CVE-2016-7641

CVE-2016-7641 concerns WebKit in Apple ecosystems (iOS, Safari, iCloud, iTunes, etc.). The issue allows remote attackers to execute arbitrary code or cause a denial of service through a crafted website, via memory corruption in WebKit. Several connected advisories (SUSE/openSUSE patches) list thi...

PyCrypto: Remote execution of arbitrary code

Background The Python Cryptography Toolkit PyCrypto is a collection of both secure hash functions such as SHA256 and RIPEMD160, and various encryption algorithms AES, DES, RSA, ElGamal, etc.. Description A heap-based buffer overflow vulnerability has been discovered in PyCrypto. Please review the...

ALPINE-CVE-2016-10134

SQL injection vulnerability in Zabbix before 2.2.14 and 3.0 before 3.0.4 allows remote attackers to execute arbitrary SQL commands via the toggleids array parameter in latest.php...

ImageMagick: Multiple vulnerabilities

Background ImageMagick is a collection of tools and libraries for many image formats. Description Multiple vulnerabilities have been discovered in ImageMagick. Please review the CVE identifiers referenced below for details. Impact A remote attacker, by enticing a user to process a specially craft...

The vulnerability of the Android operating system, allowing a hacker to execute arbitrary code

The vulnerability of the HTC TouchScreen operating system’s driver is related to deficiencies in access control. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

UBUNTU-CVE-2017-2356

An issue was discovered in certain Apple products. iOS before 10.2.1 is affected. Safari before 10.0.3 is affected. iCloud before 6.1.1 is affected. iTunes before 12.5.5 is affected. tvOS before 10.1.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute...

CVE-2016-6077

IBM Cognos Disclosure Management 10.2 (affected: 10.2.0–10.2.6) contains CVE-2016-6077, where a crafted Macro in an exported CSV could cause Excel Macro execution on the client and potentially execute commands as a lower privileged user. Remediation: apply Cognos Disclosure Management 10.2.5 Inte...

GOsa Arbitrary Command Execution Vulnerability

GOsa is a set of LDAP front-end tools for managing users. A security vulnerability exists in the 'generatesmbnthash' function in the include/functions.inc file in GOsa. A remote attacker can exploit this vulnerability to execute arbitrary commands with the help of a specially crafted password...

Command injection

MCollective 2.7.0 and 2.8.x before 2.8.9, as used in Puppet Enterprise, allows remote attackers to execute arbitrary code via vectors related to the mco ping command...

CVE-2016-2788

MCollective 2.7.0 and 2.8.x before 2.8.9, as used in Puppet Enterprise, allows remote attackers to execute arbitrary code via vectors related to the mco ping command...

CVE-2016-2788

MCollective 2.7.0 and 2.8.x before 2.8.9, as used in Puppet Enterprise, allows remote attackers to execute arbitrary code via vectors related to the mco ping command...

CVE-2016-2788

MCollective 2.7.0 and 2.8.x before 2.8.9, as used in Puppet Enterprise, allows remote attackers to execute arbitrary code via vectors related to the mco ping command...

CVE-2015-8771

The generatesmbnthash function in include/functions.inc in GOsa allows remote attackers to execute arbitrary commands via a crafted password...

CVE-2015-8771

CVE-2015-8771 affects GOsa: the generate_smb_nt_hash function in include/functions.inc allows a remote attacker to execute arbitrary commands via a crafted password. Multiple connected sources (CNVD, OSS/OSV equivalents, Debian advisories, and NVD entry) corroborate the same issue. The vulnerabil...

GLSA-201702-05 : Lsyncd: Remote execution of arbitrary code

The remote host is affected by the vulnerability described in GLSA-201702-05 Lsyncd: Remote execution of arbitrary code default-rsyncssh.lua in Lsyncd performed insufficient sanitising of filenames. Impact : An attacker, able to control files processed by Lsyncd, could possibly execute arbitrary...

Lsyncd: Remote execution of arbitrary code

Background A daemon to synchronize local directories using rsync. Description default-rsyncssh.lua in Lsyncd performed insufficient sanitising of filenames. Impact An attacker, able to control files processed by Lsyncd, could possibly execute arbitrary code with the privileges of the process or...

CVE-2016-10190

Heap-based buffer overflow in libavformat/http.c in FFmpeg before 2.8.10, 3.0.x before 3.0.5, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 allows remote web servers to execute arbitrary code via a negative chunk size in an HTTP response...

Input validation

Multiple incomplete blacklist vulnerabilities in inc/core/class.dc.core.php in Dotclear before 2.8.2 allow remote authenticated users with "manage their own media items" and "manage their own entries and comments" permissions to execute arbitrary PHP code by uploading a file with a 1 .pht, 2 .php...

CVE-2015-6024

ping.cgi in NetCommWireless HSPA 3G10WVE wireless routers with firmware before 3G10WVE-L101-S306ETS-C01R05 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the DIAIPADDRESS parameter...

CVE-2016-10192

Heap-based buffer overflow in ffserver.c in FFmpeg before 2.8.10, 3.0.x before 3.0.5, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 allows remote attackers to execute arbitrary code by leveraging failure to check chunk size...