Buffer Overflow Vulnerability in Various Esri Products (CNVD-2021-39523)

ESRI ArcGIS Enterprise and others are products of Environmental Systems Research Institute ESRI, Inc.ArcGIS Enterprise is a GIS Geographic Information System base software system.Esri Arcgis Server is a Web-oriented enterprise software platform that can be used to provide geolocation services. Es...

Medium: git

Issue Overview: Git is an open-source distributed revision control system. In affected versions of Git a specially crafted repository that contains symbolic links as well as files using a clean/smudge filter such as Git LFS, may cause just-checked out script to be executed while cloning onto a...

USN-4888-2: ldb vulnerabilities

USN-4888-1 fixed several vulnerabilities in ldb. This update provides the corresponding update for Ubuntu 14.04 ESM. Original advisory details: Douglas Bagnall discovered that ldb, when used with Samba, incorrectly handled certain LDAP attributes. A remote attacker could possibly use this issue t...

Cisco IOS XE Local Elevation of Privilege Vulnerability

Cisco IOS XE is a set of modular operating system based on Linux kernel developed by Cisco for its network equipment. A local elevation of privilege vulnerability exists in one of the diagnostic test CLI commands for Cisco IOS XE. The vulnerability stems from the fact that the affected software...

CVE-2021-1375

Multiple vulnerabilities in the fast reload feature of Cisco IOS XE Software running on Cisco Catalyst 3850, Cisco Catalyst 9300, and Cisco Catalyst 9300L Series Switches could allow an authenticated, local attacker to either execute arbitrary code on the underlying operating system, install and...

CVE-2021-21350

A flaw was found in xstream. A remote attacker may be able to execute arbitrary code only by manipulating the processed input stream. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...

EPrints Arbitrary File Read (CVE-2021-3342)

An Arbitrary File Read vulnerability exists in EPrints. Successful exploitation of this vulnerability would allow remote attackers to execute arbitrary web script into the effected system...

EulerOS 2.0 SP5 : spamassassin (EulerOS-SA-2021-1706)

According to the version of the spamassassin package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - In Apache SpamAssassin before 3.4.3, nefarious CF files can be configured to run system commands without any output or errors. With this,...

Default configuration

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to execute arbitrary code only by manipulating the processed input stream. No user is affected, who followed the recommendation to set...

Design/Logic Flaw

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected, who follow...

CVE-2021-28955

git-bug before 0.7.2 has an Uncontrolled Search Path Element. It will execute git.bat from the current directory in certain PATH situations most often seen on Windows...

TIBCO Security Advisory: March 23, 2021 - TIBCO FTL -2021-28820

TIBCO FTL Windows Platform Artifact Search vulnerability Original release date:March 23, 2021 Last revised: CVE-2021-28820 Source: TIBCO Software Inc. Products Affected TIBCO FTL - Community Edition versions 6.5.0 and below TIBCO FTL - Developer Edition versions 6.5.0 and below TIBCO FTL -...

IrfanView WPG plugin out-of-bounds read vulnerability

IrfanView is an image viewer that supports image browsing, image editing, image format conversion, etc. An out-of-bounds read vulnerability exists in IrfanView WPG plugin, which can be exploited by remote attackers to execute arbitrary code...

USN-4856-1: docker-credential-helpers vulnerability

Jasiel Spelman discovered that docker-credential-helpers has a double free. A local attacker could use this to cause a denial of service crash or possibly execute arbitrary code...

USN-4822-1: Firebird vulnerability

It was discovered that Firebird exposed certain UDF libraries. An authenticated attacker could use this vulnerability to cause a denial of service crash or possibly execute arbitrary code...

USN-4814-1: Asterisk vulnerabilities

Richard Mudgett discovered that Asterisk did not properly check the length of input string when setting the user field for PartyB on a CDR. A remote attacker could use this vulnerability to cause a denial of service crash or potentially execute arbitrary code. CVE-2017-16671 Alex Villacis Lasso...

USN-4769-1: Salt vulnerabilities

It was discovered that Salt allowed remote attackers to write to arbitrary files via a special crafted file. An attacker could use this vulnerability to cause a DoS or possibly execute arbitrary code. This issue only affected Ubuntu 14.04 ESM. CVE-2014-3563 Andreas Stieger discovered that Salt...

CVE-2020-28149

myDBR 5.8.3/4262 is affected by: Cross Site Scripting XSS. The impact is: execute arbitrary code remote. The component is: CSRF Token. The attack vector is: CSRF token injection to XSS...

Design/Logic Flaw

An issue was discovered in Quadbase EspressReports ES 7 Update 9. An authenticated user is able to navigate to the MenuPage section of the application, and change the frmsrc parameter value to retrieve and execute external files or payloads...

The vulnerability of the “cgi-bin/execute_cmd.cgi” implementation of D-Link DSL-2888A router microprogramming software allows a hacker to execute arbitrary commands.

The vulnerability of the “cgi-bin/executecmd.cgi” implementation of D-Link DSL-2888A router microprogramming software is related to the failure to take measures to neutralize special elements used in the operating system command. Exploiting this vulnerability allows a remote attacker to execute...