Sounder Contains Arbitrary Command Execution Vulnerability

lib/sounder/sound.rb in the sounder gem 1.0.1 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a filename...

GHSA-574Q-FXFJ-WV6H Puppet Improper Input Validation vulnerability

Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1, when running Ruby 1.9.3 or later, allows remote attackers to execute arbitrary code via vectors related to "serialized attributes."...

espeak-ruby allows arbitrary command execution

The espeak-ruby gem before 1.0.3 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a string to the speak, save, bytes or byteswav method in lib/espeak/speech.rb...

Buffer overflow

Buffer Overflow vulnerability in Ayukov NFTPD 2.0 and earlier allows remote attackers to execute arbitrary code...

CVE-2017-15222

Buffer Overflow vulnerability in Ayukov NFTPD 2.0 and earlier allows remote attackers to execute arbitrary code...

Logitech Media Server DOM Based XSS Vulnerability

Logitech Media Server is prone to a dom based cross site scripting vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Command injection

The codem-transcode module before 0.5.0 for Node.js, when ffprobe is enabled, allows remote attackers to execute arbitrary commands via a POST request to /probe...

CVE-2013-7377

The codem-transcode module before 0.5.0 for Node.js, when ffprobe is enabled, allows remote attackers to execute arbitrary commands via a POST request to /probe...

CVE-2017-12796

The Reporting Compatibility Add On before 2.0.4 for OpenMRS, as distributed in OpenMRS Reference Application before 2.6.1, does not authenticate users when deserializing XML input into ReportSchema objects. The result is that remote unauthenticated users are able to execute operating system...

IrfanView CADImage plugin buffer overflow vulnerability (CNVD-2017-33228)

IrfanView is an image viewer developed by Irfan Skiljan, a software developer from Bosnia and Herzegovina, which supports image browsing, image editing, image format conversion, etc. CADImage plugin is one of the plugins for viewing CAD files. A buffer overflow vulnerability exists in version...

GLSA-201710-22 : Adobe Flash Player: Remote execution of arbitrary code

The remote host is affected by the vulnerability described in GLSA-201710-22 Adobe Flash Player: Remote execution of arbitrary code A critical type confusion vulnerability was discovered in Adobe Flash Player. Impact : A remote attacker could execute arbitrary code. Workaround : There is no known...

AVTech Multiple Vulnerabilities

The remote AVTech device is affected by multiple vulnerabilities. Depending on the firmware version the vulnerabilities may include: - All user passwords are stored in cleartext - The web interface does not use CSRF protections - An attacker is able to perform arbitrary HTTP requests through the...

Adobe Flash Player: Remote execution of arbitrary code

Background The Adobe Flash Player is a renderer for the SWF file format, which is commonly used to provide interactive websites. Description A critical type confusion vulnerability was discovered in Adobe Flash Player. Impact A remote attacker could execute arbitrary code. Workaround There is no...

‘IOTroop’ Botnet Could Dwarf Mirai in Size and Devastation, Says Researcher

A botnet, which is adding new bots every day, has already infected one million businesses during the past month and could easily eclipse the size and devastation caused by Mirai. The malware and botnet, dubbed IOTroop, was spotted in September by researchers at Check Point who warn that 60 percen...

Sync Breeze Enterprise 10.1.16 - POST Remote Buffer Overflow

Sync Breeze Enterprise 10.1.16 - POST Remote Buffer Overflow !/usr/bin/python import socket try: print "\nSending evil buffer..." shellcode = "\xba\x31\x13\x39\xe4\xdb\xd3\xd9\x74\x24\xf4\x5e\x33\xc9\xb1" "\x52\x31\x56\x12\x03\x56\x12\x83\xdf\xef\xdb\x11\xe3\xf8\x9e"...

Juniper Junos Remote Execution Vulnerability (JSA10818)

According to its self-reported version number, the remote Junos device is affected by a vulnerability in the pluggable authentication module PAM of Juniper Networks Junos OS that may allow an unauthenticated network based attacker to potentially execute arbitrary code or crash daemons such as...

WordPress Store Locator Plugin SQL Injection Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language , the platform supports PHP and MySQL servers to set up a personal blog site . Store Locator plugin is one of the store locator plugin . A SQL injection vulnerability exists in WordPress Sto...

Axis SSI - Remote Command Execution / Read Files

STX Subject: SSI Remote Execute and Read Files Researcher: bashis August 2016 Release date: October, 2017 Old stuff that I've forgotten, fixed Q3/2016 by Axis Attack Vector: Remote Authentication: Anonymous no credentials needed Conditions: The cam must be configure to allow anonymous view Execut...

CVE-2017-12271

CVE-2017-12271 affects Cisco SPA300 and SPA500 Series IP Phones. The issue is a lack of cross-site request forgery (CSRF) protection in the web interface, allowing an unauthenticated, remote attacker to trigger unwanted actions by tricking a user into executing an adverse action. Documented impac...

UBUNTU-CVE-2017-7098

An issue was discovered in certain Apple products. iOS before 11 is affected. Safari before 11 is affected. iCloud before 7.0 on Windows is affected. iTunes before 12.7 on Windows is affected. tvOS before 11 is affected. The issue involves the "WebKit" component. It allows remote attackers to...