CVE-2018-1203

In Dell EMC Isilon OneFS, the compadmin is able to run tcpdump binary with root privileges. In versions between 8.1.0.0 - 8.1.0.1, 8.0.1.0 - 8.0.1.2, and 8.0.0.0 - 8.0.0.6, the tcpdump binary, being run with sudo, may potentially be used by compadmin to execute arbitrary code with root privileges...

Input validation

Philips Intellispace Portal all versions 7.0.x and 8.0.x have an input validation vulnerability that could allow a remote attacker to execute arbitrary code or cause the application to crash...

CVE-2018-5474

Philips Intellispace Portal all versions 7.0.x and 8.0.x have an input validation vulnerability that could allow a remote attacker to execute arbitrary code or cause the application to crash...

PHPSHE 'userbank' Parameter SQL Injection Vulnerability

PHPSHE is an online shopping mall system. The system supports express tracking, online chat, order evaluation and statistics. A SQL injection vulnerability exists in the 'userbank' parameter in PHPSHE version 1.6. A remote attacker can exploit this vulnerability to execute SQL commands...

Buffer overflow

Buffer overflow in Tiny FTP Daemon Ver0.52d allows an attacker to cause a denial-of-service DoS condition or execute arbitrary code via unspecified vectors...

CVE-2018-0541

Buffer overflow in Tiny FTP Daemon Ver0.52d allows an attacker to cause a denial-of-service DoS condition or execute arbitrary code via unspecified vectors...

Webmin 0.92 Multiple Vulnerabilities

According to its self-reported version, the Webmin install hosted on the remote host is 0.92 It is, therefore, affected by multiple vulnerabilities which could allow local users to execute script. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid108538;...

Mozilla Thunderbird Security Advisories (MFSA2018-04, MFSA2018-04) - Mac OS X

Mozilla Thunderbird is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:thunderbird";...

Debian DSA-4147-1 : polarssl - security update

Several vulnerabilities were discovered in PolarSSL, a lightweight crypto and SSL/TLS library, that allowed a remote attacker to either cause a denial-of-service by application crash, or execute arbitrary code. C Tenable Network Security, Inc. The descriptive text and package checks in this plugi...

PT-2018-4032

Name of the Vulnerable Software and Affected Versions OpenBuildService versions prior to 2.3.0 Description A code injection issue in the web UI of the OpenBuildService allows authorized attackers to execute shellcode by manipulating the project rebuild times statistics. Recommendations For versio...

Debian: Security Advisory (DSA-4147-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Internet Explorer Heap Buffer Overflow DoS

The vulnerability of the Internet Explorer browser arises from an operation that goes beyond the buffer boundaries in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code and cause a service failure by using a specially crafted web page...

CVE-2018-6229

A SQL injection vulnerability in an Trend Micro Email Encryption Gateway 5.5 edit policy script could allow an attacker to execute SQL commands to upload and execute arbitrary code that may harm the target system...

CVE-2018-6222

Arbitrary logs location in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to change location of log files and be manipulated to execute arbitrary commands and attain command execution on a vulnerable system...

UBUNTU-CVE-2018-5135

WebExtensions can bypass normal restrictions in some circumstances and use "browser.tabs.executeScript" to inject scripts into contexts where this should not be allowed, such as pages from other WebExtensions or unprivileged "about:" pages. This vulnerability affects Firefox 59...

CVE-2017-16251

A vulnerability in the conferencing component of Mitel ST 14.2, release GA28 and earlier, could allow an authenticated user to upload a malicious script to the Personal Library by a crafted POST request. Successful exploit could allow an attacker to execute arbitrary code within the context of th...

Cross site scripting

In BlackBerry UEM Management Console version 12.7.1 and earlier, a reflected cross-site scripting vulnerability that could allow an attacker to execute script commands in the context of the affected UEM Management Console account by crafting a malicious link and then persuading a user with...

CVE-2018-1000087

WolfCMS version version 0.8.3.1 contains a Reflected Cross Site Scripting vulnerability in "Create New File" and "Create New Directory" input box from 'files' Tab that can result in Session Hijacking, Spread Worms,Control the browser remotely. . This attack appear to be exploitable via Attacker c...

CMS Made Simple Remote Code Execution Vulnerability (CNVD-2018-06398)

CMS Made Simple CMSMS is an open source content management system CMS developed by the CMSMS team. The system supports role-based rights management system , wizard-based installation and update mechanism , intelligent caching mechanism , etc. File Manager is one of the file management component ....

CVE-2016-9606

JBoss RESTEasy before version 3.1.2 could be forced into parsing a request with YamlProvider, resulting in unmarshalling of potentially untrusted data which could allow an attacker to execute arbitrary code with RESTEasy application permissions...