CPP-Ethereum JSON-RPC Incorrect Authorization Vulnerability (CNVD-2018-02800)

CPP-Ethereum is a C++ client for Ethereum Application Programming Platform.JSON-RPC is one of the remote invocation services using JSON as the protocol. An incorrect authorization vulnerability exists in the minerstop API for JSON-RPC in CPP-Ethereum commit version...

Design/Logic Flaw

cgi-bin/drknow.cgi in Innotube ITGuard-Manager 0.0.0.1 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the username field, as demonstrated by a username beginning with "admin|" to use the '|' metacharacter...

Commvault Communications Service (cvd) - Command Injection Exploit

Exploit for windows platform in category remote exploits This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core/exploit/powershell' class MetasploitModule 'Commvault Communications Service cvd Command...

KLA11170 Multiple vulnerabilities in Microsoft Office

Multiple serious vulnerabilities have been found in Microsoft Office. Malicious users can exploit these vulnerabilities to execute arbitrary code, spoof user interface and obtain sensitive information. Below is a complete list of vulnerabilities: 1. Elevation of privilege vulnerabilities in...

CVE-2014-4972

Unrestricted file upload vulnerability in the Gravity Upload Ajax plugin 1.1 and earlier for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file under wp-content/uploads/gravityforms...

CVE-2017-5971

SQL injection vulnerability in NewsBee CMS allow remote attackers to execute arbitrary SQL commands...

Google Android Qualcomm Display elevation of privilege vulnerability

Android is a Linux-based open source operating system developed by Google and the Open Handheld Alliance OHA, and Qualcomm Display is a display component developed by Qualcomm. An elevation of privilege vulnerability exists in Qualcomm Display in Android. A remote attacker can exploit this...

Flash Operator Panel v2.31.03 - Command Execution

Document Title: =============== Flash Operator Panel v2.31.03 - Command Execution References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1907 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-5694 CVE-ID: ======= CVE-2018-5694 Release Date: =============...

GLSA-201801-03 : Chromium, Google Chrome: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201801-03 Chromium, Google Chrome: Multiple vulnerabilities Multiple vulnerabilities have been discovered in Chromium and Google Chrome. Please review the CVE identifiers referenced below for details. Impact : A remote attacker...

CVE-2017-16666

Xplico before 1.2.1 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the name of an uploaded PCAP file. NOTE: this issue can be exploited without authentication by leveraging the user registration feature...

Advantech WebAccess cnvlgxtag Untrusted Pointer Dereference Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Advantech WebAccess. Authentication is not required to exploit this vulnerability. The specific flaw exists within the parsing of the command line in the cnvlgxtag utility. The issue results from t...

eLabFTW experiment infos component cross-site scripting vulnerability

Elabftw is an open source platform for hosting experimental data. The platform runs on Linux and supports storing a variety of objects. experiment infos component is one of the experiment infos storage components. A cross-site scripting vulnerability exists in the experiment infos component in...

b2evolution Remote PHP Code Execution Vulnerability

b2evolution is prone to a remote PHP code execution vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2017-1000496

Commsy version 9.0.0 is vulnerable to XXE attacks in the configuration import functionality resulting in denial of service and possibly remote execution of code...

Updated connman packages fix security vulnerability

Security consultants in NRI Secure Technologies discovered a stack overflow vulnerability in ConnMan. An attacker with control of the DNS responses to the DNS proxy in ConnMan might crash the service and, in same cases, remotely execute arbitrary commands in the host running the service...

Ruby on Rails SQL Injection Vulnerability (CNVD-2018-01349)

Ruby on Rails is a web application development framework written in the Ruby language. A SQL injection vulnerability exists in the 'where' method in Ruby on Rails 5.1.4 and earlier. A remote attacker can exploit this vulnerability to execute arbitrary SQL commands via the 'id' parameter...

UBUNTU-CVE-2017-17917

DISPUTED SQL injection vulnerability in the 'where' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the 'id' parameter. NOTE: The vendor disputes this issue because the documentation states that this method is not intended for use with...

CVE-2017-17919

SQL injection vulnerability in the 'order' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the 'id desc' parameter. NOTE: The vendor disputes this issue because the documentation states that this method is not intended for use with untrusted...

DEBIAN-CVE-2017-17916

SQL injection vulnerability in the 'findby' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the 'name' parameter. NOTE: The vendor disputes this issue because the documentation states that this method is not intended for use with untrusted...

UBUNTU-CVE-2017-17916

DISPUTED SQL injection vulnerability in the 'findby' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the 'name' parameter. NOTE: The vendor disputes this issue because the documentation states that this method is not intended for use with...