CVE-2019-9855

LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the document it is launched from. LibreOffice also has a feature where documents can specify that pre-installed scripts can be executed on...

CVE-2019-13656

An access vulnerability in CA Common Services DIA of CA Technologies Client Automation 14 and Workload Automation AE 11.3.5, 11.3.6 allows a remote attacker to execute arbitrary code...

Command injection

Nagios XI before 5.6.6 allows remote command execution as root. The exploit requires access to the server as the nagios user, or access as the admin user via the web interface. The getprofile.sh script, invoked by downloading a system profile profile.php?cmd=download, is executed as root via a...

CVE-2019-10677

Multiple Cross-Site Scripting XSS issues in the web interface on DASAN Zhone ZNID GPON 2426A EU version S3.1.285 devices allow a remote attacker to execute arbitrary JavaScript via manipulation of an unsanitized GET parameter: /zhndnsdisplay.cmd name, /wlsecrefresh.wl wlWscCfgMethod, wlwscreg...

Oracle Linux 7 : kernel (ELSA-2019-2600)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-2600 advisory. - netdrv brcmfmac: assure SSID length from firmware is limited Stanislaw Gruszka 1704879 1704880 CVE-2019-9500 - documentation Documentation: Add swapg...

[SECURITY] Fedora 29 Update: python-mitogen-0.2.8-1.fc29

Mitogen is a Python library for writing distributed self-replicating progra ms. There is no requirement for installing packages, copying files around, writ ing shell snippets, upfront configuration, or providing any secondary link to a remote machine aside from an SSH connection. Due to its origi...

[SECURITY] Fedora 30 Update: python-mitogen-0.2.8-1.fc30

Mitogen is a Python library for writing distributed self-replicating progra ms. There is no requirement for installing packages, copying files around, writ ing shell snippets, upfront configuration, or providing any secondary link to a remote machine aside from an SSH connection. Due to its origi...

Fedora Update for ansible FEDORA-2019-01e86d4832

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

The vulnerability in the web interface of the Cisco Integrated Management Controller, a software tool for remote administration of servers, allows a perpetrator to execute arbitrary commands with root privileges.

The vulnerability in the web interface of the Cisco Integrated Management Controller, a software tool for remote administration of servers, exists due to insufficient verification of input data. Exploiting this vulnerability could allow an attacker to execute arbitrary commands with root privileg...

Authentication flaw

Datalogic AV7000 Linear barcode scanner all versions prior to 4.6.0.0 is vulnerable to authentication bypass, which may allow an attacker to remotely execute arbitrary code...

WordPress Imagely NextGEN Gallery Plugin SQL Injection Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Imagely NextGEN Gallery is an image gallery plugin used in it. A SQL injection vulnerability exists in WordPress Imagely NextGEN Galler...

CVE-2019-14314

A SQL injection vulnerability exists in the Imagely NextGEN Gallery plugin before 3.2.11 for WordPress. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system via...

BloodHound Operating System Command Injection Vulnerability

BloodHound is a JavaScript application that reveals hidden relationships and attack paths in Active Directory environments through graph theory. An operating system command injection vulnerability exists in the components/Modals/HelpModal.jsx file in BloodHound version 2.2.0, which can be exploit...

CVE-2019-9569

Buffer Overflow in dactetra in Delta Controls enteliBUS Manager V3.40B-571848 allows remote unauthenticated users to execute arbitrary code and possibly cause a denial of service via unspecified vectors...

D-Link DIR-823G Command Injection Vulnerability (CNVD-2019-30428)

The D-Link DIR-823G is a wireless router from AUO D-Link of Taiwan, China. A command injection vulnerability exists in the D-Link DIR-823G. The vulnerability arises from a failure of a network system or product to properly filter specific elements of externally entered data during the constructio...

CVE-2019-15498

cgi-bin/cmh/webcam.sh in Vera Edge Home Controller 1.7.4452 allows remote unauthenticated users to execute arbitrary OS commands via --output argument injection in the username parameter to /cgi-bin/cmh/webcam.sh...

CVE-2019-15498

CVE-2019-15498 affects Vera Edge Home Controller 1.7.4452. The vulnerability is a remote command-injection in the CGI script at cgi-bin/cmh/webcam.sh, exploitable by unauthenticated users via the username parameter’s --output argument injection, enabling arbitrary OS command execution. The issue ...

Security Bulletin: Remote Execution Vulnerability Affects Red Hat Linux Used By IBM WebSphere Application Server for IBM Cloud Private VM Quickstarter (CVE-2019-12735)

Summary There is a security vulnerability that affects Red Hat Linux used by IBM WebSphere Application Server in the IBM Cloud. Vulnerability Details Relevant CVE Information: CVEID: CVE-2019-12735 DESCRIPTION: Vim and and Neovim could allow a remote attacker to execute arbitrary commands on the...

CVE-2019-15060

The traceroute function on the TP-Link TL-WR840N v4 router with firmware through 0.9.1 3.16 is vulnerable to remote code execution via a crafted payload in an IP address input field...

CVE-2019-1936

CVE-2019-1936 is a command-injection vulnerability in the web-based management interface of Cisco IMC Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data. It stems from insufficient input validation and, per Cisco’s advisory, can be exploited by an authenticated administra...