CVE-2019-19117

/usr/lib/lua/luci/controller/admin/autoupgrade.lua on PHICOMM K2PSG1218 V22.5.9.163 devices allows remote authenticated users to execute any command via shell metacharacters in the cgi-bin/luci autoUpTime parameter...

Sensio Labs Symfony Code Injection Vulnerability

Sensio Labs Symfony is a free French Sensio Labs , based on the MVC architecture of the PHP development framework . The framework provides commonly used functional components and tools , can be used to quickly create complex WEB program . A code injection vulnerability exists in Sensio Labs Symfo...

xstream: remote code execution due to insecure XML deserialization (regression of CVE-2013-7285)

It was found that xstream API version 1.4.10 introduced a regression for a previous deserialization flaw. If the security framework has not been initialized, it may allow a remote attacker to run arbitrary shell commands when unmarshalling XML or any supported format. This a regression of...

CVE-2019-18929

Western Digital My Cloud EX2 Ultra firmware 2.31.183 allows web users including guest accounts to remotely execute arbitrary code via a downloadmgr.cgi stack-based buffer overflow...

Apache Flink JAR Upload Java Code Execution

This module uses job functionality in Apache Flink dashboard web interface to upload and execute a JAR file, leading to remote execution of arbitrary Java code as the web server user. This module has been tested successfully on Apache Flink versions: 1.9.3 on Ubuntu 18.04.4; 1.11.2 on Ubuntu...

CVE-2019-1397

A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest operating system, aka 'Windows Hyper-V Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1389, CVE-2019-1398...

CVE-2019-1406

A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'...

Optergy 2.3.0a Remote Root

!/usr/bin/env python -- coding: utf8 -- Authenticated File Upload in Optergy gaining Remote Root Code Execution Firmware version: =2.3.0a CVE: CVE-2019-7274 Advisory: https://applied-risk.com/resources/ar-2019-008 Paper: https://applied-risk.com/resources/i-own-your-building-management-system...

The vulnerabilities of PDF viewing and editing programs like Adobe Acrobat Document Cloud and Adobe Acrobat Reader Document Cloud, as well as Adobe Acrobat 2017 and Adobe Acrobat Reader 2017, are related to memory usage after it is freed. This allows attackers to execute arbitrary code.

The vulnerabilities of PDF viewing and editing programs such as Adobe Acrobat Document Cloud, Adobe Acrobat Reader Document Cloud, Adobe Acrobat 2017, and Adobe Acrobat Reader 2017 are related to the use of memory after it is freed. Exploiting these vulnerabilities can allow an attacker to execut...

CVE-2019-17327

JEUS 7 Fix05 and JEUS 8Fix01 versions contains a directory traversal vulnerability caused by improper input parameter check when uploading installation file in administration web page. That leads remote attacker to execute arbitrary code via uploaded file...

Code Execution Vulnerability in Easoft Tianchuang Ranzhi Collaboration Office System

Ranz is a collaborative office system for small and medium-sized businesses. A code execution vulnerability exists in Easoft Tiantron's Ranzhi Collaboration Office System, which can be exploited by an attacker to store a maliciously-constructed payload into the database, and the system will execu...

GLSA-201911-02 : pump: User-assisted execution of arbitrary code

The remote host is affected by the vulnerability described in GLSA-201911-02 pump: User-assisted execution of arbitrary code It was discovered that there was an arbitrary code execution vulnerability in the pump DHCP/BOOTP client. Impact : A remote attacker, by enticing a user to connect to a...

CVE-2013-1751

TWiki before 5.1.4 allows remote attackers to execute arbitrary shell commands by sending a crafted '%MAKETEXT%' parameter value containing Perl backtick characters...

Command injection

TWiki before 5.1.4 allows remote attackers to execute arbitrary shell commands by sending a crafted '%MAKETEXT%' parameter value containing Perl backtick characters...

CVE-2013-1751

The CVE affects TWiki before 5.1.4. A crafted '%MAKETEXT{}%' parameter value containing Perl backtick characters allows remote attackers to execute arbitrary shell commands. The vulnerability is a command-injection in MAKETEXT handling, enabling remote code execution with the web server user priv...

[ASA-201911-9] linux-hardened: arbitrary code execution

Arch Linux Security Advisory ASA-201911-9 ========================================= Severity: Critical Date : 2019-11-07 CVE-ID : CVE-2019-17666 Package : linux-hardened Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1063 Summary ======= The package...

Memory Corruption Vulnerability in WebKit Component of Multiple Apple Products (CNVD-2019-41296)

Apple iOS and others are products of Apple Inc.Apple iOS is an operating system developed for mobile devices.Apple tvOS is a smart TV operating system.Apple iCloud for Windows is a cloud service based on the Windows platform. The product supports storage of music, photos, apps, contacts, etc...

PT-2019-18930 · Adobe · Magento

Name of the Vulnerable Software and Affected Versions: Magento versions 2.2 prior to 2.2.10 Magento versions 2.3 prior to 2.3.3 or 2.3.2-p1 Magento versions prior to 3.1.2 Description: A remote code execution vulnerability exists, allowing an authenticated user with privileges to modify product...

Cisco Video Communications Server Command Injection Vulnerability

Cisco Video Communications Server VCS is a video communications server for videoconferencing solutions from the U.S. company Cisco Cisco. A command injection vulnerability exists in Cisco VCS X versions prior to 7.0.3, which stems from the possibility that the program may fail to properly handle...

Node.js third-party modules: [meta-git] RCE via insecure command formatting

I would like to report a RCE issue in the meta-git module. It allows to execute arbitrary commands remotely inside the victim's PC Module module name: meta-git version: 1.1.2 npm page: https://www.npmjs.com/package/meta-git Module Description git plugin for meta Module Stats 60 downloads in the...