MiniShare 1.4.1 HEAD method buffer overflow

Added: 12/21/2018 Background MiniShare is a Windows program that allows sharing of files without additional services or software. Problem MiniShare 1.4.1 and earlier allows remote attackers to execute arbitrary code via a long HTTP HEAD request. Resolution MiniShare is deprecated. References...

CVE-2018-19239

TRENDnet TEW-673GRU v1.00b40 devices have an OS command injection vulnerability in the startarpping function of the timer binary, which allows remote attackers to execute arbitrary commands via three parameters dhcpdstart, dhcpdend, and lanipaddr passed to the apply.cgi binary through a POST...

UBUNTU-CVE-2018-1160

Netatalk before 3.1.12 is vulnerable to an out of bounds write in dsiopensess.c. This is due to lack of bounds checking on attacker controlled data. A remote unauthenticated attacker can leverage this vulnerability to achieve arbitrary code execution...

CVE-2018-1000885

PHKP version including commit 88fd9cfdf14ea4b6ac3e3967feea7bcaabb6f03b contains a Command Injection vulnerability in function pgp_exec() phkp.php:98. The flaw potentially allows remote command execution or manipulation of gpg-keys, and is exploitable via the HKP-Api endpoint /pks/lookup?search. A...

CVE-2018-1000885

PHKP version including commit 88fd9cfdf14ea4b6ac3e3967feea7bcaabb6f03b contains a Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability in function pgpexec phkp.php:98 that can result in It is possible to manipulate gpg-keys or execute commands remotely...

Input validation

The Miss Marple Updater Service in COMPAREX Miss Marple Enterprise Edition before 2.0 allows remote attackers to execute arbitrary code with SYSTEM privileges via vectors related to missing update validation...

CVE-2018-8653

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine Memory Corruption Vulnerability." This affects Internet Explorer 9, Internet Explorer 11, Internet Explorer 10. This CVE ID is unique from...

CVE-2018-6669

A whitelist bypass vulnerability in McAfee Application Control / Change Control 7.0.1 and before allows a remote or local user to execute blacklisted files through an ASP.NET form...

LibVNC Out-of-Bounds Write Vulnerability

LibVNC is a cross-platform C library for implementing VNC server and client functionality. An out-of-bounds write vulnerability exists in the server code of the File Transfer extension in previous versions of LibVNC commit 502821828ed00b4a2c4bef90683d0fd88ce495de. A remote attacker can exploit th...

CVE-2018-20300

Empire CMS 7.5 allows remote attackers to execute arbitrary PHP code via the ftemp parameter in an enews=EditMemberForm action because this code is injected into a memberform.$fid.php file...

PT-2020-6621 · Gpac +1 · Gpac +1

Name of the Vulnerable Software and Affected Versions: gpac versions prior to 20200801 Description: The issue is related to a stack-buffer-overflow in the DumpRawUIConfig function located in the odf dump.c file of the GPAC multimedia platform. This allows a remote attacker to access confidential...

UBUNTU-CVE-2018-19789

An issue was discovered in Symfony 2.7.x before 2.7.50, 2.8.x before 2.8.49, 3.x before 3.4.20, 4.0.x before 4.0.15, 4.1.x before 4.1.9, and 4.2.x before 4.2.1. When using the scalar type hint string in a setter method e.g. setNamestring $name of a class that's the dataclass of a form, and when a...

WordPress Snap Creek Duplicator Code Injection (CVE-2018-17207)

An exploitable remote code execution vulnerability exists in WordPress Duplicator server. A WordPress plugin Snap Creek Duplicator restores a backup, resulting in remote code execution. An attacker can send a single authenticated HTTP request to trigger this vulnerability...

TRENDnet TEW-673GRU Command Injection Vulnerability

The TRENDnet TEW-673GRU is a dual-band green router. A command injection vulnerability exists in the TRENDnet TEW-673GRU. This allows remote attackers to inject commands via a POST request passed to the . .cgi binary file with three parameters dhcpdstart, dhcpdend, and lanipaddr to execute...

Adobe Acrobat Pro DC HTML2PDF HTML Parsing Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Adobe Acrobat Pro DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing...

Google Go Remote Code Execution Vulnerability

Google Go is a programming language optimized for programming applications on multiprocessor systems by Google. A remote code execution vulnerability exists in the 'go get' command in Google Go versions prior to 1.10.6 and 1.11.x prior to 1.11.3 GOPATH mode, which can be exploited by a remote...

Crypto currency mining machine using Elasticsearch vulnerability propagation-vulnerability warning-the black bar safety net

ElasticSearch is based on Lucene search server. It provides a distributed multi-user capability of the full-text search engine, based on the RESTful web interface. Elasticsearch is developed in Java, and as the Apache license under the terms of the open source release, is the current popular...

WebDAV Server Serving DLL

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Serve DLL via webdav server', 'Description' = %q This module simplifies the rundll32.exe Application Whitelisting Bypass technique. The module...

CVE-2018-11458

A vulnerability has been identified in SINUMERIK 828D V4.7 All versions V4.7 SP6 HF1, SINUMERIK 840D sl V4.7 All versions V4.7 SP6 HF5, SINUMERIK 840D sl V4.8 All versions V4.8 SP3. The integrated VNC server on port 5900/tcp of the affected products could allow a remote attacker to execute code...

CVE-2018-11458

A vulnerability has been identified in SINUMERIK 828D V4.7 All versions V4.7 SP6 HF1, SINUMERIK 840D sl V4.7 All versions V4.7 SP6 HF5, SINUMERIK 840D sl V4.8 All versions V4.8 SP3. The integrated VNC server on port 5900/tcp of the affected products could allow a remote attacker to execute code...