CVE-2017-15043

A vulnerability in Sierra Wireless AirLink GX400, GX440, ES440, and LS300 routers with firmware before 4.4.5 and GX450, ES450, RV50, RV50X, MP70, and MP70E routers with firmware before 4.9 could allow an authenticated remote attacker to execute arbitrary code and gain full control of an affected...

Nagios XI Cross-Site Scripting Vulnerability (CNVD-2018-09053)

Nagios XI is a suite of IT infrastructure monitoring solutions from the US-based Nagios. The solution supports monitoring and alerting of applications, services, operating systems and more. A cross-site scripting vulnerability exists in the Schedule New Report page in Nagios XI version 5.4.13,...

osCommerce Installer Unauthenticated Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'osCommerce Installer Unauthenticated Code Execution', 'Description' = %q If the /install/ directory was not removed, it is possible for an...

CVE-2018-0258

A vulnerability in the Cisco Prime File Upload servlet affecting multiple Cisco products could allow a remote attacker to upload arbitrary files to any directory of a vulnerable device aka Path Traversal and execute those files. This vulnerability affects the following products: Cisco Prime Data...

CVE-2018-10115

Incorrect initialization logic of RAR decoder objects in 7-Zip 18.03 and before can lead to usage of uninitialized memory, allowing remote attackers to cause a denial of service segmentation fault or execute arbitrary code via a crafted RAR archive...

Cisco Secure Access Control System Remote Code Execution Vulnerability

A vulnerability in the ACS Report component of Cisco Secure Access Control System ACS could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected system. Commands executed by the attacker are processed at the targeted user's privilege level. The vulnerability is d...

CVE-2018-10574

site/index.php/admin/trees/add/ in BigTree 4.2.22 and earlier allows remote attackers to upload and execute arbitrary PHP code because the BigTreeStorage class in core/inc/bigtree/apis/storage.php does not prevent uploads of .htaccess files...

CVE-2013-7202

The WebHybridClient class in PayPal 5.3 and earlier for Android allows remote attackers to execute arbitrary JavaScript on the system...

TerraMaster TOS Unauthenticated Remote Command Execution

Vulnerability Summary The following advisory describes a unauthenticated remote command execution found in TerraMaster TOS 3.0.33. TOS is a “Linux platform-based operating system developed for TerraMaster cloud storage NAS server. TOS 3 is the third generation operating system newly launched.”...

Belkin N750 Arbitrary Command Execution Vulnerability (CNVD-2018-08981)

Belkin N750 is a dual-band wireless router product from Belkin USA. A security vulnerability exists in the Belkin N750 using firmware version 1.10.22. The vulnerability can be exploited by a remote attacker to execute commands with root privileges by sending a specially crafted HTTP request to th...

Easy File Sharing Web Server 7.2 - 'UserID' Remote Buffer Overflow (DEP Bypass)

!/usr/bin/env python --------------------------------------------------------------------------------------------------- Exploit Title : Easy File Sharing Web Server 7.2 - 'UserID' Remote Buffer Overflow DEP Bypass Date : 04/24/2018 Exploit Author : Hashim Jawad Twitter : @ihack4falafel Author...

Advantech WebAccess HMI Designer

1. EXECUTIVE SUMMARY CVSS v3 6.3 ATTENTION : Exploitable remotely/low skill level to exploit. Vendor : Advantech Equipment : Advantech WebAccess HMI Designer Vulnerabilities : Heap-based Buffer Overflow, Double Free, Out-of-bounds Write 2. RISK EVALUATION Successful exploitation of these...

By CVE-2017-17215 learning router vulnerability analysis, from into the pit to give up-vulnerability warning-the black bar safety net

Basic information: 2017/11/27, Check Point Software Technologies sector reported a Huawei HG532 product remote commands execution vulnerabilityCVE-2017-17215, the Mirai an upgraded version of the variant has been used in the vulnerability. Looks like a very simple vulnerabilities, and the book...

chromium-browser: Integer overflow in WebAssembly

An integer overflow on 32-bit systems in WebAssembly in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page...

Foxit Reader ConvertToPDF_x86 BMP Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within ConvertToPDFx86.dll...

(0Day) Advantech WebAccess HMI Designer PM2 File Conversion Double Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Advantech WebAccess HMI Designer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within...

CVE-2018-1143

A remote unauthenticated user can execute commands as root in the Belkin N750 using firmware version 1.10.22 by sending a crafted HTTP request to twonkycommand.cgi...

CVE-2018-1143

The connected CNVD entry confirms a vulnerability in Belkin N750 routers (firmware 1.10.22) that allows an unauthenticated remote attacker to execute arbitrary commands with root privileges by sending a crafted HTTP request to twonky_command.cgi. Impact is elevated: full root command execution, e...

The vulnerability of the Cisco Secure Access Control System’s access control software lies in the ability to restore a questionable data structure in memory, allowing an intruder to execute arbitrary commands with root privileges.

The vulnerability of the Cisco Secure Access Control System ACS management software exists due to insufficient validation of input data and the inability to restore a reliable data structure in memory. Exploiting this vulnerability allows an attacker, operating remotely, to execute arbitrary...

Nagios XI Operating System Command Injection Vulnerability

Nagios XI is a suite of IT infrastructure monitoring solutions from the US-based Nagios. The solution supports monitoring and alerting of applications, services, operating systems and more. An operating system command injection vulnerability exists in Nagios XI version 5.2.x and version 5.4.x pri...