mysql-binuuid-rails SQL Injection Vulnerability

mysql-binuuid-rails is a tool that stores UUIDs in binary MySQL database columns. A SQL injection vulnerability exists in mysql-binuuid-rails version 1.1.0 and earlier. A remote attacker can exploit this vulnerability to execute arbitrary SQL commands...

Mozilla Firefox and Firefox ESR Elevation of Privilege Vulnerability

Mozilla Firefox is an open source web browser developed by the Mozilla Foundation in the U.S. Firefox ESR is an extended support version of Firefox. A security vulnerability exists in Mozilla Firefox ESR versions prior to 60.3 and Firefox versions prior to 63. A remote attacker can exploit the...

CVE-2018-15751

CVE-2018-15751 affects SaltStack Salt: pre-2017.7.8 and pre-2018.3.3 for the 2018.3.x line allow remote attackers to bypass authentication via salt-api (netapi) and execute arbitrary commands. Public advisories from multiple vendors (Ubuntu USN-4459-1, OpenSUSE/SUSE updates) describe the issue an...

CVE-2017-18349

parseObject in Fastjson before 1.2.25, as used in FastjsonEngine in Pippo 1.11.0 and other products, allows remote attackers to execute arbitrary code via a crafted JSON request, as demonstrated by a crafted rmi:// URI in the dataSourceName field of HTTP POST data to the Pippo /json URI, which is...

[SECURITY] Fedora 27 Update: libssh-0.7.6-1.fc27

The ssh library was designed to be used by programmers needing a working SSH implementation by the mean of a library. The complete control of the client is made by the programmer. With libssh, you can remotely execute programs, tra nsfer files, use a secure and transparent tunnel for your remote...

Microsoft Edge Sandbox Escape Command Execution (CVE-2018-8463; CVE-2018-8468; CVE-2018-8469)

A command execution vulnerability exists in Microsoft Edge . Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

[SECURITY] Fedora 28 Update: libssh-0.8.4-1.fc28

The ssh library was designed to be used by programmers needing a working SSH implementation by the mean of a library. The complete control of the client is made by the programmer. With libssh, you can remotely execute programs, tra nsfer files, use a secure and transparent tunnel for your remote...

Cisco SocialMiner Cross-Site Scripting Vulnerability (CNVD-2018-21502)

Cisco SocialMiner is the United States Cisco Cisco a social media call center solution. The solution supports social media monitoring and analytics. A cross-site scripting vulnerability exists in the web-based administration interface of Cisco SocialMiner, which arises from the program's failure ...

CVE-2018-14807

A stack-based buffer overflow vulnerability in Opto 22 PAC Control Basic and PAC Control Professional versions R10.0a and prior may allow remote code execution...

Apache Struts vulnerable to remote arbitrary command execution due to improper input validation

Apache Struts versions prior to 2.3.32 and 2.5.10.1 contain incorrect exception handling and error-message generation during file-upload attempts using the Jakarta Multipart parser, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or...

GHSA-J77Q-2QQG-6989 Apache Struts vulnerable to remote arbitrary command execution due to improper input validation

Apache Struts versions prior to 2.3.32 and 2.5.10.1 contain incorrect exception handling and error-message generation during file-upload attempts using the Jakarta Multipart parser, which allows remote attackers to execute arbitrary commands via a crafted Content-Type, Content-Disposition, or...

Adobe Acrobat and Reader Out-of-Bounds Write Vulnerability (CNVD-2019-06892)

Adobe Acrobat is a set of PDF document editing and conversion tools.Reader is a set of PDF document reading software. There is an out-of-bounds write vulnerability in Adobe Acrobat and Reader. A remote attacker can exploit this vulnerability to execute arbitrary code...

libssh Authentication Bypass Makes it Trivial to Pwn Rafts of Servers

The libssh open-source project has issued an update to address an authentication bypass vulnerability in the server code — to say that it’s trivial to exploit is an understatement. The flaw CVE-2018-10933 exists in libssh versions 0.6 and above being used in server mode – and it allows anyone to...

Foxit Reader and Foxit PhantomPDF for Windows Memory Misreference Vulnerability (CNVD-2018-22408)

Foxit Reader for Windows is a Windows-based PDF document reader from China's Foxit Foxit Software Corporation.Foxit PhantomPDF for Windows is its commercial version. A memory misreference vulnerability exists in the conversion of HTML files to PDF in Foxit Reader 9.2.0.9297 and earlier versions a...

GHSA-H6RP-8V4J-HWPH Apache Camel's XSLT component allows remote attackers to execute arbitrary Java methods

The XSLT component in Apache Camel 2.11.x before 2.11.4, 2.12.x before 2.12.3, and possibly earlier versions allows remote attackers to execute arbitrary Java methods via a crafted message...

GHSA-26V6-W6FW-RH94 Apache Camel can allow remote attackers to execute arbitrary commands

Apache Camel 2.6.x through 2.14.x, 2.15.x before 2.15.5, and 2.16.x before 2.16.1, when using 1 camel-jetty or 2 camel-servlet as a consumer in Camel routes, allow remote attackers to execute arbitrary commands via a crafted serialized Java object in an HTTP request...

CVE-2018-18382

Advanced HRM 1.6 allows Remote Code Execution via PHP code in a .php file to the user/update-user-avatar URI, which can be accessed through an "Update Profile" "Change Picture" aka user/edit-profile action...

NUUO CMS Code Execution Vulnerability (CNVD-2018-21168)

NUUO CMS is a set of centralized software management platform from NUUO. The platform is used to centrally manage devices such as NVRs hard disk recorders and IP cameras, and provides functions such as user management and alarm management. A security vulnerability exists in NUUO CMS 3.1 and earli...

LAquis SCADA LQS File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of LAquis SCADA Software. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within parsing of...

LAquis SCADA LQS File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of LAquis SCADA Software. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within parsing of...