Microsoft Windows AppX Deployment Service Hard Link Escalation of Privilege Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the AppX Deploymen...

USN-4220-1 git vulnerabilities

Joern Schneeweisz and Nicolas Joly discovered that Git contained various security flaws. An attacker could possibly use these issues to overwrite arbitrary paths, execute arbitrary code, and overwrite files in the .git directory...

Aviatrix VPN Client Privilege Handling Elevation of Privilege Vulnerability

Aviatrix VPN Client is a VPN Virtual Private Network client application that provides SAML authentication. A security vulnerability exists in Aviatrix VPN Client version 2.2.10 and earlier, which stems from the program assigning weak file permissions to the installation path. A local attacker can...

EulerOS 2.0 SP5 : gc (EulerOS-SA-2019-2526)

According to the version of the gc package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Integer overflow vulnerability in bdwgc before 2016-09-27 allows attackers to cause client of bdwgc denial of service heap buffer overflow crash and...

CVE-2019-7184

This cross-site scripting XSS vulnerability in Video Station allows remote attackers to inject and execute scripts on the administrator’s management console. To fix this vulnerability, QNAP recommend updating Video Station to their latest versions...

CVE-2018-0730

The CVE-2018-0730 entry describes a command-injection vulnerability in QNAP QTS File Station. An attacker can execute arbitrary commands on the affected device. Root cause is not elaborated beyond an input handling issue in File Station; multiple sources (NVD entry, Red Hat advisory, Tenable plug...

EulerOS 2.0 SP2 : python-crypto (EulerOS-SA-2019-2511)

According to the version of the python-crypto package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Heap-based buffer overflow in the ALGnew function in blocktemplace.c in Python Cryptography Toolkit aka pycrypto allows remote attackers to...

CVE-2019-4130

CVE-2019-4130 affects IBM Cloud Pak System 2.3 and 2.3.0.1, allowing a remote attacker to upload arbitrary files and potentially execute arbitrary code on the vulnerable server. The IBM Security Bulletin corroborates this issue and provides affected versions and recommended fixes. The remediation...

CVE-2019-14901

A heap overflow flaw was found in the Linux kernel, all versions 3.x.x and 4.x.x before 4.18.0, in Marvell WiFi chip driver. The vulnerability allows a remote attacker to cause a system crash, resulting in a denial of service, or execute arbitrary code. The highest threat with this vulnerability ...

Foxit PDF pc Client Software DLL Hijacking Vulnerability

Foxit PDF provides the same PDF rendering engine as Foxit Reader and Foxit Fengyuan PDF electronic document processing suite, using the same underlying technology as Google Chrome's embedded PDF reader, which provides a fast and clear reading experience for a wide range of users. Foxit PDF pc...

CVE-2019-15271

Cisco CVE-2019-15271 affects Small Business RV Series routers (RV016, RV042, RV042G, RV082). The issue is due to insufficient input validation of the HTTP payload in the web-based management interface, allowing an authenticated remote attacker with valid credentials or an active session token to ...

CVE-2019-15284

Consolidated details confirm CVE-2019-15284 affects Cisco Webex Network Recording Player for Windows and Cisco Webex Player for Windows. The root cause is insufficient validation of certain elements within ARF/WRF Webex recordings, enabling an attacker to execute arbitrary code on a targeted syst...

CVE-2014-6310

Buffer overflow in CHICKEN 4.9.0 and 4.9.0.1 may allow remote attackers to execute arbitrary code via the 'select' function...

ALPINE-CVE-2019-18610

An issue was discovered in manager.c in Sangoma Asterisk through 13.x, 16.x, 17.x and Certified Asterisk 13.21 through 13.21-cert4. A remote authenticated Asterisk Manager Interface AMI user without system authorization could use a specially crafted Originate AMI request to execute arbitrary syst...

CVE-2019-6186

A potential vulnerability was reported in Lenovo System Interface Foundation versions before v1.1.18.3 that could allow an authenticated user to execute code as another user...

Code injection

Code42 server through 7.0.2 for Windows has an Untrusted Search Path. In certain situations, a non-administrative attacker on the local server could create or modify a dynamic-link library DLL. The Code42 service could then load it at runtime, and potentially execute arbitrary code at an elevated...

CVE-2019-16110

The network protocol of Blade Shadow though 2.13.3 allows remote attackers to take control of a Shadow instance and execute arbitrary code by only knowing the victim's IP address, because packet data can be injected into the unencrypted UDP packet stream...

Mickey video pc client software suffers from dll hijacking vulnerability

Migu Video Client is a video software launched by China Mobile to watch various live broadcasts. Migu Video pc client software suffers from a dll hijacking vulnerability, which can be exploited by an attacker to inject a DLL file to execute arbitrary commands...

CVE-2019-3660 Advanced Threat Defense (ATD) - Improper Neutralization of HTTP requests

Improper Neutralization of HTTP requests in McAfee Advanced Threat Defense ATD prior to 4.8 allows remote authenticated attacker to execute commands on the server remotely via carefully constructed HTTP requests...

CVE-2019-5029

An exploitable command injection vulnerability exists in the Config editor of the Exhibitor Web UI versions 1.0.9 to 1.7.1. Arbitrary shell commands surrounded by backticks or $ can be inserted into the editor and will be executed by the Exhibitor process when it launches ZooKeeper. An attacker c...