The vulnerability of the xpack.security.audit.enabled component of the Kibana data visualization service allows a perpetrator to execute arbitrary commands.

The vulnerability of the xpack.security.audit.enabled component of the Kibana data visualization service is related to insufficient validation of arguments passed to commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

CVE-2019-15599

A Code Injection exists in tree-kill on Windows which allows a remote code execution when an attacker is able to control the input into the command...

CVE-2019-15598

A Code Injection exists in treekill on Windows which allows a remote code execution when an attacker is able to control the input into the command...

[SECURITY] Fedora 31 Update: libssh-0.9.3-1.fc31

The ssh library was designed to be used by programmers needing a working SSH implementation by the mean of a library. The complete control of the client is made by the programmer. With libssh, you can remotely execute programs, tra nsfer files, use a secure and transparent tunnel for your remote...

Security Bulletin: Apache Commons FileUpload Vulnerabilities in IBM Control Center (CVE-2016-1000031)

Summary The DiskFileItem class in Apache Commons Fileupload before 1.3.3, as used in Control Center, could allow remote attackers to execute arbitrary code under current context of the current process causing an undefined behavior. Vulnerability Details CVEID: CVE-2016-1000031 Description: Apache...

The vulnerability of the implementation of diagnostic functions for ping and tracert in the microprogramming software of TP-Link TL-R600VPN allows a intruder to execute arbitrary code.

The vulnerability of the ping and tracert diagnostic functions in the microprogramming software for TP-Link TL-R600VPN implementations lies in the fact that the operation’s results are stored outside of the buffer in memory. Exploiting this vulnerability allows a remote attacker to execute...

The vulnerabilities of the functions cmd_sys_traceroute_exec(), cmd_sys_arp_clear(), and cmd_sys_ping_exec() in the libclicmd.so library of the Zyxel GS1900 router microsystem software allow a attacker to execute arbitrary commands.

The vulnerabilities of the functions cmdsystracerouteexec, cmdsysarpclear, and cmdsyspingexec in the libclicmd.so library of the Zyxel GS1900 router microsystem software exist due to insufficient checking of input data. Exploiting these vulnerabilities can allow an attacker to execute arbitrary...

Revive Adserver deserialization vulnerability

Added: 12/16/2019 CVE: CVE-2019-5434 Background Revive Adserver is a free, open source ad serving system. Problem A deserialization vulnerability in Revive Adserver allows remote attackers to execute arbitrary commands injected into the what parameter of the openads.spc RPC method of adxmlrpc.php...

CVE-2019-16730

This CVE (CVE-2019-16730) affects Petwant PF-103 firmware 4.22.2.42 and Petalk AI 3.2.2.30. The vulnerability resides in processCommandUpgrade() inside libcommon.so, which allows remote attackers to execute arbitrary system commands as root. The issue is network-exploitable, with high impact on c...

Amazon Blink XT2 Sync Module OS Command Injection Vulnerability (CNVD-2020-09706)

Blink XT2 Sync Module is a camera synchronization device. Amazon Blink XT2 Sync Module suffers from an operating system command injection vulnerability. The vulnerability arises from a network system or product not properly filtering special characters, commands, etc. from external input data...

Siemens SPPA-T3000 Application Server Improper Authentication Vulnerability (CNVD-2019-45373)

SPPA-T3000 is a distributed control system mainly used in thermal power plants and large-scale renewable energy power plants.Application Server is the application server in it, which provides the main system services including access control, distribution of data to thin clients and archiving. A...

Mozilla Thunderbird < 68.3

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 68.3. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2019-38 advisory. - Mozilla developers Christoph Diehl, Nathan Froyd, Jason Kratzer, Christian Holler, Karl Tomlinson, Tyson...

CVE-2019-3987

Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitized input when configuring the devices wifi configuration via the key parameter...

Design/Logic Flaw

Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitized input when configuring the devices wifi configuration via the bssid parameter...

Command injection

Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitized input when configuring the devices wifi configuration via the encryption parameter...

CVE-2019-3985

Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitized input when configuring the devices wifi configuration via the ssid parameter...

DEBIAN-CVE-2019-14889

A flaw was found with the libssh API function sshscpnew in versions before 0.9.3 and before 0.8.8. When the libssh SCP client connects to a server, the scp command, which includes a user-provided path, is executed on the server-side. In case the library is used in a way where users can influence...

CVE-2019-13735

Out of bounds write in JavaScript in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page...

Remote code execution

A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScript Remote Code Execution Vulnerability'...

Broadcom CA Nolio CVE-2019-19230 Deserialization Remote Code Execution Vulnerability

Description Broadcom CA Nolio is prone to a remote-code execution vulnerability. Successfully exploiting this issue allows attackers to execute arbitrary code in the context of the affected application. Failed exploits will result in denial-of-service conditions. Broadcom CA Nolio version 6.6 is...