CVE-2017-18362

ConnectWise ManagedITSync integration through 2017 for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to the Kaseya VSA database. In February 2019, attackers have actively exploited this in the wild to download and execute ransomware payloads on all...

Command Execution Vulnerability in Multiple D-Link Products

D-Link DIR-822 C1 and others are wireless router products from AUO D-Link. A command execution vulnerability exists in multiple D-Link products, which can be exploited by remote attackers to execute commands...

D-Link DIR/DWR Devices Multiple Vulnerabilities (Oct 2018) - Active Check

D-Link DIR / DWR devices are prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPEPREFIX = "cpe:/o:dlink";...

Code Execution Vulnerability in ESPCMS Enterprise Website Management System P8.18101601 Stable Version

ESPCMS enterprise website management system is based on LAMP development and construction of enterprise website management system. A code execution vulnerability exists in the stable version of ESPCMS P8.18101601. It allows an attacker to remotely execute commands and gain server privileges...

Code Execution Vulnerability in Discuz! 1.5-2.5 Versions

Discuz! is a community-based professional website building platform launched by Comsenz Comsenz. A code execution vulnerability exists in Discuz! version 1.5-2.5. The vulnerability is due to improper handling of the parameters of the background database backup function, and an attacker can exploi...

Facebook Flaw Allowed Remote Commands

A vulnerability in a Facebook server that could have led to information disclosure and command execution has been patched by the social network. At issue was a Sentry service, which is an open-source error tracking application that helps developers monitor and fix crashes in real time. It’s writt...

Command Execution Vulnerability in Controller Technology's Little K Smart App

Controller smart home through cutting-edge wireless technology to upgrade the home electrical equipment networking, so as to realize a variety of whole-house intelligent scene. The controller has a variety of smart sockets, designed in a compact form with a variety of functions, with a linkage...

UBoat - HTTP Botnet Project

A POC HTTP Botnet designed to replicate a full weaponised commercial botnet. Disclaimer This project should be used for authorized testing or educational purposes only. The main objective behind creating this offensive project was to aid security researchers and to enhance the understanding of...

Command Execution Vulnerability in ZZZCMS Website Builder System

zzcms is asp language to do free open-source station-building system, mainly facing the majority of webmasters to use. ZZZCMS website builder system there is a command execution vulnerability, attackers can use the vulnerability to execute remote commands...

Code Execution Vulnerability in OURPHP Website Builder V1.8.3

OURPHP a PHP + MySQL based on the development of W3C standards-compliant building system. OURPHP website builder V1.8.3 has a code execution vulnerability that can be exploited by attackers to execute remote commands...

PT-2018-3300 · Mutt +7 · Mutt +7

Name of the Vulnerable Software and Affected Versions: Mutt versions prior to 1.10.1 NeoMutt versions prior to 2018-07-16 Description: The issue allows remote IMAP servers to execute arbitrary commands via backquote characters, related to the mailboxes command associated with a manual subscriptio...

Kisisel Portfolyo Scripti SQL Injection Vulnerability

Kisisel Portfolyo Scripti is a script that allows you to set up a site specifically for yourself to edit content and publish articles. Kisisel Portfolyo Scripti suffers from a SQL injection vulnerability. An attacker can use this vulnerability to inject arbitrary remote SQL commands to corrupt th...

UBUNTU-CVE-2018-11652

CSV Injection vulnerability in Nikto 2.1.6 and earlier allows remote attackers to inject arbitrary OS commands via the Server field in an HTTP response header, which is directly injected into a CSV report...

ALPINE-CVE-2018-11652

CSV Injection vulnerability in Nikto 2.1.6 and earlier allows remote attackers to inject arbitrary OS commands via the Server field in an HTTP response header, which is directly injected into a CSV report...

CVE-2018-8939

An SSRF issue was discovered in NmAPI.exe in Ipswitch WhatsUp Gold before 2018 18.0. Malicious actors can submit specially crafted requests via the NmAPI executable to 1 gain unauthorized access to the WhatsUp Gold system, 2 obtain information about the WhatsUp Gold system, or 3 execute remote...

CVE-2018-8939

CVE-2018-8939 describes a Server-Side Request Forgery (SSRF) in NmAPI.exe of Ipswitch WhatsUp Gold, affecting versions prior to 18.0. An attacker can submit specially crafted requests via NmAPI.exe to gain unauthorized access, obtain information about the WhatsUp Gold system, or execute remote co...

UBUNTU-CVE-2017-18190

A localhost.localdomain whitelist entry in validhost in scheduler/client.c in CUPS before 2.2.2 allows remote attackers to execute arbitrary IPP commands by sending POST requests to the CUPS daemon in conjunction with DNS rebinding. The localhost.localdomain name is often resolved via a DNS serve...

Server side request forgery (ssrf)

Citrix NetScaler VPX through NS12.0 53.13.nc allows an SSRF attack via the /rapi/readurl URI by an authenticated attacker who has a webapp account. The attacker can gain access to the nsroot account, and execute remote commands with root privileges...

CVE-2018-6186

Citrix NetScaler VPX through NS12.0 53.13.nc allows an SSRF attack via the /rapi/readurl URI by an authenticated attacker who has a webapp account. The attacker can gain access to the nsroot account, and execute remote commands with root privileges...

CVE-2018-6186

Citrix NetScaler VPX through NS12.0 53.13.nc allows an SSRF attack via the /rapi/readurl URI by an authenticated attacker who has a webapp account. The attacker can gain access to the nsroot account, and execute remote commands with root privileges...