsung Mobile Device Buffer Overflow Vulnerability (CNVD-2020-32804)

Android is a Linux-based open source operating system jointly developed by Google Inc. and the Open Handheld Alliance OHA for short. The Samsung mobile device buffer overflow vulnerability can be exploited by an attacker to execute arbitrary code on the system with the help of a specially crafted...

Apache Solr 8.3.0 Velocity Template Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core/exploit/powershell' class MetasploitModule 'Apache Solr Remote Code Execution via Velocity Template', 'Description' = %q This module exploits a...

Contact Form 7 Datepicker <= 2.6.0 - Authenticated Stored Cross-Site Scripting (XSS)

Contact Form 7 Datepicker registers an AJAX action to save settings which calls a function that fails to perform a capability check or nonce check. As such, a logged-in attacker with minimal permissions such as a subscriber can send a crafted request which will store a malicious JavaScript in the...

IBM Spectrum Protect Plus Command Execution Vulnerability (CNVD-2020-20698)

IBM Spectrum Protect Plus is a suite of data protection platforms from IBM USA. The platform provides organizations with a single point of control and management and supports backup and recovery for virtual, physical and cloud environments of all sizes. A security vulnerability exists in IBM...