Columbia Weather Systems Weather MicroServer Cross-Site Scripting Vulnerability (CNVD-2019-07785)

Columbia Weather Systems Weather MicroServer is a weather monitoring device from Columbia Weather Systems, USA. A cross-site scripting vulnerability exists in Columbia Weather Systems Weather MicroServer MS2.6.9900 and prior versions, which stems from the program failing to properly validate inpu...

CVE-2018-20323

www/soap/application/MCSoap/Logs.php in MailCleaner Community Edition 2018.08 allows remote attackers to execute arbitrary OS commands...

UBUNTU-CVE-2019-9787

WordPress before 5.1.1 does not properly filter comment content, leading to Remote Code Execution by unauthenticated users in a default configuration. This occurs because CSRF protection is mishandled, and because Search Engine Optimization of A elements is performed incorrectly, leading to XSS...

CVE-2019-9766

Stack-based buffer overflow in Free MP3 CD Ripper 2.6, when converting a file, allows user-assisted remote attackers to execute arbitrary code via a crafted .mp3 file...

CVE-2019-9767

CVE-2019-9767 describes a stack-based buffer overflow in Free MP3 CD Ripper when converting files, triggered by specially crafted .wma inputs. The vulnerability affects at least versions 2.6 and 2.8, where processing certain WMA-containing payloads can overwrite the stack and allow arbitrary code...

DEBIAN-CVE-2018-17937

gpsd versions 2.90 to 3.17 and microjson versions 1.0 to 1.3, an open source project, allow a stack-based buffer overflow, which may allow remote attackers to execute arbitrary code on embedded platforms via traffic on Port 2947/TCP or crafted JSON inputs...

Microsoft Visual Studio Remote Code Execution Vulnerability (CNVD-2019-07333)

Microsoft Visual Studio is a family of development tool suites from Microsoft, and a largely complete development toolset that includes most of the tools needed throughout the software life cycle. A remote code execution vulnerability exists in Microsoft Visual Studio 2017 15.9 that stems from th...

Microsoft Edge Scripting Engine Memory Corruption (CVE-2019-0769)

A memory corruption vulnerability exists in Microsoft Edge. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

AutoRDPwn v4.8 - The Shadow Attack Framework

AutoRDPwn is a script created in Powershell and designed to automate the Shadow attack on Microsoft Windows computers. This vulnerability allows a remote attacker to view his victim's desktop without his consent, and even control it on request. For its correct operation, it is necessary to comply...

Motorola C1 and Motorola M2 OS Command Injection Vulnerability

The Motorola C1 and Motorola M2 are both routers from Motorola USA. An operating system command injection vulnerability exists in the Motorola C1 and Motorola M2. The vulnerability can be exploited to execute arbitrary operating system commands with the help of a specially crafted request...

CVE-2019-9185

Controller/Async/FilesystemManager.php in the filemanager in Bolt before 3.6.5 allows remote attackers to execute arbitrary PHP code by renaming a previously uploaded file to have a .php extension...

GHSA-WG37-7MRV-CFWM Unauthenticated Remote Code Execution in Apache JMeter

Unauthenticated RCE is possible when JMeter is used in distributed mode -r or -R command line options. Attacker can establish a RMI connection to a jmeter-server using RemoteJMeterEngine and proceed with an attack using untrusted data deserialization. This only affect tests running in Distributed...

The vulnerability of the SoMachine Basic software, related to configuration errors, allows a perpetrator to execute SoMachine.

The vulnerability of the SoMachine Basic software is related to configuration errors. Exploiting this vulnerability allows a remote attacker to execute SoMachine by sending specially crafted Ethernet messages...

Debian DLA-1700-1 : uw-imap security update

A vulnerability was discovered in uw-imap, the University of Washington IMAP Toolkit, that might allow remote attackers to execute arbitrary OS commands if the IMAP server name is untrusted input e.g., entered by a user of a web application and if rsh has been replaced by a program with different...

CVE-2019-6555

Cscape, 9.80 SP4 and prior. An improper input validation vulnerability may be exploited by processing specially crafted POC files. This may allow an attacker to read confidential information and remotely execute arbitrary code...

CVE-2019-1674 Cisco Webex Meetings Desktop App and Cisco Webex Productivity Tools Update Service Command Injection Vulnerability

A vulnerability in the update service of Cisco Webex Meetings Desktop App and Cisco Webex Productivity Tools for Windows could allow an authenticated, local attacker to execute arbitrary commands as a privileged user. The vulnerability is due to insufficient validation of user-supplied parameters...

CVE-2019-9227

An issue was discovered in baigo CMS 2.1.1. There is a vulnerability that allows remote attackers to execute arbitrary code. A BGSITENAME parameter with malicious code can be written into the optbase.inc.php file...

CVE-2019-9122

An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. They allow remote attackers to execute arbitrary commands via the ntpserver parameter in an ntpsync.cgi POST request...

CVE-2019-9122

The CVE-2019-9122 issue affects D-Link DIR-825 Rev.B firmware 2.10. An input validation flaw in the ntp_sync.cgi endpoint allows a remote attacker to pass ntp_server in a POST request to execute arbitrary commands, giving remote code execution with high impact (C/H/I/H) per CVSS 3.1. Exploitation...

CVE-2019-9122

An issue was discovered on D-Link DIR-825 Rev.B 2.10 devices. They allow remote attackers to execute arbitrary commands via the ntpserver parameter in an ntpsync.cgi POST request...