Exploit for Missing Authentication for Critical Function in Oracle Weblogic_Server

WebLogic Wls-wsat XMLDecoder 漏洞描述 mitre:https://vulners.com/cve/CVE-2017-3506 早期，黑客利用WebLogic WLS 组件漏洞对企业服务器发起大范围远程攻击，有大量企业的服务器被攻陷，且被攻击企业数量呈现明显上升趋势，需要引起高度重视。其中，CVE-2017-3506是一个利用Oracle WebLogic中WLS 组件的远程代码执行漏洞，属于没有公开细节的野外利用漏洞，大量企业尚未及时安装补丁。官方在 2017 年 4 月份就发布了该漏洞的补丁。 CVE-2017-3506补丁说明： public...

jackson-databind: mishandles the interaction between serialization gadgets and typing which could result in remote command execution

A flaw was found in jackson-databind 2.x in versions prior to 2.9.10.4. FasterXML jackson-databind 2.x mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability...

TP-LINK Cloud Cameras Command Injection (CVE-2020-12111; CVE-2020-12109)

A command injection vulnerability exists in TP-LINK cloud cameras. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

SUSE SLES12 Security Update : squid (SUSE-SU-2020:1227-1)

This update for squid fixes the following issues : CVE-2019-12519, CVE-2019-12521: fixes incorrect buffer handling that can result in cache poisoning, remote execution, and denial of service attacks when processing ESI responses bsc1169659. CVE-2020-11945: fixes a potential remote execution...

SonicWall SMA100 Remote Code Execution (CVE-2019-7486)

A remote code execution vulnerability exists in SonicWall SRA and SonicWall SMA systems. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

TYPO3 Backend User Interface Component Code Issue Vulnerability

TYPO3 is a free and open source content management system framework CMS/CMF of the Swiss TYPO3 Association. A code issue vulnerability exists in the Backend User Interface component in TYPO3 versions 9.0.0 through 9.5.16 and 10.0.0 through 10.4.1. The vulnerability stems from an improper design o...

The vulnerability in the vManage web interface of the software-defined Cisco SD-WAN network allows a attacker to execute arbitrary SQL queries.

The vulnerability in the vManage web interface of the Cisco SD-WAN programmatically defined network is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries remotely...

Security Advisory 0048

Security Advisory 0048 PDF Date: May 13, 2020 Version: 1.0 Revision | Date | Changes ---|---|--- 1.0 | May 13, 2020 | Initial Release The CVE-ID tracking this issue: CVE-2020-10188 CVSSv3 Base Score: 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Description: This security advisory documents the exposur...

Microsoft Internet Explorer JScript Garbage Collection Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Internet Explorer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

undertow: AJP File Read/Inclusion Vulnerability

A file inclusion vulnerability was found in the AJP connector enabled with a default AJP configuration port of 8009 in Undertow version 2.0.29.Final and before. A remote, unauthenticated attacker could exploit this vulnerability to read web application files from a vulnerable server. In instances...

Remote Code Execution

openjpeg is vulnerable to remote code execution. The vulnerability exists as a mishandled zero case was discovered in opjj2ksetcinemaparameters in lib/openjp2/j2k.c in OpenJPEG 2.2.0. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service heap-based buffer...

SUSE-SU-2020:1227-1 Security update for squid

This update for squid fixes the following issues: - CVE-2019-12519, CVE-2019-12521: fixes incorrect buffer handling that can result in cache poisoning, remote execution, and denial of service attacks when processing ESI responses bsc1169659. - CVE-2020-11945: fixes a potential remote execution...

CVE-2020-5741

Deserialization of Untrusted Data in Plex Media Server on Windows allows a remote, authenticated attacker to execute arbitrary Python code...

Advantech WebAccess Node Path Traversal Vulnerability

Advantech WebAccess is a browser-based SCADA software package for monitoring, data acquisition and visualization. It is used to automate complex industrial processes where remote operation is required. A path traversal vulnerability exists in Advantech WebAccess Node, which can be exploited by an...

Command Injection in thebeet/idevicekit

Overview Affected versions execute arbitrary commands remotely inside the victim's PC. The issue occurs because user input is formatted inside a command that will be executed without any checks. There is a possible bypass of the checkSerial function leading to malicious serial variable content...

Command Injection in forsigner/node-pngdefry

Overview Affected versions execute arbitrary commands remotely inside the victim's PC. The issue occurs because user input is formatted inside a command that will be executed without any checks...

CVE-2020-10795

Gira TKS-IP-Gateway 4.0.7.7 is vulnerable to authenticated remote code execution via the backup functionality of the web frontend. This can be combined with CVE-2020-10794 for remote root access...

[SECURITY] [DSA 4676-2] salt security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4676-2 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso May 07, 2020 https://www.debian.org/security/faq -...

CVE-2019-19164

dext5.ocx ActiveX Control in Dext5 Upload 5.0.0.112 and earlier versions contains a vulnerability that could allow remote files to be executed by setting the arguments to the activex method. A remote attacker could induce a user to access a crafted web page, causing damage such as malicious code...

Design/Logic Flaw

dext5.ocx ActiveX Control in Dext5 Upload 5.0.0.112 and earlier versions contains a vulnerability that could allow remote files to be executed by setting the arguments to the activex method. A remote attacker could induce a user to access a crafted web page, causing damage such as malicious code...