6330 matches found
GHSA-JXX8-V83V-RHW3 Spree Improper Input Validation vulnerability
Spree Commerce 1.0.x before 2.0.0.rc1 allows remote authenticated administrators to instantiate arbitrary Ruby objects and execute arbitrary commands via the 1 paymentmethod parameter to core/app/controllers/spree/admin/paymentmethodscontroller.rb; and the 2 promotionaction parameter to...
GHSA-FHJ9-CJJH-27VM Active Record contains deserialization of arbitrary YAML
ActiveRecord in Ruby on Rails before 2.3.17 and 3.x before 3.1.0 allows remote attackers to cause a denial of service or execute arbitrary code via crafted serialized attributes that cause the +serialize+ helper to deserialize arbitrary YAML...
Active Record contains deserialization of arbitrary YAML
ActiveRecord in Ruby on Rails before 2.3.17 and 3.x before 3.1.0 allows remote attackers to cause a denial of service or execute arbitrary code via crafted serialized attributes that cause the +serialize+ helper to deserialize arbitrary YAML...
GHSA-HGMW-X865-HF9X Arabic Prawn allows remote attackers to execute arbitrary commands via shell metacharacters
lib/stringutfsupport.rb in the Arabic Prawn 0.0.1 gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in the 1 downloadedfile or 2 url variable...
Arabic Prawn allows remote attackers to execute arbitrary commands via shell metacharacters
lib/stringutfsupport.rb in the Arabic Prawn 0.0.1 gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in the 1 downloadedfile or 2 url variable...
Stack overflow
Multiple stack-based buffer overflows in TP-Link WR940N WiFi routers with hardware version 4 allow remote authenticated users to execute arbitrary code via the 1 pingaddr parameter to PingIframeRpm.htm or 2 dnsserver2 parameter to WanStaticIpV6CfgRpm.htm...
CVE-2016-5714
Puppet Enterprise 2015.3.3 and 2016.x before 2016.4.0, and Puppet Agent 1.3.6 through 1.7.0 allow remote attackers to bypass a host whitelist protection mechanism and execute arbitrary code on Puppet nodes via vectors related to command validation, aka "Puppet Execution Protocol PXP Command...
CVE-2015-7806
Eval injection vulnerability in the fmsaveHelperGatherItems function in ajax.php in the Form Manager plugin before 1.7.3 for WordPress allows remote attackers to execute arbitrary code via unspecified vectors...
Heap overflow
Heap-based buffer overflow in the pcnetreceive function in hw/net/pcnet.c in QEMU allows guest OS administrators to cause a denial of service instance crash or possibly execute arbitrary code via a series of packets in loopback mode...
CVE-2015-7504
Heap-based buffer overflow in the pcnetreceive function in hw/net/pcnet.c in QEMU allows guest OS administrators to cause a denial of service instance crash or possibly execute arbitrary code via a series of packets in loopback mode...
CVE-2015-7687
Use-after-free vulnerability in OpenSMTPD before 5.7.2 allows remote attackers to cause a denial of service crash or execute arbitrary code via vectors involving reqcavrfysmtp and reqcavrfymta...
CVE-2015-7687
Use-after-free vulnerability in OpenSMTPD before 5.7.2 allows remote attackers to cause a denial of service crash or execute arbitrary code via vectors involving reqcavrfysmtp and reqcavrfymta...
CVE-2015-7687
Use-after-free vulnerability in OpenSMTPD before 5.7.2 allows remote attackers to cause a denial of service crash or execute arbitrary code via vectors involving reqcavrfysmtp and reqcavrfymta...
Apache Solr/Lucene Remote Code Execution Vulnerability
Apache Solr is an open source search server . Solr using the Java language development , mainly based on HTTP and Apache Lucene implementation. Lucene is apache Software Foundation 4 jakarta project group a subproject , is an open source full-text search engine toolkit . Apache Solr/Lucene has a...
CVE-2017-12178
xorg-x11-server before 1.19.5 had wrong extra length check in ProcXIChangeHierarchy function allowing malicious X client to cause X server to crash or possibly execute arbitrary code...
Heap overflow
HPE LoadRunner before 12.53 Patch 4 and HPE Performance Center before 12.53 Patch 4 allow remote attackers to execute arbitrary code via unspecified vectors. At least in LoadRunner, this is a libxdrutil.dll mxdrstring heap-based buffer overflow...
KLA11064 Multiple vulnerabilities in IrfanView
Multiple serious vulnerabilities have been found in IrfanView 4.44. Malicious users can exploit these vulnerabilities to cause a denial of service or execute arbitrary code. Below is a complete list of vulnerabilities: 1. An integer overflow vulnerability in the JPEG 2000 parser can be exploited...
PCRE2: Multiple vulnerabilities
Background PCRE2 is a project based on PCRE Perl Compatible Regular Expressions which has a new and revised API. Description Multiple vulnerabilities have been discovered in PCRE2. Please review the referenced CVE identifiers for details. Impact A remote attacker could possibly execute arbitrary...