Flash Operator Panel v2.31.03 - Command Execution

Document Title: =============== Flash Operator Panel v2.31.03 - Command Execution References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1907 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-5694 CVE-ID: ======= CVE-2018-5694 Release Date: =============...

GLSA-201801-03 : Chromium, Google Chrome: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201801-03 Chromium, Google Chrome: Multiple vulnerabilities Multiple vulnerabilities have been discovered in Chromium and Google Chrome. Please review the CVE identifiers referenced below for details. Impact : A remote attacker...

CVE-2017-16666

Xplico before 1.2.1 allows remote authenticated users to execute arbitrary commands via shell metacharacters in the name of an uploaded PCAP file. NOTE: this issue can be exploited without authentication by leveraging the user registration feature...

Advantech WebAccess cnvlgxtag Untrusted Pointer Dereference Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Advantech WebAccess. Authentication is not required to exploit this vulnerability. The specific flaw exists within the parsing of the command line in the cnvlgxtag utility. The issue results from t...

eLabFTW experiment infos component cross-site scripting vulnerability

Elabftw is an open source platform for hosting experimental data. The platform runs on Linux and supports storing a variety of objects. experiment infos component is one of the experiment infos storage components. A cross-site scripting vulnerability exists in the experiment infos component in...

b2evolution Remote PHP Code Execution Vulnerability

b2evolution is prone to a remote PHP code execution vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2017-1000496

Commsy version 9.0.0 is vulnerable to XXE attacks in the configuration import functionality resulting in denial of service and possibly remote execution of code...

Updated connman packages fix security vulnerability

Security consultants in NRI Secure Technologies discovered a stack overflow vulnerability in ConnMan. An attacker with control of the DNS responses to the DNS proxy in ConnMan might crash the service and, in same cases, remotely execute arbitrary commands in the host running the service...

Ruby on Rails SQL Injection Vulnerability (CNVD-2018-01349)

Ruby on Rails is a web application development framework written in the Ruby language. A SQL injection vulnerability exists in the 'where' method in Ruby on Rails 5.1.4 and earlier. A remote attacker can exploit this vulnerability to execute arbitrary SQL commands via the 'id' parameter...

UBUNTU-CVE-2017-17917

DISPUTED SQL injection vulnerability in the 'where' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the 'id' parameter. NOTE: The vendor disputes this issue because the documentation states that this method is not intended for use with...

CVE-2017-17919

SQL injection vulnerability in the 'order' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the 'id desc' parameter. NOTE: The vendor disputes this issue because the documentation states that this method is not intended for use with untrusted...

UBUNTU-CVE-2017-17916

DISPUTED SQL injection vulnerability in the 'findby' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the 'name' parameter. NOTE: The vendor disputes this issue because the documentation states that this method is not intended for use with...

DEBIAN-CVE-2017-17916

SQL injection vulnerability in the 'findby' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the 'name' parameter. NOTE: The vendor disputes this issue because the documentation states that this method is not intended for use with untrusted...

Buffer overflow

A buffer overflow vulnerability in NetTransport.exe in NetTransport Download Manager 2.96L and earlier could allow remote HTTP servers to execute arbitrary code on NAS devices via a long HTTP response...

CVE-2017-17968

A buffer overflow vulnerability in NetTransport.exe in NetTransport Download Manager 2.96L and earlier could allow remote HTTP servers to execute arbitrary code on NAS devices via a long HTTP response...

CVE-2017-17968

A buffer overflow vulnerability in NetTransport.exe in NetTransport Download Manager 2.96L and earlier could allow remote HTTP servers to execute arbitrary code on NAS devices via a long HTTP response...

ZKTeco ZKBioSecurity 3.0 Hardcoded Credentials Remote SYSTEM Code Execution

Summary ZKBioSecurity3.0 is the ultimate "All in One" web based security platform developed by ZKTeco. It contains four integrated modules: access control, video linkage, elevator control and visitor management. With an optimized system architecture designed for high level biometric identificatio...

Debian DLA-1224-1 : mercurial security update

A vulnerability was found in the Mercurial version control system which could lead to remote arbitrary code execution. CVE-2017-17458 A specially malformed Mercurial repository could cause Git subrepositories to run arbitrary code in the form of a .git/hooks/post-update script checked into the...

NetTransport 2.96L - Remote Buffer Overflow (DEP Bypass)

!/usr/bin/python Exploit Title: Buffer overflow in NetTransport Download Manager - Version 2.96L DEP Bypass CVE: CVE-2017-17968 Date: 28-12-2017 Software Link: http://xi-soft.com/downloads/NXSetupx86.zip Exploit Author: Author: Aloyce J. Makalanga Contact: https://twitter.com/aloycemjr Vendor...

PT-2017-15098 · Ruby +1 · Ruby On Rails +1

Name of the Vulnerable Software and Affected Versions: Ruby on Rails versions 5.1.4 and earlier Description: A SQL injection issue in the 'where' method allows remote attackers to execute arbitrary SQL commands via the id parameter. The vendor disputes this issue, citing that the method is not...