CVE-2019-9585

eQ-3 Homematic CCU2 prior to 2.47.10 and CCU3 prior to 3.47.10 JSON API has Improper Access Control for Interface.Metadata related operations, resulting in the ability to read, set and deletion of Metadata...

CVE-2019-9585

CVE-2019-9585 affects eQ-3 Homematic CCU2 (before 2.47.10) and CCU3 (before 3.47.10). The JSON API has improper access control, enabling metadata read, set, and delete operations via the interface. ROOT CAUSE: insufficient access restrictions on the JSON API. IMPACT: potential disclosure and modi...

PT-2019-19727

Name of the Vulnerable Software and Affected Versions eQ-3 Homematic CCU2 versions prior to 2.47.10 eQ-3 Homematic CCU3 versions prior to 3.47.10 Description The issue is related to Improper Access Control in the JSON API for Interface.Metadata related operations. This allows unauthorized access ...

CVE-2019-9585: Missing Authentication for Critical Function

eQ-3 Homematic CCU2 prior to 2.47.10 and CCU3 prior to 3.47.10 JSON API has Improper Access Control for Interface.Metadata related operations, resulting in the ability to read, set and deletion of Metadata...

eQ-3 HomeMatic CCU2 and eQ-3 Homematic CCU3 Access Control Error Vulnerabilities

The eQ-3 Homematic CCU3 and the eQ-3 HomeMatic CCU2 are both central control units for a smart home system from eQ-3 Germany. An access control error vulnerability exists in the JSON API in the eQ-3 Homematic CCU2 version prior to 2.47.10 and the eQ-3 Homematic CCU3 version prior to 3.47.10, whic...

CVE-2016-10843

cPanel before 11.54.0.4 allows code execution in the context of shared users via JSON-API SEC-76...

Code injection

cPanel before 11.54.0.4 allows code execution in the context of shared users via JSON-API SEC-76...

CVE-2016-10843

cPanel before 11.54.0.4 allows code execution in the context of shared users via JSON-API SEC-76...

CVE-2016-10843

Summary: CVE-2016-10843 affects cPanel prior to 11.54.0.4 and allows code execution in the context of shared users via the JSON-API (SEC-76). Affected product/vector: cPanel software; vulnerability arises through the JSON-API, enabling code execution in shared-user context. Root cause / impact: N...

CVE-2016-10843: Improper Neutralization of Special Elements used in a Command

cPanel before 11.54.0.4 allows code execution in the context of shared users via JSON-API SEC-76...

PT-2019-7639

Name of the Vulnerable Software and Affected Versions cPanel versions prior to 11.54.0.4 Description The issue allows code execution in the context of shared users via JSON-API. Recommendations For versions prior to 11.54.0.4, update to version 11.54.0.4 or later to resolve the issue...

CVE-2019-3702

A Remote Code Execution issue in the DNS Query Web UI in Lifesize Icon LSRM33.7.0 2421 allows remote authenticated attackers to execute arbitrary commands via a crafted DNS Query address field in a JSON API request...

Remote code execution

A Remote Code Execution issue in the DNS Query Web UI in Lifesize Icon LSRM33.7.0 2421 allows remote authenticated attackers to execute arbitrary commands via a crafted DNS Query address field in a JSON API request...

CVE-2019-3702

CVE-2019-3702 affects Lifesize Icon LS_RM3_3.7.0 (2421). The vulnerability is a Remote Code Execution in the DNS Query Web UI, exploitable by an authenticated attacker who crafts a DNS Query address field in a JSON API request. Connected sources reiterate the issue but do not provide exploitation...

CVE-2019-3702

A Remote Code Execution issue in the DNS Query Web UI in Lifesize Icon LSRM33.7.0 2421 allows remote authenticated attackers to execute arbitrary commands via a crafted DNS Query address field in a JSON API request...

PT-2019-16650

Name of the Vulnerable Software and Affected Versions Lifesize Icon version 3.7.0 2421 Description A Remote Code Execution issue in the DNS Query Web UI allows remote authenticated attackers to execute arbitrary commands via a crafted DNS Query address field in a JSON API request. Recommendations...

CVE-2019-3702: Improper Neutralization of Special Elements used in an OS Command

A Remote Code Execution issue in the DNS Query Web UI in Lifesize Icon LSRM33.7.0 2421 allows remote authenticated attackers to execute arbitrary commands via a crafted DNS Query address field in a JSON API request...

CVE-2019-6340 Drupal core - Highly critical - Remote Code Execution

Some field types do not properly sanitize data from non-form sources in Drupal 8.5.x before 8.5.11 and Drupal 8.6.x before 8.6.10. This can lead to arbitrary PHP code execution in some cases. A site is only affected by this if one of the following conditions is met: The site has the Drupal 8 core...

JSON:API - Highly critical - Remote code execution - SA-CONTRIB-2019-019

This resolves issues described in SA-CORE-2019-003 for this module...

Remote Code Execution (RCE)

cfme is vulnerable to remote code execution RCE attacks. The vulnerability exists as Red Hat CloudForms Management Engine 4.1 does not properly handle regular expressions passed to the expression engine via the JSON API and the web-based UI, which allows remote authenticated users to execute...