275 matches found
Security Bulletin: A vulnerability has been identified in IBM Spectrum Scale GUI where an unauthorised user can execute commands (CVE-2020-4348)
Summary A security vulnerability has been identified in all levels of IBM Spectrum Scale GUI that could allow an unauthorised user to execute commands . A fix for this vulnerability is available. Vulnerability Details CVEID: CVE-2020-4348 DESCRIPTION: IBM Spectrum Scale could allow an authenticat...
SUSE-SU-2020:1392-1 Security update for salt
This update for salt fixes the following issues: Security issues fixed: - CVE-2020-11651: Fixed the improper validation of method calls in salt-master, that could have allowed unauthenticated remote users to run arbitrary commands on salt minions bsc1170595. - CVE-2020-11652: Fixed an improper pa...
SAP Adaptive Server Enterprise SQL Injection Vulnerability (CNVD-2020-29750)
SAP Adaptive Server Enterprise is a relational database server from SAP. A SQL injection vulnerability exists in SAP Adaptive Server Enterprise. An attacker could exploit this vulnerability by executing specially crafted query statements to elevate privileges, modify database objects, or execute...
CyberArk PSMP 10.9.1 - Policy Restriction Bypass
Exploit Title: CyberArk PSMP 10.9.1 - Policy Restriction Bypass Google Dork: NA Date: 2020-02-25 Exploit Author: LAHBAL Said Vendor Homepage: https://www.cyberark.com/ Software Link: https://www.cyberark.com/ Version: PSMP = 11.1 Prerequisites Policy allows us to overwrite PSMRemoteMachine...
ASUS ZenFone 5Q Access Control Error Vulnerability (CNVD-2020-14785)
The ASUS ZenFone 5Q is a smartphone from Asus ASUS of Taiwan, China. An access control error vulnerability exists in the ASUS ZenFone 5Q. The vulnerability arises from a network system or product that does not properly restrict access to resources from unauthorized roles. An attacker could exploi...
ASUS ZenFone 4 Selfie Access Control Error Vulnerability (CNVD-2020-14727)
The ASUS ZenFone 4 Selfie is a smartphone from Asus ASUS of Taiwan, China. An access control error vulnerability exists in ASUS ZenFone 4 Selfie. The vulnerability arises from a network system or product that does not properly restrict access to resources from unauthorized roles. An attacker coul...
ASUS ZenFone 4 Selfie Access Control Error Vulnerability (CNVD-2020-14737)
The ASUS ZenFone 4 Selfie is a smartphone from Asus ASUS of Taiwan, China. An access control error vulnerability exists in ASUS ZenFone 4 Selfie. The vulnerability arises from a network system or product that does not properly restrict access to resources from unauthorized roles. An attacker coul...
ASUS ZenFone Max 4 Access Control Error Vulnerability (CNVD-2020-14732)
The ASUS ZenFone Max 4 is a smartphone from Asus ASUS of Taiwan, China. An access control error vulnerability exists in the ASUS ZenFone Max 4. The vulnerability arises from a network system or product that does not properly restrict access to resources from unauthorized roles. An attacker could...
Unspecified Vulnerability in ASUS ASUS_X015_1
The ASUS ASUSX0151 is a smartphone from Asus ASUS of Taiwan, China. Asus ASUSX0151 build fingerprint: asus/CNX015/ASUSX0151:7.0/NRD90M/CNX015-14.00.1709.35-20171215:user/release-keys has a security vulnerability in the com. A security vulnerability exists in the lovelyfont.defcontainer app. An...
CVE-2019-15419
The Asus ASUSX0151 Android device with a build fingerprint of asus/CNX015/ASUSX0151:7.0/NRD90M/CNX015-14.00.1709.35-20171215:user/release-keys contains a pre-installed app with a package name of com.lovelyfont.defcontainer app versionCode=5, versionName=5.0.1 that allows unauthorized command...
CVE-2019-15418
The Asus ASUSX00K1 Android device with a build fingerprint of asus/CNX00K/ASUSX00K1:7.0/NRD90M/CNX00K-14.01.1711.27-20180420:user/release-keys contains a pre-installed app with a package name of com.lovelyfont.defcontainer app versionCode=5, versionName=5.0.1 that allows unauthorized command...
Command injection
The Asus ASUSX0151 Android device with a build fingerprint of asus/CNX015/ASUSX0151:7.0/NRD90M/CNX015-14.00.1709.35-20171215:user/release-keys contains a pre-installed app with a package name of com.lovelyfont.defcontainer app versionCode=5, versionName=5.0.1 that allows unauthorized command...
CVE-2019-15419
Technical details about CVE-2019-15419 are not publicly provided in the connected documents. Monitor for updates and new disclosures before drawing conclusions on impact, affected components, or remediation.
CVE-2019-15418
The Asus ASUSX00K1 Android device with a build fingerprint of asus/CNX00K/ASUSX00K1:7.0/NRD90M/CNX00K-14.01.1711.27-20180420:user/release-keys contains a pre-installed app with a package name of com.lovelyfont.defcontainer app versionCode=5, versionName=5.0.1 that allows unauthorized command...
CVE-2019-15418
The CVE-2019-15418 entry concerns the ASUS_X00K_1 device running Android 7.0 with a pre-installed app (package com.lovelyfont.defcontainer, versionCode 5, versionName 5.0.1) that enables unauthorized command execution via a confused deputy attack. Affected component is the defcontainer app on the...
CVE-2019-16662
An issue was discovered in rConfig 3.9.2. An attacker can directly execute system commands by sending a GET request to ajaxServerSettingsChk.php because the rootUname parameter is passed to the exec function without filtering, which can lead to command execution...
CVE-2019-10969
Affected product: Moxa EDR 810 Series Secure Router (all versions 5.1 and prior). Vulnerability: CVE-2019-10969 is described as an improper input validation vulnerability in the CLI/ping feature that allows an authenticated attacker to execute unauthorized commands on the router, potentially resu...
WordPress Give SQL Injection Vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Give is one of the fundraising platform plugins used in it. A SQL injection vulnerability exists in WordPress Give. The vulnerability...
CVE-2019-10915
A vulnerability has been identified in TIA Administrator All versions V1.0 SP1 Upd1. The integrated configuration web application TIA Administrator allows to execute certain application commands without proper authentication. The vulnerability could be exploited by an attacker with local access t...