Code injection

Ubuntu's packaging of libvirt in 20.04 LTS created a control socket with world read and write permissions. An attacker could use this to overwrite arbitrary files or execute arbitrary code...

CVE-2020-15708

Ubuntu's packaging of libvirt in 20.04 LTS created a control socket with world read and write permissions. An attacker could use this to overwrite arbitrary files or execute arbitrary code...

CVE-2020-24433

Adobe Acrobat Reader DC versions 2020.012.20048 and earlier, 2020.001.30005 and earlier and 2017.011.30175 and earlier are affected by a local privilege escalation vulnerability that could enable a user without administrator privileges to delete arbitrary files and potentially execute arbitrary...

CVE-2020-24433

Adobe Acrobat Reader DC versions 2020.012.20048 and earlier, 2020.001.30005 and earlier and 2017.011.30175 and earlier are affected by a local privilege escalation vulnerability that could enable a user without administrator privileges to delete arbitrary files and potentially execute arbitrary...

[R1] Nessus Network Monitor 5.12.1 Fixes One Vulnerability

A vulnerability in Nessus Network Monitor versions 5.11.0, 5.11.1, and 5.12.0 for Windows could allow an authenticated local attacker to execute arbitrary code by copying user-supplied files to a specially constructed path in a specifically named user directory. The attacker needs valid credentia...

mysql-connector-java: allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors which could result in unauthorized update, insert or delete

A flaw was found in the mysql-connector-java package. A complicated attack against the mysql Connector/J allows attackers on the local network to interfere with a user's connection and insert unauthorized SQL commands...

CVE-2020-27689

The Relish Verve Connect VH510 device with firmware before 1.0.1.6L0516 contains undocumented default admin credentials for the web management interface. A remote attacker could exploit this vulnerability to login and execute commands on the device, as well as upgrade the firmware image to a...

webkitgtk: use-after-free via crafted web content

A use-after-free flaw exists in WebKitGTK. This flaw allows remote attackers to execute arbitrary code or cause a denial of service...

EulerOS 2.0 SP2 : perl-XML-LibXML (EulerOS-SA-2020-2383)

According to the version of the perl-XML-LibXML package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Use-after-free in the XML-LibXML module through 2.0129 for Perl allows remote attackers to execute arbitrary code by controlling the...

CVE-2018-19950

If exploited, this command injection vulnerability could allow remote attackers to execute arbitrary commands. This issue affects: QNAP Systems Inc. Music Station versions prior to 5.1.13; versions prior to 5.2.9; versions prior to 5.3.11...

CVE-2020-14425: Undefined Security Weakness

Foxit Reader before 10.0 allows Remote Command Execution via the app.opencPDFWebPage JavsScript API. An attacker can execute local files and bypass the security dialog...

Memory corruption

IBM i2 Analyst Notebook 9.2.0 and 9.2.1 could allow a local attacker to execute arbitrary code on the system, caused by a memory corruption. By persuading a victim to open a specially-crafted file, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force I...

CVE-2020-4723

IBM i2 Analyst Notebook 9.2.0 and 9.2.1 could allow a local attacker to execute arbitrary code on the system, caused by a memory corruption. By persuading a victim to open a specially-crafted file, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force I...

CVE-2020-27654

Improper access control vulnerability in lbd in Synology Router Manager SRM before 1.2.4-8081 allows remote attackers to execute arbitrary commands via port 1 7786/tcp or 2 7787/tcp...

CVE-2020-27853

CVE-2020-27853 is a format-string vulnerability in Wire’s peerflow/sdp.c (sdp_media_set_lattr). It affects Wire AVS 5.3–6.x before 6.4 and Wire Secure Messenger apps on Android/iOS (before the listed versions). Remote attackers could cause a denial of service (crash) or execute arbitrary code; im...

Systeminformation Command Injection Vulnerability

systeminformation is an Npm repository of operating system information for individual developers. A command injection vulnerability exists in systeminformation versions prior to 4.27.11, which allows an attacker to concatenate curl arguments to overwrite a Javascript file and then execute all OS...

Medium: bash

Issue Overview: rbash in Bash before 4.4-beta2 did not prevent the shell user from modifying BASHCMDS, thus allowing the user to execute any command with the permissions of the shell. CVE-2019-9924 Affected Packages: bash Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository...

CVE-2020-7752

This affects the package systeminformation before 4.27.11. This package is vulnerable to Command Injection. The attacker can concatenate curl's parameters to overwrite Javascript files and then execute any OS commands...

Mozilla Firefox Memory Corruption Vulnerability (CNVD-2020-60333)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A memory corruption vulnerability exists in Mozilla Firefox's handling of WEB page content, which allows remote attackers to exploit the vulnerability by submitting a special WEB request that the user ...

PT-2020-19768

Name of the Vulnerable Software and Affected Versions systeminformation versions prior to 4.27.11 Description This issue affects the systeminformation package, allowing an attacker to perform Command Injection. The attacker can concatenate curl's parameters to overwrite Javascript files and then...