720 matches found
CVE-2017-12243
A vulnerability in the Cisco Unified Computing System UCS Manager, Cisco Firepower 4100 Series Next-Generation Firewall NGFW, and Cisco Firepower 9300 Security Appliance could allow an authenticated, local attacker to obtain root shell privileges on the device, aka Command Injection. The...
Cisco UCS Manager, Cisco Firepower 4100 Series NGFW, and Cisco Firepower 9300 Security Appliance Command Injection Vulnerability
A vulnerability in the Cisco Unified Computing System UCS Manager, Cisco Firepower 4100 Series Next-Generation Firewall NGFW, and Cisco Firepower 9300 Security Appliance could allow an authenticated, local attacker to obtain root shell privileges on the device. The vulnerability is due to imprope...
Newspaper 1.0 - SQL Injection
Exploit Title: Newspaper Magazine & Blog CMS 1.0 - SQL Injection Dork: N/A Date: 30.10.2017 Vendor Homepage: http://geniusocean.com/ Software Link: https://codecanyon.net/item/mymagazine-fully-responsive-magazine-cms/19493325 Demo: http://demo.geniusocean.com/newspaper/ Version: 1.0 Category:...
[ASA-201710-15] go: arbitrary command execution
Arch Linux Security Advisory ASA-201710-15 ========================================== Severity: High Date : 2017-10-12 CVE-ID : CVE-2017-15041 Package : go Type : arbitrary command execution Remote : Yes Link : https://security.archlinux.org/AVG-442 Summary ======= The package go before version...
Debian DSA-3994-1 : nautilus - security update
Christian Boxdorfer discovered a vulnerability in the handling of FreeDesktop.org .desktop files in Nautilus, a file manager for the GNOME desktop environment. An attacker can craft a .desktop file intended to run malicious commands but displayed as a innocuous document file in Nautilus. An user...
[SECURITY] [DSA 3994-1] nautilus security update
------------------------------------------------------------------------- Debian Security Advisory DSA-3994-1 [email protected] https://www.debian.org/security/ Yves-Alexis Perez October 07, 2017 https://www.debian.org/security/faq -...
CVE-2017-15041
Go before 1.8.4 and 1.9.x before 1.9.1 allows "go get" remote command execution. Using custom domains, it is possible to arrange things so that example.com/pkg1 points to a Subversion repository but example.com/pkg1/pkg2 points to a Git repository. If the Subversion repository includes a Git...
CVE-2017-15041
Go before 1.8.4 and 1.9.x before 1.9.1 allows "go get" remote command execution. Using custom domains, it is possible to arrange things so that example.com/pkg1 points to a Subversion repository but example.com/pkg1/pkg2 points to a Git repository. If the Subversion repository includes a Git...
CVE-2017-15041
Removed by vendor...
CVE-2017-15041
Go before 1.8.4 and 1.9.x before 1.9.1 allows "go get" remote command execution. Using custom domains, it is possible to arrange things so that example.com/pkg1 points to a Subversion repository but example.com/pkg1/pkg2 points to a Git repository. If the Subversion repository includes a Git...
CVE-2017-14604
GNOME Nautilus before 3.23.90 allows attackers to spoof a file type by using the .desktop file extension, as demonstrated by an attack in which a .desktop file's Name field ends in .pdf but this file's Exec field launches a malicious "sh -c" command. In other words, Nautilus provides no UI...
CVE-2017-14604
GNOME Nautilus before 3.23.90 allows attackers to spoof a file type by using the .desktop file extension, as demonstrated by an attack in which a .desktop file's Name field ends in .pdf but this file's Exec field launches a malicious "sh -c" command. In other words, Nautilus provides no UI...
Security Advisory - Two Command Injection Vulnerabilities in The FusionSphere OpenStack
The FusionSphere has two command injection vulnerabilities due to the insufficient input validation on one port. An attacker can exploit the vulnerabilities to gain root privileges by sending some messages with malicious commands. Vulnerability ID: HWPSIRT-2017-05142 and HWPSIRT-2017-05143 The tw...
Cross-site Request Forgery (CSRF)
brooklyn is susceptible to cross-site request forgery CSRF attacks. The vulnerability is possible because it does not prevent the malicious website from producing a malicious link. When the link is clicked by a logged-in user, it triggers the server to execute the malicious commands as the user...
Command injection
git-fastclone before 1.0.5 passes user modifiable strings directly to a shell command. An attacker can execute malicious commands by modifying the strings that are passed as arguments to "cd " and "git clone " commands in the library...
BSNL Teracom Router Firmware Rewrite / Link Modification
Multiple Vulnerabilities in TERACOM ROUTER Author: Ajay Gowtham aka AJOXR Contact: gowtham.ajay5 at gmail.com Vulnerability Type: Insecure Upload File Permissions Affected Module: Upload Functionality Criticality: Medium Device Model: BSNL Teracom T2-B-Gawv1.4U10Y-BI is WiFi enabled ADSL2+...
Hi Technology & Services CMS SQL Injection Vulnerability
Hi Technology & Services CMS suffers from a SQL injection vulnerability that allows remote attackers to execute malicious sql commands to connect to dbms...
Samsumg android phone denial of service vulnerability (CNVD-2016-02879)
Samsumg android phone is a series of cell phone products based on Android platform. The Samsumg android system service fails to properly handle exceptions, allowing local attackers to conduct denial of service attacks by sending malicious service commands...
Samsumg android phone denial of service vulnerability
Samsumg android phone is a series of cell phone products based on Android platform. The Samsumg android system service fails to properly handle exceptions, allowing local attackers to conduct denial of service attacks by sending malicious service commands...
espeak-ruby Gem for Ruby Arbitrary Command Execution
espeak-ruby passes user modifiable strings directly to a shell command. An attacker can execute malicious commands by modifying the strings that are passed as arguments to the speak, save, bytes and byteswav methods in the lib/espeak/speech.rb library...