CVE-2017-16100: Improper Control of Generation of Code

dns-sync is a sync/blocking dns resolver. If untrusted user input is allowed into the resolve method then command injection is possible...

PT-2018-6164

Name of the Vulnerable Software and Affected Versions: method-override versions prior to 2.3.10 Description: The issue concerns a regular expression denial of service vulnerability. It occurs when specially crafted input is passed to be parsed via the X-HTTP-Method-Override header. This can happe...

CVE-2017-16136: Uncontrolled Resource Consumption

method-override is a module used by the Express.js framework to let you use HTTP verbs such as PUT or DELETE in places where the client doesn't support it. method-override is vulnerable to a regular expression denial of service vulnerability when specially crafted input is passed in to be parsed...

Cisco Prime Collaboration Provisioning Unauthenticated Remote Method Invocation Vulnerability

A vulnerability in Cisco Prime Collaboration Provisioning PCP could allow an unauthenticated, remote attacker to access the Java Remote Method Invocation RMI system. The vulnerability is due to an open port in the Network Interface and Configuration Engine NICE service. An attacker could exploit...

Weak Computation Of Iterations For MR Primality Test

bouncycastle is vulnerable to weak computation of iterations for MR primality test. The vulnerability exists in the RSA Key Pairs generated in low-level API with added certainty where a method signature change could occur that results in weak computation of iterations for the MR primality test...

GE MDS PulseNET and MDS PulseNET Enterprise Remote Code Execution Vulnerability

GE MDS PulseNET and MDS PulseNET Enterprise are both products of General Electric GE, U.S.A. GE MDS PulseNET is a suite of network management software designed for radio communication systems. An authorization issue vulnerability exists in the Java Remote Method Invocation RMI input port in GE MD...

Clone 2 GO Video Converter 2.8.2 Unicode Buffer Overflow

!/usr/bin/python ---------------------------------------------------------------------------------------------------------------------- Exploit Title : Clone 2 GO Video converter 2.8.2 Unicode Buffer Overflow Remote Code Execution Exploit Author : Gokul Babu Organisation : Arridae Infosec P.V Ltd...

MGASA-2018-0270 Updated python3 packages fix security vulnerabilities

Updated python3 packages fix security vulnerabilities: A flaw was found in the way catastrophic backtracking was implemented in Python's pop3lib's apop method. An attacker could use this flaw to cause denial of service CVE-2018-1060. A flaw was found in the way catastrophic backtracking was...

CVE-2018-10611

Java remote method invocation RMI input port in GE MDS PulseNET and MDS PulseNET Enterprise version 3.2.1 and prior may be exploited to allow unauthenticated users to launch applications and support remote code execution through web services...

CVE-2018-10611

Java remote method invocation RMI input port in GE MDS PulseNET and MDS PulseNET Enterprise version 3.2.1 and prior may be exploited to allow unauthenticated users to launch applications and support remote code execution through web services...

Quest DR Series Disk Backup Software Command Injection Vulnerability (CNVD-2018-15866)

The Quest DR Series are disk storage and deduplication appliances. A command injection vulnerability exists in the "user update" method in versions of Quest DR Series disk backup software prior to version 4.0.3.1. An attacker could exploit this vulnerability to execute arbitrary system commands...

Quest DR Series Disk Backup Software Command Injection Vulnerability (CNVD-2018-15621)

The Quest DR Series are disk storage and deduplication appliances. A command injection vulnerability exists in the customer portal register method in Quest DR Series disk backup software before 4.0.3.1. An attacker could exploit this vulnerability to execute system commands via specially crafted...

Quest DR Series Disk Backup Software Command Injection Vulnerability (CNVD-2018-15617)

The Quest DR Series are disk storage and deduplication appliances. A command injection vulnerability exists in the get usage method in Quest DR Series disk backup software before 4.0.3.1. An attacker could exploit this vulnerability to execute commands...

Quest DR Series Disk Backup Software Command Injection Vulnerability (CNVD-2018-15871)

The Quest DR Series are disk storage and deduplication appliances. A command injection vulnerability exists in the setCleaner method in versions of Quest DR Series disk backup software prior to 4.0.3.1. An attacker could exploit this vulnerability to execute commands...

Quest DR Series Disk Backup Software Command Injection Vulnerability (CNVD-2018-15622)

The Quest DR Series are disk storage and deduplication appliances. A command injection vulnerability exists in the cloud portal register method in Quest DR Series disk backup software before 4.0.3.1. An attacker can exploit this vulnerability to execute commands via the 'registrationCode' request...

Quest DR Series Disk Backup Software Command Injection Vulnerability (CNVD-2018-15619)

The Quest DR Series are disk storage and deduplication appliances. A command injection vulnerability exists in the set DNS method in Quest DR Series disk backup software prior to 4.0.3.1. An attacker could exploit this vulnerability to execute commands...

PT-2018-6052 · Github · Uri.Js

Name of the Vulnerable Software and Affected Versions: uri-js versions 2.1.1 and earlier Description: The issue arises from a regular expression used by uri-js to validate URLs, which is vulnerable to redos. This vulnerability causes the program to hang and results in 100% CPU usage when attempti...

Quest DR Series Disk Backup Software Command Injection Vulnerability (CNVD-2018-15865)

The Quest DR Series are disk storage and deduplication appliances. A command injection vulnerability exists in the 'Logon' method in Quest DR Series Disk Backup Software versions prior to 4.0.3.1. An attacker can exploit this vulnerability to execute arbitrary commands via the 'Password' paramete...

Quest DR Series Disk Backup Software Command Injection Vulnerability (CNVD-2018-15624)

The Quest DR Series are disk storage and deduplication appliances. A command injection vulnerability exists in the setpassphrase method of Quest DR Series disk backup software before 4.0.3.1. An attacker could exploit this vulnerability to execute arbitrary system commands...

Command injection

The '/common/ajaxemailconnectiontest.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by any authenticated user and can be abused to execute arbitrary commands on the system. This script is vulnerable to command injection via the unsanitized user input 'TESTSERVER'...