Adobe Flash 28.0.0.137 Remote Code Execution Exploit

Adobe Flash versions 28.0.0.137 and below remote code execution proof of concept exploit. !/usr/bin/env python coding: UTF-8 import BaseHTTPServer import sys from SimpleHTTPServer import SimpleHTTPRequestHandler print "@Syfi2k" print "+ CVE-2018-4878 poc " print "--------------------------------"...

CVE-2018-9247

The CVE-2018-9247 entry concerns Gxlcms QY v1.0.0713. The vulnerability is in the upsql function of \Lib\Lib\Action_Admin\DataAction.class.php, allowing remote attackers to execute arbitrary SQL via the sql parameter, and subsequently execute arbitrary PHP code by placing it after a

Memory corruption

An issue was discovered in certain Apple products. iOS before 11.3 is affected. Safari before 11.1 is affected. iCloud before 7.4 on Windows is affected. iTunes before 12.7.4 on Windows is affected. tvOS before 11.3 is affected. watchOS before 4.3 is affected. The issue involves the "WebKit"...

Vulnerability Spotlight: Moxa AWK-3131A Multiple Features Login Username Parameter OS Command Injection Vulnerability

This vulnerability is discovered by Patrick DeSantis and Dave McDaniel of Cisco Talos Today, Talos is disclosing TALOS-2017-0507 CVE-2017-14459, a vulnerability that has been identified in Moxa AWK-3131A industrial wireless access point. The Moxa AWK-3131A Industrial IEEE 802.11a/b/g/n wireless...

CVE-2018-4085

CVE-2018-4085 affects Apple devices via the QuartzCore component. A memory corruption issue in processing web content could allow remote code execution or cause a denial of service (application crash). Affected: iOS before 11.2.5, macOS before 10.13.3, tvOS before 11.2.5, watchOS before 4.2.2. Mi...

Moxa AWK-3131A Multiple Features Login Username Parameter OS Command Injection Vulnerability

Summary An exploitable OS Command Injection vulnerability exists in the Telnet, SSH, and console login functionality of Moxa AWK-3131A Industrial IEEE 802.11a/b/g/n wireless AP/bridge/client in firmware versions 1.4 to 1.7 current. An attacker can inject commands via the username parameter of...

Swisscom MySwisscomAssistant DLL Loading Vulnerability

Swisscom MySwisscomAssistant is a telecom network assistant program from Swisscom, Switzerland. The program helps to set up, maintain and manage the network. A security vulnerability exists in the handling of multiple DLLs files in Swisscom MySwisscomAssistant version 2.17.1.1065. A remote attack...

CVE-2017-11509

An authenticated remote attacker can execute arbitrary code in Firebird SQL Server versions 2.5.7 and 3.0.2 by executing a malformed SQL statement...

CVE-2018-8802

SQL injection vulnerability in the management interface in ePortal Manager allows remote attackers to execute arbitrary SQL commands via unspecified parameters...

Design/Logic Flaw

Philips IntelliSpace Portal all versions of 8.0.x, and 7.0.x have a vulnerability where code debugging methods are enabled, which could allow an attacker to remotely execute arbitrary code during runtime...

CVE-2018-5454

CVE-2018-5454 affects Philips IntelliSpace Portal (all 8.0.x and 7.0.x). Vulnerability: leftover code debugging methods enabled, enabling remote arbitrary code execution atRuntime. Root cause: enabled debugging/debug code in ISP components. Exploitation status varies across sources; some document...

ruby: Command injection vulnerability in Net::FTP

It was discovered that the Net::FTP module did not properly process filenames in combination with certain operations. A remote attacker could exploit this flaw to execute arbitrary commands by setting up a malicious FTP server and tricking a user or Ruby application into downloading files with...

OMRON CX-Supervisor SCS File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of OMRON CX-Supervisor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing ...

Code injection

IBM Tivoli Monitoring V6 6.2.3 and 6.3.0 could allow an unauthenticated user to remotely execute code through unspecified methods. IBM X-Force ID: 137034...

CVE-2017-1789

IBM Tivoli Monitoring V6 6.2.3 and 6.3.0 could allow an unauthenticated user to remotely execute code through unspecified methods. IBM X-Force ID: 137034...

Remote code execution

Gitlab Community and Enterprise Editions version 10.3.3 is vulnerable to an Insecure Temporary File in the project import component resulting remote code execution...

The vulnerability of the base64D function in the STMP listener component of the Exim mail server allows a attacker to execute arbitrary code.

The vulnerability of the base64 component of the STMP listener in the Exim mail server arises from buffer overflows during data processing, where the size of the buffer is not a multiple of 4 4n + 3. Exploiting this vulnerability allows an attacker, operating remotely, to execute arbitrary code...

Buffer overflow

In Eaton ELCSoft versions 2.04.02 and prior, there are multiple cases where specially crafted files could cause a buffer overflow which, in turn, may allow remote execution of arbitrary code...

CVE-2018-7511

In Eaton ELCSoft versions 2.04.02 and prior, there are multiple cases where specially crafted files could cause a buffer overflow which, in turn, may allow remote execution of arbitrary code...

Kentico SQL Injection Vulnerability

Kentico is the United States Kentico Software Corporation of a set of ASP.NET-based content management system CMS. The system consists of two main tools : Kentico CMS Desk is used to edit the content of the page ; Kentico CMS Controls is used to edit and control various elements of the page . An...