Design/Logic Flaw

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.6.0.25114. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Joomla Object Injection

Added: 10/24/2019 Background Joomla is a content management system written in PHP. Problem An object injection vulnerability in Joomla could allow a remote, unauthenticated attacker to execute arbitrary commands on the server. This vulnerability has been nicknamed "Rusty Joomla". Resolution Upgra...

YouPHPTube Encoder Operating System Command Injection Vulnerability

YouPHPTube is a PHP-based video website system.YouPHPTube Encoder is one of the encoders. An operating system command injection vulnerability exists in the 'base64Url' parameter of the /objects/getSpiritsFromVideo.php file in YouPHPTube Encoder version 2.3. The vulnerability arises when a network...

CVE-2019-15065

CVE-2019-15065 affects Chunghwa HiNet GPON firmware prior to I040GWR190731. A service hosted on port 6998 allows an attacker to execute commands to read arbitrary files, enabling high-severity impact (CVSS 3.0 base 9.3). Affected target: HiNet GPON firmware

CVE-2019-13657

CA Performance Management 3.5.x, 3.6.x before 3.6.9, and 3.7.x before 3.7.4 have a default credential vulnerability that can allow a remote attacker to execute arbitrary commands and compromise system security...

jackson-databind: improper polymorphic deserialization of types from Jodd-db library

A vulnerability was discovered in jackson-databind where it would permit deserialization of a malicious object using Jodd DB connection classes when using DefaultTyping. An attacker could use this flaw to achieve remote code execution under certain circumstances...

tika: Command injection in tika-server can allow remote attackers to execute arbitrary commands via crafted headers

From Apache Tika versions 1.7 to 1.17, clients could send carefully crafted headers to tika-server that could be used to inject commands into the command line of the server running tika-server. This vulnerability only affects those running tika-server on a server that is open to untrusted clients...

Adobe Acrobat and Reader Use After Free (APSB19-49: CVE-2019-8192)

A use-after-free vulnerability exists in Adobe Acrobat and Reader. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Adobe Acrobat and Reader Type Confusion (APSB19-49: CVE-2019-8200)

A type confusion vulnerability exists in Adobe Acrobat and Reader. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

CVE-2019-13392

A reflected Cross-Site Scripting XSS vulnerability in MindPalette NateMail 3.0.15 allows an attacker to execute remote JavaScript in a victim's browser via a specially crafted POST request. The application will reflect the recipient value if it is not in the NateMail recipient array. Note that th...

Cross site scripting

A reflected Cross-Site Scripting XSS vulnerability in MindPalette NateMail 3.0.15 allows an attacker to execute remote JavaScript in a victim's browser via a specially crafted POST request. The application will reflect the recipient value if it is not in the NateMail recipient array. Note that th...

ReportLab Code Execution Vulnerability

ReportLab is an open source engine for creating data-driven PDF documents and custom vector graphics. A code execution vulnerability exists in ReportLab 3.5.26 and earlier versions that can be exploited by remote attackers to execute code...

cPanel Command Injection Vulnerability (CNVD-2019-36142)

cPanel is a set of Web-based automated colocation platform from the US-based cPanel. The platform is primarily used to automate the management of websites and servers. A command injection vulnerability exists in cPanel versions prior to 11.54.0.4. The vulnerability stems from a network system or...

CVE-2019-13392

A reflected Cross-Site Scripting XSS vulnerability in MindPalette NateMail 3.0.15 allows an attacker to execute remote JavaScript in a victim's browser via a specially crafted POST request. The application will reflect the recipient value if it is not in the NateMail recipient array. Note that th...

EUVD-2019-4886

A reflected Cross-Site Scripting XSS vulnerability in MindPalette NateMail 3.0.15 allows an attacker to execute remote JavaScript in a victim's browser via a specially crafted POST request. The application will reflect the recipient value if it is not in the NateMail recipient array. Note that th...

CVE-2019-17408

parserIfLabel in inc/zzztemplate.php in ZZZCMS zzzphp 1.7.3 allows remote attackers to execute arbitrary code because the dangerkey function can be bypassed via manipulations such as strtr...

Linux kernel input validation error vulnerability (CNVD-2019-38515)

Linux kernel is the kernel used by Linux, the open source operating system released by the Linux Foundation in the United States. A security vulnerability exists in the net/ipv6/ip6mr.c file in Linux kernel versions prior to 4.11. An attacker could exploit this vulnerability to execute arbitrary...

Softing uaGate SI Command Injection Vulnerability

Softing uaGate SI is a compact industrial gateway product from Softing Germany. A command injection vulnerability exists in the CGI script in Softing uaGate SI version 1.60.01, which can be exploited by an attacker to execute illegal commands...

SUSE-SU-2019:1212-2 Security update for jakarta-commons-fileupload

This update for jakarta-commons-fileupload fixes the following issue: Security issue fixed: - CVE-2016-1000031: Fixed remote execution bsc1128963, bsc1128829...

Cisco Identity Services Engine Cross-Site Scripting Vulnerability (CNVD-2019-36625)

Cisco Identity Services Engine ISE is an identity-based environment awareness platform ISE Identity Services Engine from Cisco. The platform collects real-time information from the network, users and devices, and develops and enforces policies to regulate the network. A cross-site scripting...