CVE-2020-1446

A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory, aka 'Microsoft Word Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1447, CVE-2020-1448...

Remote code execution

A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Remote Code Execution Vulnerability'...

CVE-2020-4512

IBM QRadar SIEM 7.3 and 7.4 could allow a remote privileged user to execute commands...

CVE-2020-13925

Similar to CVE-2020-1956, Kylin has one more restful API which concatenates the API inputs into OS commands and then executes them on the server; while the reported API misses necessary input validation, which causes the hackers to have the possibility to execute OS command remotely. Users of all...

CVE-2020-13925

CVE-2020-13925 is a Kylin REST API command injection issue affecting 2.3.x through 3.1.0. The root cause is REST endpoints concatenating user input into OS commands, enabling remote command execution on vulnerable servers. The CVE is linked to CVE-2020-1956 disclosures describing similar REST‑bas...

CVE-2020-13925

Similar to CVE-2020-1956, Kylin has one more restful API which concatenates the API inputs into OS commands and then executes them on the server; while the reported API misses necessary input validation, which causes the hackers to have the possibility to execute OS command remotely. Users of all...

Tenda AC15 AC1900 Cross-Site Scripting Vulnerability

Tenda AC15 AC1900 is a wireless router from Tenda, a Chinese company. A cross-site scripting vulnerability exists in the /goform/WifiBasicSet endpoint in the Tenda AC15 AC1900 version 15.03.05.19, which can be exploited by remote attackers to execute JavaScript via the WifiName POST parameter...

Cross site scripting

An XSS issue in the /goform/WifiBasicSet endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute malicious payloads via the WifiName POST parameter...

Design/Logic Flaw

The goform/setUsbUnload endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute arbitrary system commands via the deviceName POST parameter...

CVE-2020-10987

The goform/setUsbUnload endpoint of Tenda AC15 AC1900 version 15.03.05.19 allows remote attackers to execute arbitrary system commands via the deviceName POST parameter...

Impress CMS 1.4.0 Code Execution / SQL Injection Vulnerabilities

Impress CMS version 1.4.0 has an issue where an authenticated user can make use of the AutoTask feature to execute php code, allowing for remote SQL injection and remote code execution. Author: AppleBois Homepage: https://sourceforge.net/projects/impresscms/ Affected Version: 1.4.0 Remote Code...

CVE-2020-5604

Android App 'Mercari' Japan version prior to version 3.52.0 allows arbitrary method execution of a Java object by a remote attacker via a Man-In-The-Middle attack by using Java Reflection API of JavaScript code on WebView...

Exploit for Path Traversal in F5 Big-Ip_Access_Policy_Manager

Cve-2020-5029-finder It is a small script to fetch out the s...

Barracuda Load Balancer Remote Code Execution (CVE-2017-6320)

A remote code execution vulnerability exists in Barracuda load balancer. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Google Android System Remote Code Execution Vulnerability (CNVD-2020-43680)

Android is a Linux-based open source operating system from Google and the Open Handset Alliance OHA in the U.S. System is one of the system components. A security vulnerability exists in Google Android System. The vulnerability can be exploited by a remote attacker to execute code...

SolarWinds Serv-U FTP Server Code Injection Vulnerability

SolarWinds Serv-U FTP Server is a set of U.S. SolarWinds FTP and MFT file transfer software. A security vulnerability exists in SolarWinds Serv-U FTP Server versions prior to 15.2.1. A remote attacker can exploit the vulnerability to execute commands...

CVE-2020-1425 - Windows Codecs Library RCE

A remote code execution in Windows Codecs Library has been fixed by Microsoft with out-of-band patch on 30th June 2020. The vulnerability allows attacker to remotely execute arbitrary code, if the victim opens maliciously crafted media file. Recent assessments: busterb at July 07, 2020 6:42pm UTC...

Apple Multiple Products Memory Corruption (CVE-2019-8672)

A memory corruption vulnerability exists in Apple. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

AnyDesk GUI Format String Write

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'AnyDesk GUI Format String Write', 'Description' = %q The AnyDesk GUI is vulnerable to a remotely exploitable format string vulnerability. By...

tomcat: Apache Tomcat AJP File Read/Inclusion Vulnerability

CVE-2020-1938 is a file read/inclusion vulnerability in the AJP connector in Apache Tomcat. This is enabled by default with a default configuration port of 8009. A remote, unauthenticated attacker could exploit this vulnerability to read web application files from a vulnerable server. In instance...