Design/Logic Flaw

Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitized input when configuring the devices wifi configuration via the bssid parameter...

CVE-2019-3985

Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitized input when configuring the devices wifi configuration via the ssid parameter...

DEBIAN-CVE-2019-14889

A flaw was found with the libssh API function sshscpnew in versions before 0.9.3 and before 0.8.8. When the libssh SCP client connects to a server, the scp command, which includes a user-provided path, is executed on the server-side. In case the library is used in a way where users can influence...

CVE-2019-13735

Out of bounds write in JavaScript in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page...

Remote code execution

A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScript Remote Code Execution Vulnerability'...

Broadcom CA Nolio CVE-2019-19230 Deserialization Remote Code Execution Vulnerability

Description Broadcom CA Nolio is prone to a remote-code execution vulnerability. Successfully exploiting this issue allows attackers to execute arbitrary code in the context of the affected application. Failed exploits will result in denial-of-service conditions. Broadcom CA Nolio version 6.6 is...

PrestaShop Adobe Stock API integration file upload vulnerability

PrestaShop is an open source e-commerce solution. PrestaShop Adobe Stock API integration reset/modules/advancedformmakeredit/multiupload/upload.php A file upload vulnerability exists that allows remote attackers to submit a special request that can be exploited to upload . php file and execute it...

Integard Pro NoJs 2.2.0.9026 - Remote Buffer Overflow

Exploit Title: Integard Pro NoJs 2.2.0.9026 - Remote Buffer Overflow Date: 2019-09-22 Exploit Author: purpl3f0xsecur1ty Vendor Homepage: https://www.tucows.com/ Software Link: http://www.tucows.com/preview/519612/Integard-Home Version: Pro 2.2.0.9026 / Home 2.0.0.9021 Tested on: Windows XP / Win7...

CVE-2019-7184

This cross-site scripting XSS vulnerability in Video Station allows remote attackers to inject and execute scripts on the administrator’s management console. To fix this vulnerability, QNAP recommend updating Video Station to their latest versions...

CVE-2019-7185

This cross-site scripting XSS vulnerability in Music Station allows remote attackers to inject and execute scripts on the administrator’s management console. To fix this vulnerability, QNAP recommend updating Music Station to their latest versions...

Google Android Media Framework Remote Code Execution Vulnerability (CNVD-2019-44273)

Android is a Linux-based open source operating system from Google and the Open Handset Alliance OHA in the U.S. Media Framework is one of the multimedia development frameworks. A remote code execution vulnerability exists in Media Framework in Google Android. An attacker can exploit this...

EulerOS 2.0 SP2 : python-pillow (EulerOS-SA-2019-2437)

According to the versions of the python-pillow package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Pillow before 2.7.0 allows remote attackers to cause a denial of service via a compressed text chunk in a PNG image that has a large size...

EulerOS 2.0 SP2 : php (EulerOS-SA-2019-2438)

According to the versions of the php packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM...

CVE-2019-19502

This CVE affects Image Uploader and Browser for CKEditor (pluginconfig.php) prior to version 4.1.9. The root cause is a code injection vulnerability that allows remote authenticated users to execute arbitrary PHP code. Impact is scope-wide on affected deployments, with high risk per CVSS in the p...

CVE-2011-2717

The DHCPv6 client dhcp6c as used in the dhcpv6 project through 2011-07-25 allows remote DHCP servers to execute arbitrary commands via shell metacharacters in a hostname obtained from a DHCP message...

Code injection

The DHCPv6 client dhcp6c as used in the dhcpv6 project through 2011-07-25 allows remote DHCP servers to execute arbitrary commands via shell metacharacters in a hostname obtained from a DHCP message...

CVE-2011-2717

CVE-2011-2717 affects the DHCPv6 client (dhcp6c) used in the dhcpv6 project up to 2011-07-25. The underlying issue is shell metacharacter handling in a hostname received from a DHCPv6 message, allowing remote DHCP servers to execute arbitrary commands via that hostname. The connected documents co...

CVE-2011-2717

The DHCPv6 client dhcp6c as used in the dhcpv6 project through 2011-07-25 allows remote DHCP servers to execute arbitrary commands via shell metacharacters in a hostname obtained from a DHCP message...

OMRON CX-One CX-Protocol Type Confusion (CVE-2018-19027)

A type confusion vulnerability exists in OMRON CX-One CX-Protocol. This vulnerability occurs due to improper parsing of the project file. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Nagios Xi Remote Command Execution (CVE-2019-9164)

A command execution vulnerability exists in nagios nagios xi r1.0. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...