ICSA-19-192-03 Siemens TIA Administrator (TIA Portal)

1. EXECUTIVE SUMMARY CVSS v3 8.0 ATTENTION : Low skill level to exploit Vendor : Siemens Equipment : TIA Administrator TIA Portal Vulnerability : Improper Access Control 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an execution of some commands without proper...

CVE-2019-6503

There is a deserialization vulnerability in Chatopera cosin v3.10.0. An attacker can execute commands during server-side deserialization by uploading maliciously constructed files. This is related to the TemplateController.java impsave method and the MainUtils toObject method...

PT-2018-5423

Name of the Vulnerable Software and Affected Versions: HPE System Management Homepage versions prior to 7.6.1 Description: A local arbitrary execution of commands issue was discovered in HPE System Management Homepage, allowing for potential exploitation. Recommendations: For versions prior to...

Automattic: CSV Injection in polldaddy.com

Hello, We can inject commands in any fields of a member in an email group =210 for example, and when it's exported to CSV it will be evaluated to 20 in the corresponding cell, this enables an attacker to spread malware and execute system level commands on a victim's machine if the victim download...

PT-2020-7454

Name of the Vulnerable Software and Affected Versions: Zabbix version 2.0.9 Description: The issue is related to an Arbitrary Command Execution, which allows for unauthorized execution of commands. Recommendations: For Zabbix version 2.0.9, update to a newer version that contains a fix for this...

CVE-2010-2092

SQL injection vulnerability in graph.php in Cacti 0.8.7e and earlier allows remote attackers to execute arbitrary SQL commands via a crafted rraid parameter in a GET request in conjunction with a valid rraid value in a POST request or a cookie, which causes the POST or cookie value to bypass the...

CVE-2000-0088

CVE-2000-0088 describes a buffer overflow in the conversion utilities for Word 5 documents (Japanese, Korean and Chinese) that allows a local attacker to execute arbitrary commands. The vulnerability is identified as the "Malformed Conversion Data" issue. The available references indicate a high ...