16660 matches found
CVE-2017-12576
An issue was discovered on the PLANEX CS-QR20 1.30. A hidden and undocumented management page allows an attacker to execute arbitrary code on the device when the user is authenticated. The management page was used for debugging purposes, once you login and access the page directly...
Nokogiri does not forbid namespace nodes in XPointer ranges
xpointer.c in libxml2 before 2.9.5 as used in nokogiri before 1.7.1 amongst other products does not forbid namespace nodes in XPointer ranges, which allows remote attackers to execute arbitrary code or cause a denial of service use-after-free and memory corruption via a crafted XML document...
High severity vulnerability that affects espeak-ruby
Withdrawn, accidental duplicate publish. The espeak-ruby gem before 1.0.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a string to the speak, save, bytes or byteswav method in lib/espeak/speech.rb...
Zortam MP3 Media Studio 23.95 - Denial of Service (PoC)
Exploit Title: Zortam MP3 Media Studio 23.95 - Denial of Service PoC Author: Gionathan "John" Reale Discovey Date: 2018-08-19 Homepage: https://www.zortam.com Software Link: https://www.zortam.com/download.html Tested Version: 23.95 Tested on OS: Windows 7 x64 Steps to Reproduce: Run the python...
Autostart Desktop Item Persistence
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Autostart Desktop Item Persistence', 'Description' = %q This module will create an autostart entry to execute a payload. The payload will be...
CVE-2018-3784
A code injection in cryo 0.0.6 allows an attacker to arbitrarily execute code due to insecure implementation of deserialization...
CVE-2018-1455
IBM Tivoli Application Dependency Discovery Manager 7.2.2 and 7.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 11029...
Out-of-bounds
VMware Workstation 14.x before 14.1.3 and Fusion 10.x before 10.1.3 contain an out-of-bounds write vulnerability in the e1000 device. This issue may allow a guest to execute code on the host...
Intel Smart Sound Technology Driver Module Elevation of Privilege Vulnerability (CNVD-2018-15605)
Intel Smart Sound Technology is an integrated audio DSP Digital Signal Processor from Intel USA, which is mainly used to process audio, support voice interaction and so on. An elevation of privilege vulnerability exists in the driver module in versions prior to Intel Smart Sound Technology...
Microsoft Edge CVE-2018-8377 Remote Memory Corruption Vulnerability
Description Microsoft Edge is prone to a remote memory-corruption vulnerability. Attackers can exploit this issue to execute arbitrary code in the context of the currently logged-in user. Failed attacks will cause denial of service conditions. Technologies Affected Microsoft Edge Recommendations...
USN-3737-1: GDM vulnerability
A use-after-free was discovered in GDM. A local user could exploit this to cause a denial of service, or potentially execute arbitrary code as the administrator...
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
active-support ruby gem could allow a remote attacker to execute arbitrary code on the system, caused by containing a malicious backdoor. An attacker could exploit this vulnerability to execute arbitrary code on the system...
VMSA-2018-0022:VMware Workstation and Fusion updates address an out-of-bounds write issue
VMSA-2018-0022 VMware Workstation and Fusion updates address an out-of-bounds write issue VMware Security Advisory VMware Security Advisory Advisory ID: VMSA-2018-0022 VMware Security Advisory Severity: Critical VMware Security Advisory Synopsis: VMware Workstation and Fusion updates address an...
VMWare Horizon Client wswc_sharedMem_shared Out-Of-Bounds Read Information Disclosure Vulnerability
This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of VMware Horizon Client. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within...
CVE-2018-0429
Stack-based buffer overflow in the Cisco Thor decoder before commit 18de8f9f0762c3a542b1122589edb8af859d9813 allows local users to cause a denial of service segmentation fault and execute arbitrary code via a crafted non-conformant Thor bitstream...
CVE-2018-15193
A CSRF vulnerability in the admin panel in Gogs through 0.11.53 allows remote attackers to execute admin operations via a crafted issue / link...
statics-server cross-site scripting vulnerability
statics-server is a static file server. A cross-site scripting vulnerability exists in statics-server 0.0.9 and earlier versions. A remote attacker can exploit this vulnerability by injecting an iframe into a file name to execute arbitrary JavaScript code...
Security update for python-dulwich (moderate)
This update for python-dulwich to version 0.18.5 fixes this security issue: - CVE-2017-16228: Dulwich, when an SSH subprocess is used, allowed remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname bsc1066430. For detailed changes please see...
Insteon Hub Buffer Overflow Vulnerability
The Insteon Hub is an Insteon central controller product from Insteon USA. This product can remotely control light bulbs, wall switches, air conditioners and more in your home. A buffer overflow vulnerability exists in the Insteon Hub using firmware version 1012. An attacker could exploit the...