EulerOS 2.0 SP3 : texlive (EulerOS-SA-2019-2062)

According to the version of the texlive packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - TeX Live allows remote attackers to execute arbitrary commands by leveraging inclusion of mpost in shellescapecommands in the texmf.cnf config...

Code injection

joyplus-cms 1.6.0 allows remote attackers to execute arbitrary PHP code via /install by placing the code in the name of an object in the database...

CVE-2019-16665

An issue was discovered in ThinkSAAS 2.91. There is XSS via the content to the index.php?app=group&ac=comment&ts=do&js=1 URI, as demonstrated by a crafted SVG document in the SRC attribute of an EMBED element...

ruby: Command injection vulnerability in Net::FTP

It was discovered that the Net::FTP module did not properly process filenames in combination with certain operations. A remote attacker could exploit this flaw to execute arbitrary commands by setting up a malicious FTP server and tricking a user or Ruby application into downloading files with...

The vulnerability of the SECURITY DEFINER function in the PostgreSQL database management system allows a hacker to execute arbitrary SQL commands.

The vulnerability of the SECURITY DEFINER function in the PostgreSQL database management system is related to the lack of protective measures for SQL query structures. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL commands remotely...

Siemens SCALANCE SC-600 Command Injection Vulnerability

The Siemens SCALANCE SC-600 is an industrial security device from Siemens, Germany. It is designed to protect devices and networks in the discrete manufacturing and process industries and protects industrial communications through mechanisms such as stateful packet inspection firewalls SPI...

Advantech WebAccess

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION : Exploitable remotely/low skill level to exploit Vendor : Advantech Equipment : WebAccess Vulnerabilities : Code Injection, Command Injection, Stack-based Buffer Overflow, Improper Authorization 2. RISK EVALUATION Successful exploitation of these...

Pulse Connect Secure Cross-Site Scripting (CVE-2019-11507)

A cross-site scripting vulnerability exists in Pulse Secure SSL VPN. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary commands on the affected system...

The vulnerability of the Remote Desktop Client on Windows operating systems allows a hacker to execute arbitrary code.

The vulnerability of the Remote Desktop Client for Windows operating systems exists due to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Generic Zip Slip Traversal

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'rex/zip' class MetasploitModule "Generic Zip Slip Traversal Vulnerability", 'Description' = %q This is a generic arbitrary file overwrite technique, which...

CVE-2019-1208

A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScript Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1236...

Heap overflow

Delta Electronics TPEditor, Versions 1.94 and prior. Multiple heap-based buffer overflow vulnerabilities may be exploited by processing specially crafted project files, which may allow an attacker to remotely execute arbitrary code...

Delta Industrial Automation TPEditor TPE File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Delta Industrial Automation TPEditor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists with...

CVE-2019-10891

An issue was discovered in D-Link DIR-806 devices. There is a command injection in function hnapmain, which calls system without checking the parameter that can be controlled by user, and finally allows remote attackers to execute arbitrary shell commands with a special HTTP header...

CVE-2019-10891

CVE-2019-10891 affects D-Link DIR-806 devices. The issue is a command injection in the hnap_main function where system() is called with a parameter controllable by the user, enabling remote attackers to execute arbitrary shell commands via a special HTTP header. The CVE is rated critical (CVSS 3....

CVE-2019-9855

LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the document it is launched from. LibreOffice also has a feature where documents can specify that pre-installed scripts can be executed on...

CVE-2019-13656

An access vulnerability in CA Common Services DIA of CA Technologies Client Automation 14 and Workload Automation AE 11.3.5, 11.3.6 allows a remote attacker to execute arbitrary code...

Command injection

Nagios XI before 5.6.6 allows remote command execution as root. The exploit requires access to the server as the nagios user, or access as the admin user via the web interface. The getprofile.sh script, invoked by downloading a system profile profile.php?cmd=download, is executed as root via a...

CVE-2019-10677

Multiple Cross-Site Scripting XSS issues in the web interface on DASAN Zhone ZNID GPON 2426A EU version S3.1.285 devices allow a remote attacker to execute arbitrary JavaScript via manipulation of an unsanitized GET parameter: /zhndnsdisplay.cmd name, /wlsecrefresh.wl wlWscCfgMethod, wlwscreg...

Oracle Linux 7 : kernel (ELSA-2019-2600)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-2600 advisory. - netdrv brcmfmac: assure SSID length from firmware is limited Stanislaw Gruszka 1704879 1704880 CVE-2019-9500 - documentation Documentation: Add swapg...