CVE-2018-17228

nmap4j 1.1.0 allows attackers to execute arbitrary commands via shell metacharacters in an includeHosts call...

CVE-2017-12576

An issue was discovered on the PLANEX CS-QR20 1.30. A hidden and undocumented management page allows an attacker to execute arbitrary code on the device when the user is authenticated. The management page was used for debugging purposes, once you login and access the page directly...

Cisco NX-OS Software NX-API Privilege Escalation Vulnerability

A vulnerability in the NX-API management application programming interface API in devices running, or based on, Cisco NX-OS Software could allow an authenticated, remote attacker to execute commands with elevated privileges. The vulnerability is due to a failure to properly validate certain...

Security Bulletin: A vulnerability in git affects PowerKVM (CVE-2015-7545)

Summary PowerKVM is affected by a vulnerability in git. This vulnerability is now fixed. Vulnerability Details CVEID: CVE-2015-7545 DESCRIPTION: GIT could allow a remote attacker to execute arbitrary commands on the system, caused by the failure to properly handle recursive clones of git...

Security Bulletin: IBM Maximo Asset Management could allow a remote authenticated attacker to execute arbitrary commands on the system as administrator (CVE-2016-9984)

Summary IBM Maximo Asset Management could allow a remote authenticated attacker to execute arbitrary commands on the system as administrator. Vulnerability Details CVEID: CVE-2016-9984 DESCRIPTION: IBM Maximo Asset Management could allow a remote authenticated attacker to execute arbitrary comman...

CVE-2018-1460

IBM Netezza Platform Software IBM PureData System for Analytics 1.0.0 could allow a local user to modify a world writable file, which could be used to execute commands as root. IBM X-Force ID: 140211...

CVE-2018-1460

CVE-2018-1460 affects IBM Netezza Platform Software (IBM PureData System for Analytics) versions 7.0.4 through 7.2.1.6. A local attacker can modify a world-writable file to execute commands with root privileges, enabling local privilege escalation. IBM’s security bulletin confirms the vulnerabili...

patch security update

2.7.1-10 - Fixed Coverity reported issues 2.7.1-9 - Fixed CVE-2018-1000156 - Malicious patch files cause ed to execute arbitrary commands...

Design/Logic Flaw

IBM Security SiteProtector System 3.0, 3.1.0 and 3.1.1 allows remote attackers to bypass intended security restrictions and consequently execute unspecified commands and obtain sensitive information via unknown vectors. IBM X-Force ID: 100927...

CVE-2018-0194

Multiple vulnerabilities in the CLI parser of Cisco IOS XE Software could allow an authenticated, local attacker to inject arbitrary commands into the CLI of the affected software, which could allow the attacker to gain access to the underlying Linux shell of an affected device and execute comman...

PHPSHE 'userbank' Parameter SQL Injection Vulnerability

PHPSHE is an online shopping mall system. The system supports express tracking, online chat, order evaluation and statistics. A SQL injection vulnerability exists in the 'userbank' parameter in PHPSHE version 1.6. A remote attacker can exploit this vulnerability to execute SQL commands...

CVE-2018-6222

Arbitrary logs location in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to change location of log files and be manipulated to execute arbitrary commands and attain command execution on a vulnerable system...

CVE-2018-6530

OS command injection vulnerability in soap.cgi soapcgimain in cgibin in D-Link DIR-880L DIR-880LREVAFIRMWAREPATCH1.08B04 and previous versions, DIR-868L DIR868LA1FW112b04 and previous versions, DIR-65L DIR-865LREVAFIRMWAREPATCH1.08.B01 and previous versions, and DIR-860L DIR860LA1FW110b04 and...

The vulnerability of the Core component of the Oracle VM VirtualBox allows a malicious attacker from the guest operating system to execute certain commands or copy data from the host operating system.

The vulnerability of the Core hypervisor component in Oracle VM VirtualBox is related to access control deficiencies. Exploiting this vulnerability allows a malicious individual operating locally on the guest operating system to execute certain commands or copy data from the guest operating syste...

Horde Groupware SQL Injection Vulnerability

Horde Groupware is an enterprise browser based on the Communication Suite from Horde USA. The browser supports sending and receiving e-mail, managing and sharing calendars, contacts and tasks, and more. A SQL injection vulnerability exists in Horde Groupware 5.2.22 and earlier versions. A remote...

Escape Sequence Injection

Fluentd is vulnerable to escape sequence injection attacks. User input is pushed directly to the logs without filtering, allowing an attacker to change the terminal UI or execute commands on the device parsing the logs...

Cisco Application Policy Infrastructure Controller Command Injection Vulnerability

The Cisco Application Policy Infrastructure Controller APIC is a controller for automating the management of application-centric infrastructures ACI from Cisco. A command injection vulnerability exists in the system script file in Cisco APIC that stems from the program failing to adequately...

CVE-2017-12336

A vulnerability in the TCL scripting subsystem of Cisco NX-OS System Software could allow an authenticated, local attacker to escape the interactive TCL shell and gain unauthorized access to the underlying operating system of the device. The vulnerability exists due to insufficient input validati...

MacOS 10.13 root Authentication Bypass (Security Update 2017-001)

The remote host is running a version of MacOS 10.13 or 10.13.1 that is missing a security update. It is, therefore, affected by a root authentication bypass vulnerability. A local attacker or a remote attacker with credentials for a standard user account has the ability to blank out the root...

CVE-2017-8198

FusionSphere V100R006C00SPC102NFV has an SQL injection vulnerability. An authenticated, remote attacker could craft interface messages carrying malicious SQL statements and send them to a target device. Successful exploit could allow the attacker to launch an SQL injection attack and execute SQL...