CVE-2016-5313

Symantec Web Gateway (SWG) is affected by CVE-2016-5313: before version 5.2.5, the management console contains a flaw in the web interface (notably the /spywall/new_whitelist.php script) that allows remote authenticated users to execute arbitrary OS commands due to improper whitelist validation. ...

Adobe Flash Player Security Update (APSB17-10) - Linux

Adobe Flash Player is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:adobe:flashplayer";...

Microsoft Office Word OLE Object Code Execution Vulnerability

Microsoft Office is a popular office software suite developed by Microsoft. A code execution vulnerability exists in the Microsoft Office Word OLE object, which can be exploited by an attacker to obtain permission to remotely execute arbitrary code, covertly install a variety of malware, and infe...

Design/Logic Flaw

Synology Photo Station before 6.3-2958 allows remote authenticated guest users to execute arbitrary commands via shell metacharacters in the X-Forwarded-For HTTP header to photo/login.php...

The vulnerability of the Adobe Reader PDF viewer program allows a hacker to execute arbitrary code.

The vulnerability of the Adobe Reader PDF viewer program arises from an operation that goes beyond the buffer boundaries in memory within the rendering system. Exploiting this vulnerability allows a malicious actor to execute arbitrary code memory corruption remotely...

SquirrelMail Remote Code Execution Vulnerability

SquirrelMail is a PHP-based WEB mail service program . A remote code execution vulnerability exists in SquirrelMail 1.4.22 and earlier versions, which allows an attacker to inject specific parameters into a malicious Sendmail configuration file when using Sendmail, and then upload it as an...

MS IIS 6.0 Buffer Overflow NSE Script

local nmap = require "nmap" local string = require "string" local shortport = require "shortport" local vulns = require "vulns" -- NSE Buffer Overflow vulnerability in IIS description = Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services IIS...

Foxit Reader Heap Buffer Overflow Vulnerability

Foxit Reader is a small PDF document viewer and printing program. A heap buffer overflow vulnerability exists in the CreateFXPDFConvertor function of ConvertToPdfx86.dll in Foxit Reader version 7.3.4.311, which can be exploited by remote attackers to execute arbitrary code...

Code injection

GMV Checker ATM Security prior to 5.0.18 allows remote authenticated users to execute arbitrary code via unspecified vectors, aka PT-2017-03...

Remote Command Execution Vulnerability in iGuardian Security Guardian

iGuardian is a router-based application embedded in the Linux operating system, with Snort an intrusion detection system as an embedded command-and-control system. A remote command execution vulnerability exists in the iGuardian Security/apps/login.php file. This allows an attacker to remotely...

Gazelle cross-site scripting vulnerability (CNVD-2017-05135)

Gazelle is a set of web frameworks for BitTorrent trackers. A cross-site scripting vulnerability exists in versions of Gazelle prior to 2017-03-19 that stems from the program failing to adequately filter the torrents and size parameters. A remote attacker could use this vulnerability to execute...

CVE-2017-7447

HelpDEZk 1.1.1 has CSRF in admin/home/logos/ with an impact of remote execution of arbitrary PHP code...

Code injection

HelpDEZk 1.1.1 has CSRF in admin/home/logos/ with an impact of remote execution of arbitrary PHP code...

CVE-2017-7447

HelpDEZk 1.1.1 has CSRF in admin/home/logos/ with an impact of remote execution of arbitrary PHP code...

CVE-2017-7447

CVE-2017-7447 affects HelpDEZk 1.1.1, with CSRF in the admin path (admin/home#/logos/) that can lead to remote execution of arbitrary PHP code. The vulnerability is documented across multiple sources (NVD/NVD-linked records, CNVD, CVE listings, and exploitation records), and exploit references in...

CVE-2017-7447

HelpDEZk 1.1.1 has CSRF in admin/home/logos/ with an impact of remote execution of arbitrary PHP code...

CVE-2016-10229

udp.c in the Linux kernel before 4.5 allows remote attackers to execute arbitrary code via UDP traffic that triggers an unsafe second checksum calculation during execution of a recv system call with the MSGPEEK flag...

Schneider Electric Interactive Graphical SCADA System Software

CVSS v3 6.8 ATTENTION: Remotely exploitable/low skill level to exploit. Vendor: Schneider Electric Equipment: Interactive Graphical SCADA System IGSS Software Vulnerability: DLL Hijacking AFFECTED PRODUCTS Schneider Electric reports that the vulnerability affects the following IGSS HMI desktop...

CVE-2017-7410

Multiple SQL injection vulnerabilities in account/signup.php and account/signup2.php in WebsiteBaker 2.10.0 and earlier allow remote attackers to execute arbitrary SQL commands via the 1 username, 2 displayname parameter...

elasticsearch: remote code execution via Groovy sandbox bypass

It was reported that Elasticsearch versions 1.3.0-1.3.7 and 1.4.0-1.4.2 have vulnerabilities in the Groovy scripting engine. The vulnerability allows an attacker to construct Groovy scripts that escape the sandbox and execute shell commands as the user running the Elasticsearch Java VM...