Windows SMBv3 Client/Server Remote Code Execution Vulnerability.


Remote Desktop Protocol Remote Code Execution Vulnerability.


HEIF Image Extensions Remote Code Execution Vulnerability.


JAI-EXT is an open-source project which aims to extend the Java Advanced Imaging (JAI) API. Programs allowing Jiffle script to be provided via network request can lead to a Remote Code Execution as the Jiffle script is compiled into Java code via Janino and executed. In particular this affects the downstream GeoServer project. Version 1.2.22 will contain a patch that disables the ability to inject malicious code into the resulting script. Users unable to upgrade may negate the ability to compile Jiffle scripts from the final application by removing janino-x.y.z.jar from the classpath.


Windows Kerberos Remote Code Execution Vulnerability.


Forms generated by JQueryForm.com before 2022-02-05 allow remote attackers to obtain the URI to any uploaded file by capturing the POST response. When chained with CVE-2022-24984 this could lead to unauthenticated remote code execution on the underlying web server. This occurs because the Unique ID field is contained in the POST response upon submitting a form.


Windows Server Service Remote Code Execution Vulnerability.


Windows Local Security Authority (LSA) Remote Code Execution Vulnerability.


Parse Server is an open source http web server backend. In versions prior to 4.10.7 there is a Remote Code Execution (RCE) vulnerability in Parse Server. This vulnerability affects Parse Server in the default configuration with MongoDB. The main weakness that leads to RCE is the Prototype Pollution vulnerable code in the file `DatabaseController.js` so it is likely to affect Postgres and any other database backend as well. This vulnerability has been confirmed on Linux (Ubuntu) and Windows. Users are advised to upgrade as soon as possible. The only known workaround is to manually patch your installation with code referenced at the source GHSA-p6h4-93qp-jhcm.


RiteCMS version 3.1.0 and below suffers from an arbitrary file overwrite via path traversal vulnerability in Admin Panel. Exploiting the vulnerability allows an authenticated attacker to overwrite any file in the web root (along with any other file on the server that the PHP process user has the proper permissions to write) resulting a remote code execution.


A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists that could cause modification of an existing file by adding at end of file or create a new file in the context of the Data Server potentially leading to remote code execution when an attacker sends a specially crafted message. Affected Product: Interactive Graphical SCADA System Data Server (V15.0.0.22020 and prior)


Windows

DNS

Server

Remote

Code

Execution

Vulnerability.

This

CVE

ID

is

unique

from


An attacker can abuse the batch-requests plugin to send requests to bypass the IP restriction of Admin API. A default configuration of Apache APISIX (with default API key) is vulnerable to remote code execution. When the admin key was changed or the port of Admin API was changed to a port different from the data panel the impact is lower. But there is still a risk to bypass the IP restriction of Apache APISIX's data panel. There is a check in the batch-requests plugin which overrides the client IP with its real remote IP. But due to a bug in the code this check can be bypassed.


Admin.php in HYBBS2 through 2.3.2 allows remote code execution because it writes plugin-related configuration information to conf.php.


Databasir is a team-oriented relational database model document management platform. Databasir 1.01 has remote code execution vulnerability. JDBC drivers are not validated prior to use and may be provided by users of the system. This can lead to code execution by any basic user who has access to the system. Users are advised to upgrade. There are no known workarounds to this issue.


wpsupdater.exe in Kingsoft WPS Office through 11.2.0.10382 allows remote code execution by modifying HKEY_CURRENT_USER in the registry.


The package ungit before 1.5.20 are vulnerable to Remote Code Execution (RCE) via argument injection. The issue occurs when calling the /api/fetch endpoint. User controlled values (remote and ref) are passed to the git fetch command. By injecting some git options it was possible to get arbitrary command execution.


Atom CMS v2.0 was discovered to contain a remote code execution (RCE) vulnerability via /admin/uploads.php.


Axeda agent (All versions) and Axeda Desktop Server for Windows (All versions) may allow an attacker to send certain commands to a specific port without authentication. Successful exploitation of this vulnerability could allow a remote unauthenticated attacker to obtain full file-system access and remote code execution.


Network Olympus version 1.8.0 allows an authenticated admin user to inject SQL queries in '/api/eventinstance' via the 'sqlparameter' JSON parameter. It is also possible to achieve remote code execution in the default installation (PostgreSQL) by exploiting this issue.


Obyte (formerly Byteball) Wallet before 3.4.1 allows XSS. A crafted chat message can lead to remote code execution.


SuiteCRM v7.11.23 was discovered to allow remote code execution via a crafted payload injected into the FirstName text field.


A CSRF issue in /api/crontab on iRZ Mobile Routers through 2022-03-16 allows a threat actor to create a crontab entry in the router administration panel. The cronjob will consequently execute the entry on the threat actor's defined interval leading to remote code execution allowing the threat actor to gain filesystem access. In addition if the router's default credentials aren't rotated or a threat actor discovers valid credentials remote code execution can be achieved without user interaction.


Seacms v11.6 was discovered to contain a remote code execution (RCE) vulnerability via the component /admin/weixin.php.


On 16.1.x versions prior to 16.1.2.2 and 15.1.x versions prior to 15.1.5.1 BIG-IP APM does not properly validate configurations allowing an authenticated attacker with high privileges to manipulate the APM policy leading to privilege escalation/remote code execution. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated


RG-NBR-E Enterprise Gateway RG-NBR2100G-E was discovered to contain a remote code execution (RCE) vulnerability via the fileName parameter at /guest_auth/cfg/upLoadCfg.php.


Gradle Enterprise before 2022.1 allows remote code execution if the installation process did not specify an initial configuration file. The configuration allows certain anonymous access to administration and an API.


Laravel 9.1.8 when processing attacker-controlled data for deserialization allows Remote Code Execution via an unserialize pop chain in __destruct in GuzzleHttp\\Cookie\\FileCookieJar.php.


Laravel

when

processing

attacker-controlled

data

for

deserialization

allows

Remote

Code

Execution

via

an

unserialize

pop

chain

in

in

and

dispatch($command)

in


Webmin through 1.991 when the Authentic theme is used allows remote code execution when a user has been manually created (i.e. not created in Virtualmin or Cloudmin). This occurs because settings-editor_write.cgi does not properly restrict the file parameter.


TP-Link TL-WDR7660 2.0.30 Mercury D196G 20200109_2.0.4 and Fast FAC1900R 20190827_2.0.2 routers have a stack overflow issue in `MmtAtePrase` function. Local users could get remote code execution.


Windows

DNS

Server

Remote

Code

Execution

Vulnerability.

This

CVE

ID

is

unique

from


Multiple improper input validation vulnerabilities exists in the libnvram.so nvram_import functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted file can lead to remote code execution. An attacker can send a sequence of requests to trigger this vulnerability.An improper input validation vulnerability exists in the `httpd`'s `user_define_print` function. Controlling the `user_define_timeout` nvram variable can lead to remote code execution.


Windows Fax Compose Form Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-26916 CVE-2022-26917.


Multiple improper input validation vulnerabilities exists in the libnvram.so nvram_import functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted file can lead to remote code execution. An attacker can send a sequence of requests to trigger this vulnerability.An improper input validation vulnerability exists in the `httpd`'s `user_define_init` function. Controlling the `user_define_timeout` nvram variable can lead to remote code execution.


Multiple improper input validation vulnerabilities exists in the libnvram.so nvram_import functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted file can lead to remote code execution. An attacker can send a sequence of requests to trigger this vulnerability.An improper input validation vulnerability exists in the `httpd`'s `user_define_set_item` function. Controlling the `user_define_timeout` nvram variable can lead to remote code execution.


In Pluck 4.7.16 an admin user can use the theme upload functionality at /admin.php?action=themeinstall to perform remote code execution.


DiskUsage.exe Remote Code Execution Vulnerability.


TP-Link TL-WDR7660 2.0.30 Mercury D196G 20200109_2.0.4 and Fast FAC1900R 20190827_2.0.2 routers have a stack overflow issue in `MntAte` function. Local users could get remote code execution.


Windows Address Book Remote Code Execution Vulnerability.


Windows Fax Compose Form Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-26916 CVE-2022-26918.


Windows Fax Compose Form Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-26917 CVE-2022-26918.


The BeanShell components of IRISNext through 9.8.28 allow execution of arbitrary commands on the target server by creating a custom search (or editing an existing/predefined search) of the documents. The search components permit adding BeanShell expressions that result in Remote Code Execution in the context of the IRISNext application user running on the web server.


O2OA v6.4.7 was discovered to contain a remote code execution (RCE) vulnerability via /x_program_center/jaxrs/invoke.


VMware Workspace ONE Access Identity Manager and vRealize Automation contain two remote code execution vulnerabilities (CVE-2022-22957 & CVE-2022-22958). A malicious actor with administrative access can trigger deserialization of untrusted data through malicious JDBC URI which may result in remote code execution.


A remote code execution vulnerability was discovered on Western Digital My Cloud devices where an attacker could trick a NAS device into loading through an unsecured HTTP call. This was a result insufficient verification of calls to the device. The vulnerability was addressed by disabling checks for internet connectivity using HTTP.


VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability due to server-side template injection. A malicious actor with network access can trigger a server-side template injection that may result in remote code execution.


A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar i.e. the default it is not vulnerable to the exploit. However the nature of the vulnerability is more general and there may be other ways to exploit it.


A limited authentication bypass vulnerability was discovered that could allow an attacker to achieve remote code execution and escalate privileges on the My Cloud devices. Addressed this vulnerability by changing access token validation logic and rewriting rule logic on PHP scripts.


An issue was discovered in OverIT Geocall before 8.0. An authenticated user who has the Test Trasformazione XSL functionality enabled can exploit a XSLT Injection vulnerability. Attackers could exploit this issue to achieve remote code execution.


Microsoft Office ClickToRun Remote Code Execution Vulnerability.


Cybonet

PineApp

Mail

Relay

Unauthenticated

Sql

Injection.

Attacker

can

send

a

request

to:

/manage/emailrichment/userlist.php?CUSTOMER_ID_INNER=1

/admin/emailrichment/userlist.php?CUSTOMER_ID_INNER=1

/manage/emailrichment/usersunlist.php?CUSTOMER_ID_INNER=1

/admin/emailrichment/usersunlist.php?CUSTOMER_ID_INNER=1

and

by

doing

that

the

attacker

can

run

Remote

Code

Execution

in

one

liner.


HotelDruid v3.0.3 was discovered to contain a remote code execution (RCE) vulnerability which is exploited via an attacker inserting a crafted payload into the name field under the Create New Room module.


In Spring Cloud Function versions 3.1.6 3.2.2 and older unsupported versions when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local resources.


An authenticated high privileged malicious actor with network access to the VMware Cloud Director tenant or provider may be able to exploit a remote code execution vulnerability to gain access to the server.


XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions it's possible for an unprivileged user to perform a remote code execution by injecting a groovy script in her own profile and by calling the Reset password feature since the feature is performing a save of the user profile with programming rights in the impacted versions of XWiki. The issue has been patched in XWiki 13.1RC1. There are two different possible workarounds each consisting of modifying the XWiki/ResetPassword page. 1. The Reset password feature can be entirely disabled by deleting the XWiki/ResetPassword page. 2. The script in XWiki/ResetPassword can also be modified or removed: an administrator can replace it with a simple email contact to ask an administrator to reset the password.


Windows Event Tracing Remote Code Execution Vulnerability.


SuiteCRM through 7.12.1 and 8.x through 8.0.1 allows Remote Code Execution. Authenticated users with access to the Scheduled Reports module can achieve this by leveraging PHP deserialization in the email_recipients property. By using a crafted request they can create a malicious report containing a PHP-deserialization payload in the email_recipients field. Once someone accesses this report the backend will deserialize the content of the email_recipients field and the payload gets executed. Project dependencies include a number of interesting PHP deserialization gadgets (e.g. Monolog/RCE1 from phpggc) that can be used for Code Execution.


Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-21972.


Microsoft Dynamics GP Remote Code Execution Vulnerability.


Sourcegraph is a code search and navigation engine. Sourcegraph prior to version 3.37 is vulnerable to remote code execution in the `gitserver` service. The service acts as a git exec proxy and fails to properly restrict calling `git config`. This allows an attacker to set the git `core.sshCommand` option which sets git to use the specified command instead of ssh when they need to connect to a remote system. Exploitation of this vulnerability depends on how Sourcegraph is deployed. An attacker able to make HTTP requests to internal services like gitserver is able to exploit it. This issue is patched in Sourcegraph version 3.37. As a workaround ensure that requests to gitserver are properly protected.


JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP service the attacker has access to. The attacker can provide a TopicConnectionFactoryBindingName configuration causing JMSSink to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-4104. Note this issue only affects Log4j 1.x when specifically configured to use JMSSink which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.


PublicCMS v4.0 was discovered to contain a remote code execution (RCE) vulnerability via the cmdarray parameter.


The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution (RCE) via argument injection when using git or mercurial repositories. Authenticated users can change the behavior of the application in an unintended way leading to command execution.


AXIS IP Utility before 4.18.0 allows for remote code execution and local privilege escalation by the means of DLL hijacking. IPUtility.exe would attempt to load DLLs from its current working directory which could allow for remote code execution if a compromised DLL would be placed in the same folder.


WikiDocs version 0.1.18 has an authenticated remote code execution vulnerability. An attacker can upload a malicious file using the image upload form through index.php.


Paint 3D Remote Code Execution Vulnerability.


HTTP Protocol Stack Remote Code Execution Vulnerability.


Windows Runtime Remote Code Execution Vulnerability.


Roaming Security Rights Management Services Remote Code Execution Vulnerability.


MMP: All versions prior to v1.0.3 PTP C-series: Device versions prior to v2.8.6.1 and PTMP C-series and A5x: Device versions prior to v2.5.4.1 does not perform proper authorization and authentication checks on multiple API routes. An attacker may gain access to these API routes and achieve remote code execution create a denial-of-service condition and obtain sensitive information.


DirectX Graphics Kernel Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-21898.


Remote Desktop Protocol Remote Code Execution Vulnerability.


pipenv is a Python development workflow tool. Starting with version 2018.10.9 and prior to version 2022.1.8 a flaw in pipenv's parsing of requirements files allows an attacker to insert a specially crafted string inside a comment anywhere within a requirements.txt file which will cause victims who use pipenv to install the requirements file to download dependencies from a package index server controlled by the attacker. By embedding malicious code in packages served from their malicious index server the attacker can trigger arbitrary remote code execution (RCE) on the victims' systems. If an attacker is able to hide a malicious `--index-url` option in a requirements file that a victim installs with pipenv the attacker can embed arbitrary malicious code in packages served from their malicious index server that will be executed on the victim's host during installation (remote code execution/RCE). When pip installs from a source distribution any code in the setup.py is executed by the install process. This issue is patched in version 2022.1.8. The GitHub Security Advisory contains more information about this vulnerability.


Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-23270.


Windows Security Center API Remote Code Execution Vulnerability.


Win32 Stream Enumeration Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-24534.


Windows IKE Extension Remote Code Execution Vulnerability.


Windows Geolocation Service Remote Code Execution Vulnerability.


Windows Modern Execution Server Remote Code Execution Vulnerability.


MMP: All versions prior to v1.0.3 PTP C-series: Device versions prior to v2.8.6.1 and PTMP C-series and A5x: Device versions prior to v2.5.4.1 does not perform proper authorization checks on multiple API functions. An attacker may gain access to these functions and achieve remote code execution create a denial-of-service condition and obtain sensitive information.


Windows Mobile Device Management Remote Code Execution Vulnerability.


DirectX Graphics Kernel Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-21912.


EMC RepliStor Server Service before ESA-09-003 has a DoASOCommand Remote Code Execution Vulnerability. The flaw exists within the DoRcvRpcCall RPC function -exposed via the rep_srv.exe process- where the vulnerability is caused by an error when the rep_srv.exe handles a specially crafted packet sent by an unauthenticated attacker.


A \Cisco WebEx Network Recording Player Remote Code Execution Vulnerability\ exists in Cisco WebEx Network Recording Player for Advanced Recording Format (ARF) and WebEx Recording Format (WRF) files. A remote attacker could exploit this by providing a user with a malicious ARF or WRF file via email or URL and convincing the user to launch the file. Exploitation of this could cause an affected player to crash and in some cases could allow arbitrary code execution on the system of a targeted user. Cisco Bug IDs: CSCve10584 CSCve10591 CSCve11503 CSCve10658 CSCve11507 CSCve10749 CSCve10744 CSCve11532 CSCve10762 CSCve10764 CSCve11538.


A \Cisco WebEx Network Recording Player Remote Code Execution Vulnerability\ exists in Cisco WebEx Network Recording Player for Advanced Recording Format (ARF) and WebEx Recording Format (WRF) files. A remote attacker could exploit this by providing a user with a malicious ARF or WRF file via email or URL and convincing the user to launch the file. Exploitation of this could cause an affected player to crash and in some cases could allow arbitrary code execution on the system of a targeted user. Cisco Bug IDs: CSCvf38060 CSCvg54836 CSCvf38077 CSCvg54843 CSCvf38084 CSCvg54850.


Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch although it uses Lucene is NOT vulnerable to this. Note that the XML external entity expansion vulnerability occurs in the XML Query Parser which is available by default for any query request with parameters deftype=xmlparser and can be exploited to upload malicious data to the /upload request handler or as Blind XXE using ftp wrapper in order to read arbitrary local files from the Solr server. Note also that the second vulnerability relates to remote code execution using the RunExecutableListener available on all affected versions of Solr.


Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser it is possible in Apache CouchDB before 1.7.0 and 2.x before 2.1.1 to submit _users documents with duplicate keys for 'roles' used for access control within the database including the special case '_admin' role that denotes administrative users. In combination with CVE-2017-12636 (Remote Code Execution) this can be used to give non-admin users access to arbitrary shell commands on the server as the database system user. The JSON parser differences result in behaviour that if two 'roles' keys are available in the JSON the second one will be used for authorising the document write but the first 'roles' key is used for subsequent authorization for the newly created user. By design users can not assign themselves roles. The vulnerability allows non-admin users to give themselves admin privileges.


A \Cisco WebEx Network Recording Player Remote Code Execution Vulnerability\ exists in Cisco WebEx Network Recording Player for Advanced Recording Format (ARF) and WebEx Recording Format (WRF) files. A remote attacker could exploit this by providing a user with a malicious ARF or WRF file via email or URL and convincing the user to launch the file. Exploitation of this could cause an affected player to crash and in some cases could allow arbitrary code execution on the system of a targeted user. Cisco Bug IDs: CSCvf49650 CSCvg54853 CSCvg54856 CSCvf49697 CSCvg54861 CSCvf49707 CSCvg54867.


A \Cisco WebEx Network Recording Player Remote Code Execution Vulnerability\ exists in Cisco WebEx Network Recording Player for Advanced Recording Format (ARF) and WebEx Recording Format (WRF) files. A remote attacker could exploit this by providing a user with a malicious ARF or WRF file via email or URL and convincing the user to launch the file. Exploitation of this could cause an affected player to crash and in some cases could allow arbitrary code execution on the system of a targeted user. Cisco Bug IDs: CSCvf57234 CSCvg54868 CSCvg54870.


In avrc_pars_vendor_cmd of avrc_pars_tg.cc there is a possible stack corruption due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 5.1.1 6.0 6.0.1 7.0 7.1.1 7.1.2 8.0 8.1. Android ID: A-69478941.


An Insufficient Entropy issue was discovered in LOYTEC LVIS-3ME versions prior to 6.2.0. The application does not utilize sufficiently random number generation for the web interface authentication mechanism which could allow remote code execution.


In the initDecoder function of SoftAVCDec there is a possible out-of-bounds write to mCodecCtx due to a use after free when buffer allocation fails. This could lead to remote code execution as a privileged process with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 6.0.1 7.0 7.1.1 7.1.2 8.0 8.1. Android ID: A-66969281.


In receive_packet of libnetutils/packet.c there is a possible out-of-bounds write due to a missing bounds check on the DHCP response. This could lead to remote code execution as a privileged process with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 5.1.1 6.0 6.0.1 7.0 7.1.1 7.1.2 8.0 8.1. Android ID: A-67474440.


In avrc_ctrl_pars_vendor_rsp of bluetooth avrcp_ctrl there is a possible out of bounds write on the stack due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 7.0 7.1.1 7.1.2 8.0 8.1. Android ID: A-71603410.


QNAP has patched a remote code execution vulnerability affecting the QTS Media Library in all versions prior to QTS 4.2.6 build 20170905 and QTS 4.3.3.0299 build 20170901. This particular vulnerability allows a remote attacker to execute commands on a QNAP NAS using a transcoding service on port 9251. A remote user does not require any privileges to successfully execute an attack.


In

the

and

functions

of

SoftHEVC

there

is

a

possible

out-of-bounds

write

due

to

a

use

after

free.

Both

and

point

to

the

same

memory

and

could

be

freed

without

clearing

ps_create_op->s_ivd_create_op_t.pv_handle.

This

could

lead

to

remote

code

execution

as

a

privileged

process

with

no

additional

execution

privileges

needed.

User

interaction

is

not

needed

for

exploitation.

Product:

Android.

Versions:

Android

ID:


In ihevcd_fmt_conv of ihevcd_fmt_conv.c there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: 6.0 6.0.1 7.0 7.1.1 7.1.2 8.0 8.1. Android ID: A-72165027.


In process_service_search_attr_req of sdp_server.cc there is an out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 5.1.1 6.0 6.0.1 7.0 7.1.1 7.1.2 8.0 8.1. Android ID: A-68817966.


In function ih264d_ref_idx_reordering of libavc there is an out-of-bounds write due to modCount being defined as an unsigned character. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: 6.0 6.0.1 7.0 7.1.1 7.1.2 8.0 8.1. Android ID: A-69478425.


In wl_get_assoc_ies of wl_cfg80211.c there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android kernel. Android ID: A-70722061. References: B-V2018010201.


In ih264d_fmt_conv_420sp_to_420p of ih264d_utils.c there is an out of bound write due to a missing out of bounds check because of a multiplication error. This could lead to an remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: 6.0 6.0.1 7.0 7.1.1 7.1.2 8.0 8.1. Android ID: A-71375536.


In several functions of libhevc NEON registers are not preserved. This could lead to remote code execution as a privileged process with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 5.1.1 6.0 6.0.1 7.0 7.1.1 7.1.2 8.0 8.1. Android ID: A-68320413.


In impeg2_idct_recon_sse42() of impeg2_idct_recon_sse42_intr.c there is an out of bound write due to a missing bounds check. This could lead to an remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: 6.0 6.0.1 7.0 7.1.1 7.1.2 8.0 8.1. Android ID: A-70349612.


In process_service_attr_req of sdp_server.c there is an out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 5.1.1 6.0 6.0.1 7.0 7.1.1 7.1.2 8.0 8.1. Android ID: A-68776054.


In impeg2d_api_set_display_frame of impeg2d_api_main.c there is an out of bound write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: 6.0 6.0.1 7.0 7.1.1 7.1.2 8.0 8.1. Android ID: A-70399408.


In SvoxSsmlParser and startElement of svox_ssml_parser.cpp there is a possible out of bounds write due to an uninitialized buffer. This could lead to remote code execution in an unprivileged process with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 6.0 6.0.1 7.0 7.1.1 7.1.2 8.0 8.1. Android ID: A-69177126.


A remote code execution vulnerability exists when Windows Hyper-V Network Switch running on a host server fails to properly validate input from an authenticated user on a guest operating system aka \Hyper-V Remote Code Execution Vulnerability.\ This CVE ID is unique from CVE-2017-0162 CVE-2017-0180 and CVE-2017-0181.


Microsoft Windows 7 SP1 Windows Server 2008 SP2 and R2 SP1 Windows 8.1 and Windows RT 8.1 Windows Server 2012 and R2 Windows 10 Gold 1511 1607 and 1703 and Windows Server 2016 allow an attacker to execute remote code when Windows fails to properly handle cabinet files aka \Windows Remote Code Execution Vulnerability\.


Microsoft Office 2010 SP2 Office 2013 SP1 and Office 2016 allow a remote code execution vulnerability when the software fails to properly handle objects in memory aka \Office Remote Code Execution Vulnerability\. This CVE ID is unique from CVE-2017-0262 and CVE-2017-0281.


ExpressionEngine version 2.x < 2.11.8 and version 3.x < 3.5.5 create an object signing token with weak entropy. Successfully guessing the token can lead to remote code execution.


The Microsoft Server Message Block 1.0 (SMBv1) server on Microsoft Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 Windows 10 Gold 1511 1607 and 1703 and Windows Server 2016 allows an attacker to execute remote code by the way it handles certain requests aka \Windows SMB Remote Code Execution Vulnerability\. This CVE ID is unique from CVE-2017-0272 CVE-2017-0277 and CVE-2017-0278.


A remote code execution vulnerability exists in Microsoft Office when the software fails to properly handle objects in memory aka \Office Remote Code Execution Vulnerability\. This CVE ID is unique from CVE-2017-8509 CVE-2017-8510 CVE-2017-8511 CVE-2017-8512 and CVE-2017-8506.


The Microsoft Server Message Block 1.0 (SMBv1) server on Microsoft Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 Windows 10 Gold 1511 1607 and 1703 and Windows Server 2016 allows an attacker to execute remote code by the way it handles certain requests aka \Windows SMB Remote Code Execution Vulnerability\. This CVE ID is unique from CVE-2017-0272 CVE-2017-0277 and CVE-2017-0279.


Windows PDF in Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 Windows 10 Gold 1511 1607 1703 and Windows Server 2016 allows remote code execution if a user opens a specially crafted PDF file aka \Windows PDF Remote Code Execution Vulnerability\. This CVE ID is unique from CVE-2017-0292.


RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability. YAML deserialization of gem specifications can bypass class white lists. Specially crafted serialized objects can possibly be used to escalate to remote code execution.


A remote code execution vulnerability exists when Windows Hyper-V Network Switch running on a Windows 10 Windows 8.1 Windows Server 2012 R2 or Windows Server 2016 host server fails to properly validate input from an authenticated user on a guest operating system aka \Hyper-V Remote Code Execution Vulnerability.\ This CVE ID is unique from CVE-2017-0163 CVE-2017-0180 and CVE-2017-0181.


Microsoft Office 2007 SP3 Office 2010 SP2 Office 2013 SP1 Office 2016 Office Online Server 2016 Office Web Apps 2010 SP2 Office Web Apps 2013 SP1 Project Server 2013 SP1 SharePoint Enterprise Server 2013 SP1 SharePoint Enterprise Server 2016 SharePoint Foundation 2013 SP1 Sharepoint Server 2010 SP2 Word 2016 and Skype for Business 2016 allow a remote code execution vulnerability when the software fails to properly handle objects in memory aka \Office Remote Code Execution Vulnerability\. This CVE ID is unique from CVE-2017-0261 and CVE-2017-0262.


A remote code execution vulnerability exists when Windows Hyper-V Network Switch running on a Windows 10 or Windows Server 2016 host server fails to properly validate input from an authenticated user on a guest operating system aka \Hyper-V Remote Code Execution Vulnerability.\ This CVE ID is unique from CVE-2017-0162 CVE-2017-0163 and CVE-2017-0180.


Microsoft Office 2010 SP2 Office 2013 SP1 and Office 2016 allow a remote code execution vulnerability when the software fails to properly handle objects in memory aka \Office Remote Code Execution Vulnerability\. This CVE ID is unique from CVE-2017-0261 and CVE-2017-0281.


Microsoft .NET Framework 2.0 3.5 4.5.2 4.6 4.6.1 4.6.2 and 4.7 allows an attacker with access to the local system to execute malicious code aka \.NET Remote Code Execution Vulnerability.\


The Microsoft Server Message Block 1.0 (SMBv1) server on Microsoft Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 Windows 10 Gold 1511 1607 and 1703 and Windows Server 2016 allows an attacker to execute remote code by the way it handles certain requests aka \Windows SMB Remote Code Execution Vulnerability\. This CVE ID is unique from CVE-2017-0277 CVE-2017-0278 and CVE-2017-0279.


Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory aka \Microsoft Office Remote Code Execution Vulnerability\. This CVE ID is unique from CVE-2017-8570.


Uniscribe in Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 Windows 10 Gold 1511 1607 Windows Server 2016 Microsoft Office 2007 SP3 Microsoft Office 2010 SP2 Microsoft Office Word Viewer Microsoft Lync 2013 SP1 Skype for Business 2016 Microsoft Silverlight 5 Developer Runtime when installed on Microsoft Windows and Microsoft Silverlight 5 when installed on Microsoft Windows allows a remote code execution vulnerability due to the way it handles objects in memory aka \Windows Uniscribe Remote Code Execution Vulnerability\. This CVE ID is unique from CVE-2017-8528.


The Microsoft Server Message Block 1.0 (SMBv1) server on Microsoft Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 Windows 10 Gold 1511 1607 and 1703 and Windows Server 2016 allows an attacker to execute remote code by the way it handles certain requests aka \Windows SMB Remote Code Execution Vulnerability\. This CVE ID is unique from CVE-2017-0272 CVE-2017-0278 and CVE-2017-0279.


The Windows NetBT Session Services component on Microsoft Windows Server 2008 R2 SP1 Windows 7 SP1 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 Windows 10 Gold 1511 1607 and 1703 and Windows Server 2016 allows a remote code execution vulnerability when it fails to maintain certain sequencing requirements aka \NetBIOS Remote Code Execution Vulnerability\.


A remote code execution vulnerability exists when Windows Hyper-V Network Switch running on a host server fails to properly validate input from an authenticated user on a guest operating system aka \Hyper-V Remote Code Execution Vulnerability.\ This CVE ID is unique from CVE-2017-0162 CVE-2017-0163 and CVE-2017-0181.


Windows PDF in Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 Windows 10 Gold 1511 1607 1703 and Windows Server 2016 allows remote code execution if a user opens a specially crafted PDF file aka \Windows PDF Remote Code Execution Vulnerability\. This CVE ID is unique from CVE-2017-0291.


The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Windows 7 SP1 Windows 8.1 Windows RT 8.1 Windows 10 Gold 1511 1607 and 1703 1709 and Windows Server 2016 Windows Server version 1709 Microsoft Exchange Server 2013 and 2016 does not properly scan a specially crafted file leading to remote code execution. aka \Microsoft Malware Protection Engine Remote Code Execution Vulnerability\. This is different than CVE-2017-11937.


SQL Injection in Trend Micro Control Manager 6.0 causes Remote Code Execution when executing opcode 0x1b07 due to lack of proper user input validation in cmdHandlerTVCSCommander.dll. Formerly ZDI-CAN-4560.


The Microsoft Graphics Component on Microsoft Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 Windows 10 Gold 1511 1607 and 1703 and Windows Server 2016 allows a remote code execution vulnerability in the way it handles specially crafted embedded fonts aka \Microsoft Graphics Remote Code Execution Vulnerability\. This CVE ID is unique from CVE-2017-11763.


The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Windows 7 SP1 Windows 8.1 Windows RT 8.1 Windows 10 Gold 1511 1607 and 1703 1709 and Windows Server 2016 Windows Server version 1709 Microsoft Exchange Server 2013 and 2016 does not properly scan a specially crafted file leading to remote code execution. aka \Microsoft Malware Protection Engine Remote Code Execution Vulnerability\.


PHICOMM K2(PSG1218) devices V22.5.11.5 and earlier allow unauthenticated remote code execution via a request to an unspecified ASP script; alternatively the attacker can leverage unauthenticated access to this script to trigger a reboot via an ifType=reboot action.


Microsoft Office 2016 Click-to-Run (C2R) and Microsoft Office 2016 for Mac allow an attacker to use a specially crafted file to perform actions in the security context of the current user due to how Microsoft Office handles files in memory aka \Microsoft Office Remote Code Execution Vulnerability\.


SQL Injection in Trend Micro Control Manager 6.0 causes Remote Code Execution when executing opcode 0x4707 due to lack of proper user input validation in cmdHandlerNewReportScheduler.dll. Formerly ZDI-CAN-4549.


SQL Injection in Trend Micro Control Manager 6.0 causes Remote Code Execution when RestfulServiceUtility.NET.dll doesn't properly validate user provided strings before constructing SQL queries. Formerly ZDI-CAN-4639 and ZDI-CAN-4638.


Microsoft Office 2016 Click-to-Run (C2R) allows a remote code execution vulnerability due to the way files are handled in memory aka \Microsoft Excel Remote Code Execution Vulnerability\.


SQL Injection in Trend Micro Control Manager 6.0 causes Remote Code Execution when executing opcode 0x3b21 due to lack of proper user input validation in mdHandlerLicenseManager.dll. Formerly ZDI-CAN-4561.


Windows 7 SP1 Windows 8.1 and RT 8.1 Windows Server 2008 SP2 and R2 SP1 Windows Server 2012 and R2 Windows 10 Gold 1511 1607 1703 and 1709 Windows Server 2016 and Windows Server version 1709 allow a remote code execution vulnerability due to the way the Routing and Remote Access service handles requests aka \Windows RRAS Service Remote Code Execution Vulnerability\.


Microsoft Office 2010 SharePoint Enterprise Server 2010 SharePoint Server 2010 Web Applications Office Web Apps Server 2010 and 2013 Word Viewer Word 2007 2010 2013 and 2016 Word Automation Services and Office Online Server allow remote code execution when the software fails to properly handle objects in memory.


SQL Injection in Trend Micro Control Manager 6.0 causes Remote Code Execution when executing opcode 0x6b1b due to lack of proper user input validation in cmdHandlerStatusMonitor.dll. Formerly ZDI-CAN-4545.


The Microsoft Windows Domain Name System (DNS) DNSAPI.dll on Microsoft Windows 8.1 Windows Server 2012 R2 Windows RT 8.1 Windows 10 Gold 1511 1607 and 1703 and Windows Server 2016 allows a remote code execution vulnerability when it fails to properly handle DNS responses aka \Windows DNSAPI Remote Code Execution Vulnerability\.


The Microsoft Windows TRIE component on Microsoft Windows 10 Gold 1511 1607 and 1703 and Windows Server 2016 allows a remote code execution vulnerability in the way it handles loading dll files aka \TRIE Remote Code Execution Vulnerability\.


The Server Message Block 1.0 (SMBv1) on Microsoft Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 Windows 10 Gold 1511 1607 and 1703 and Windows Server 2016 allows a remote code execution vulnerability when it fails to properly handle certain requests aka \Windows SMB Remote Code Execution Vulnerability\.


The Microsoft Windows Search component on Microsoft Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 Windows 10 Gold 1511 1607 and 1703 and Windows Server 2016 allows a remote code execution vulnerability when it fails to properly handle DNS responses aka \Windows Search Remote Code Execution Vulnerability\.


An exploitable free of a stack pointer vulnerability exists in the x509 certificate parsing code of ARM mbed TLS before 1.3.19 2.x before 2.1.7 and 2.4.x before 2.4.2. A specially crafted x509 certificate when parsed by mbed TLS library can cause an invalid free of a stack pointer leading to a potential remote code execution. In order to exploit this vulnerability an attacker can act as either a client or a server on a network to deliver malicious x509 certificates to vulnerable applications.


An exploitable use-after-free vulnerability exists in the HTTP server implementation of Cesanta Mongoose 6.8. An ordinary HTTP POST request with a CGI target can cause a reuse of previously freed pointer potentially resulting in remote code execution. An attacker needs to send this HTTP request over the network to trigger this vulnerability.


An exploitable heap overflow vulnerability exists in the gdk_pixbuf__jpeg_image_load_increment functionality of Gdk-Pixbuf 2.36.6. A specially crafted jpeg file can cause a heap overflow resulting in remote code execution. An attacker can send a file or url to trigger this vulnerability.


EMC Network Configuration Manager (NCM) 9.3.x EMC Network Configuration Manager (NCM) 9.4.0.x EMC Network Configuration Manager (NCM) 9.4.1.x EMC Network Configuration Manager (NCM) 9.4.2.x contains a Java RMI Remote Code Execution vulnerability that could potentially be exploited by malicious users to compromise the affected system.


hawtio before version 1.5.5 is vulnerable to remote code execution via file upload. An attacker could use this vulnerability to upload a crafted file which could be executed on a target machine where hawtio is deployed.


Versions of Puppet prior to 4.10.1 will deserialize data off the wire (from the agent to the server in this case) with a attacker-specified format. This could be used to force YAML deserialization in an unsafe manner which would lead to remote code execution. This change constrains the format of data on the wire to PSON or safely decoded YAML.


Adobe Captivate versions 9 and earlier have a remote code execution vulnerability in the quiz reporting feature that could be abused to read and write arbitrary files to the server.


A vulnerability in the Data-in-Motion (DMo) process installed with the Cisco IOx application environment could allow an unauthenticated remote attacker to cause a stack overflow that could allow remote code execution with root privileges in the virtual instance running on an affected device. The vulnerability is due to insufficient bounds checking in the DMo process. An attacker could exploit this vulnerability by sending crafted packets that are forwarded to the DMo process for evaluation. The impacts of a successful exploit are limited to the scope of the virtual instance and do not impact the router that is hosting Cisco IOx. This vulnerability affects the following Cisco 800 Series Industrial Integrated Services Routers: Cisco IR809 and Cisco IR829. Cisco IOx Releases 1.0.0.0 and 1.1.0.0 are vulnerable. Cisco Bug IDs: CSCuy52330.


In HPE Storage Essentials 9.5.0.142 there is Unauthenticated Java Deserialization with remote code execution via OS commands in a request to invoker/JMXInvokerServlet aka PSRT110461.


In Netwide Assembler (NASM) 2.14rc0 there are multiple heap use after free vulnerabilities in the tool nasm. The related heap is allocated in the token() function and freed in the detoken() function (called by pp_getline()) - it is used again at multiple positions later that could cause multiple damages. For example it causes a corrupted double-linked list in detoken() a double free or corruption in delete_Token() and an out-of-bounds write in detoken(). It has a high possibility to lead to a remote code execution attack.


The Hipchat for Mac desktop client is vulnerable to client-side remote code execution via video call link parsing. Hipchat for Mac desktop clients at or above version 4.0 and before version 4.30 are affected by this vulnerability.


A Remote Code Execution vulnerability has been found in the Horde_Image library when using the \Im\ backend that utilizes ImageMagick's \convert\ utility. It's not exploitable through any Horde application because the code path to the vulnerability is not used by any Horde code. Custom applications using the Horde_Image library might be affected. This vulnerability affects all versions of Horde_Image from 2.0.0 to 2.5.1 and is fixed in 2.5.2. The problem is missing input validation of the index field in _raw() during construction of an ImageMagick command line.


Xiph.Org libvorbis 1.3.5 allows Remote Code Execution upon freeing uninitialized memory in the function vorbis_analysis_headerout() in info.c when vi->channels<=0 a similar issue to Mozilla bug 550184.


The DHCP client on D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) devices allows unauthenticated remote code execution as root because /etc/services/INET/inet_ipv4.php mishandles shell metacharacters affecting generated files such as WAN-1-udhcpc.sh.


An issue was discovered in Squiz Matrix before 5.3.6.1 and 5.4.x before 5.4.1.3. Authenticated users with permissions to edit design assets can cause Remote Code Execution (RCE) via a maliciously crafted time_format tag.


A Server Side Request Forgery (SSRF) vulnerability could lead to remote code execution for authenticated administrators. This issue was introduced in version 2.2.0 of Hipchat Server and version 3.0.0 of Hipchat Data Center. Versions of Hipchat Server starting with 2.2.0 and before 2.2.6 are affected by this vulnerability. Versions of Hipchat Data Center starting with 3.0.0 and before 3.1.0 are affected.


SquirrelMail 1.4.22 (and other versions before 20170427_0200-SVN) allows post-authentication remote code execution via a sendmail.cf file that is mishandled in a popen call. It's possible to exploit this vulnerability to execute arbitrary shell commands on the remote server. The problem is in the Deliver_SendMail.class.php with the initStream function that uses escapeshellcmd() to sanitize the sendmail command before executing it. The use of escapeshellcmd() is not correct in this case since it doesn't escape whitespaces allowing the injection of arbitrary command parameters. The problem is in -f$envelopefrom within the sendmail command line. Hence if the target server uses sendmail and SquirrelMail is configured to use it as a command-line program it's possible to trick sendmail into using an attacker-provided configuration file that triggers the execution of an arbitrary command. For exploitation the attacker must upload a sendmail.cf file as an email attachment and inject the sendmail.cf filename with the -C option within the \Options > Personal Informations > Email Address\ setting.


An issue was discovered in Enalean Tuleap 9.6 and prior versions. The vulnerability exists because the User::getRecentElements() method is using the unserialize() function with a preference value that can be arbitrarily manipulated by malicious users through the REST API interface and this can be exploited to inject arbitrary PHP objects into the application scope allowing an attacker to perform a variety of attacks (including but not limited to Remote Code Execution).


An issue was discovered in api/includes/systems.php in Unitrends Enterprise Backup before 9.0.0. User input is not properly filtered before being sent to a popen function. This allows for remote code execution by sending a specially crafted user variable.


An issue was discovered in Unitrends Enterprise Backup before 9.1.2. A lack of sanitization of user input in the createReportName and saveReport functions in recoveryconsole/bpl/reports.php allows for an authenticated user to create a randomly named file on disk with a user-controlled extension contents and path leading to remote code execution aka Unrestricted File Upload.


rkhunter versions before 1.4.4 are vulnerable to file download over insecure channel when doing mirror update resulting into potential remote code execution.


Remote

Code

Execution

vulnerability

in

in

Symphony

CMS

through

allows

remote

attackers

to

execute

code

and

get

a

webshell

from

the

back-end.

The

attacker

must

be

authenticated

and

enter

PHP

code

in

the

datasource

editor

or

event

editor.


Samba since version 3.5.0 and before 4.6.4 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability allowing a malicious client to upload a shared library to a writable share and then cause the server to load and execute it.


The Symantec Messaging Gateway can encounter a file inclusion vulnerability which is a type of vulnerability that is most commonly found to affect web applications that rely on a scripting run time. This issue is caused when an application builds a path to executable code using an attacker-controlled variable in a way that allows the attacker to control which file is executed at run time. This file inclusion vulnerability subverts how an application loads code for execution. Successful exploitation of a file inclusion vulnerability will result in remote code execution on the web server that runs the affected web application.


An Arbitrary File Upload issue was discovered in 3S-Smart Software Solutions GmbH CODESYS Web Server. The following versions of CODESYS Web Server part of the CODESYS WebVisu web browser visualization software are affected: CODESYS Web Server Versions 2.3 and prior. A specially crafted web server request may allow the upload of arbitrary files (with a dangerous type) to the CODESYS Web Server without authorization which may allow remote code execution.


The Symantec Messaging Gateway can encounter an issue of remote code execution which describes a situation whereby an individual may obtain the ability to execute commands remotely on a target machine or in a target process.


A vulnerability in the web-based user interface of Cisco Prime Infrastructure (PI) and Evolved Programmable Network Manager (EPNM) could allow an authenticated remote attacker read and write access to information stored in the affected system as well as perform remote code execution. The attacker must have valid user credentials. The vulnerability is due to improper handling of XML External Entity (XXE) entries when parsing an XML file. An attacker could exploit this vulnerability by convincing the administrator of an affected system to import a crafted XML file with malicious entries which could allow the attacker to read and write files and execute remote code within the application aka XML Injection. Cisco Prime Infrastructure software releases 1.1 through 3.1.6 are vulnerable. Cisco EPNM software releases 1.2 2.0 and 2.1 are vulnerable. Cisco Bug IDs: CSCvc23894 CSCvc49561.


The Symantec Messaging Gateway before 10.6.3-267 can encounter an issue of remote code execution which describes a situation whereby an individual may obtain the ability to execute commands remotely on a target machine or in a target process. In this type of occurrence after gaining access to the system the attacker may attempt to elevate their privileges.


A Header Injection issue was discovered in Certec EDV GmbH atvise scada prior to Version 3.0. An \improper neutralization of HTTP headers for scripting syntax\ issue has been identified which may allow remote code execution.


A 3rd party development library including with Drupal 8 development dependencies is vulnerable to remote code execution. This is mitigated by the default .htaccess protection against PHP execution and the fact that Composer development dependencies aren't normal installed. You might be vulnerable to this if you are running a version of Drupal before 8.2.2. To be sure you aren't vulnerable you can remove the <siteroot>/vendor/phpunit directory from your production deployments


An active network attacker (MiTM) can achieve remote code execution on a machine that runs IKARUS Anti Virus 2.16.7. IKARUS AV for Windows uses cleartext HTTP for updates along with a CRC32 checksum and an update value for verification of the downloaded files. The attacker first forces the client to initiate an update transaction by modifying an update field within an HTTP 200 response so that it refers to a nonexistent update. The attacker then modifies the HTTP 404 response so that it specifies a successfully found update with a Trojan horse executable file (e.g. guardxup.exe) and the correct CRC32 checksum for that file.


In Apache Geode before v1.4.0 the Geode server stores application objects in serialized form. Certain cluster operations and API invocations cause these objects to be deserialized. A user with DATA:WRITE access to the cluster may be able to cause remote code execution if certain classes are present on the classpath.


A malicious X-ProxyContextPath or X-Forwarded-Context header containing external resources or embedded code could cause remote code execution. The fix to properly handle these headers was applied on the Apache NiFi 1.5.0 release. Users running a prior 1.x release should upgrade to the appropriate release.


In Apache Geode before v1.4.0 the TcpServer within the Geode locator opens a network port that deserializes data. If an unprivileged user gains access to the Geode locator they may be able to cause remote code execution if certain classes are present on the classpath.


Webmin before 1.860 has XSS with resultant remote code execution. Under the 'Others/File Manager' menu there is a 'Download from remote URL' option to download a file from a remote server. After setting up a malicious server one can wait for a file download request and then send an XSS payload that will lead to Remote Code Execution as demonstrated by an OS command in the value attribute of a name='cmd' input element.


X-Cart 5.2.23 5.3.1.9 5.3.2.13 and 5.3.3 is vulnerable to Remote Code Execution. This vulnerability exists because the application fails to check remote file extensions before saving locally. This vulnerability can be exploited by anyone with Vendor access or higher. One attack methodology is to upload an image file in the Attachments section of a product catalog upload a .php file with an \Add File Via URL\ action and change the image's Description URL to reference the .php URL in the attachments/ directory.


In Apache Synapse by default no authentication is required for Java Remote Method Invocation (RMI). So Apache Synapse 3.0.1 or all previous releases (3.0.0 2.1.0 2.0.0 1.2 1.1.2 1.1.1) allows remote code execution attacks that can be performed by injecting specially crafted serialized objects. And the presence of Apache Commons Collections 3.2.1 (commons-collections-3.2.1.jar) or previous versions in Synapse distribution makes this exploitable. To mitigate the issue we need to limit RMI access to trusted users only. Further upgrading to 3.0.1 version will eliminate the risk of having said Commons Collection version. In Synapse 3.0.1 Commons Collection has been updated to 3.2.2 version.


When an Apache Geode server versions 1.0.0 to 1.4.0 is configured with a security manager a user with DATA:WRITE privileges is allowed to deploy code by invoking an internal Geode function. This allows remote code execution. Code deployment should be restricted to users with DATA:MANAGE privilege.


VMware ESXi (6.5 before ESXi650-201710401-BG) Workstation (12.x before 12.5.8) and Fusion (8.x before 8.5.9) contain a vulnerability that could allow an authenticated VNC session to cause a heap overflow via a specific set of VNC packets resulting in heap corruption. Successful exploitation of this issue could result in remote code execution in a virtual machine via the authenticated VNC session. Note: In order for exploitation to be possible in ESXi VNC must be manually enabled in a virtual machine's .vmx configuration file. In addition ESXi must be configured to allow VNC traffic through the built-in firewall.


VMware ESXi (6.0 before ESXi600-201711101-SG 5.5 ESXi550-201709101-SG) Workstation (12.x before 12.5.8) and Fusion (8.x before 8.5.9) contain a vulnerability that could allow an authenticated VNC session to cause a stack overflow via a specific set of VNC packets. Successful exploitation of this issue could result in remote code execution in a virtual machine via the authenticated VNC session. Note: In order for exploitation to be possible in ESXi VNC must be manually enabled in a virtual machine's .vmx configuration file. In addition ESXi must be configured to allow VNC traffic through the built-in firewall.


EMC VASA Provider Virtual Appliance versions 8.3.x and prior has an unauthenticated remote code execution vulnerability that could potentially be exploited by malicious users to compromise the affected system.


FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper bypassing a blacklist that is ineffective if the Spring libraries are available in the classpath.


Embedthis GoAhead before 3.6.5 allows remote code execution if CGI is enabled and a CGI program is dynamically linked. This is a result of initializing the environment of forked CGI scripts using untrusted HTTP request parameters in the cgiHandler function in cgi.c. When combined with the glibc dynamic linker this behaviour can be abused for remote code execution using special parameter names such as LD_PRELOAD. An attacker can POST their shared object payload in the body of the request and reference it using /proc/self/fd/0.


BMC Remedy Mid Tier 9.1SP3 is affected by remote and local file inclusion. Due to the lack of restrictions on what can be targeted the system can be vulnerable to attacks such as system fingerprinting internal port scanning Server Side Request Forgery (SSRF) or remote code execution (RCE).


In Utilities.php in Perfex CRM 1.9.7 Unrestricted file upload can lead to remote code execution.


Huawei HG532 with some customized versions has a remote code execution vulnerability. An authenticated attacker could send malicious packets to port 37215 to launch attacks. Successful exploit could lead to the remote execution of arbitrary code.


Based

on

details

posted

by

the

ElectronJS

team;

A

remote

code

execution

vulnerability

has

been

discovered

in

Google

Chromium

that

affects

all

recent

versions

of

Electron.

Any

Electron

app

that

accesses

remote

content

is

vulnerable

to

this

exploit

regardless

of

whether

the

sandbox

is

enabled.


A remote code execution vulnerability was found within the pg module when the remote database or query specifies a specially crafted column name. There are 2 likely scenarios in which one would likely be vulnerable. 1) Executing unsafe user-supplied sql which contains a malicious column name. 2) Connecting to an untrusted database and executing a query which returns results where any of the column names are malicious.


In Horde Groupware 5.2.19 there is XSS via the Name field during creation of a new Resource. This can be leveraged for remote code execution after compromising an administrator account because the CVE-2015-7984 CSRF protection mechanism can then be bypassed.


gfe-sass is a library for promises (CommonJS/Promises/A B D) gfe-sass downloads resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.


windows-build-tools is a module for installing C++ Build Tools for Windows using npm. windows-build-tools versions below 1.0.0 download resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.


An issue was discovered in Hanwha Techwin Smart Security Manager Versions 1.5 and prior. Multiple Cross Site Request Forgery vulnerabilities have been identified. The flaws exist within the Redis and Apache Felix Gogo servers that are installed as part of this product. By issuing specific HTTP Post requests an attacker can gain system level access to a remote shell session. Smart Security Manager Versions 1.5 and prior are affected by these vulnerabilities. These vulnerabilities can allow for remote code execution.


The Codextrous B2J Contact (aka b2j_contact) extension before 2.1.13 for Joomla! allows a rename attack that bypasses a \safe file extension\ protection mechanism leading to remote code execution.


An authenticated remote code execution vulnerability in HPE Aruba ClearPass Policy Manager version 6.6.x was found.


An issue was discovered in VideoInsight Web Client Version 6.3.5.11 and previous versions. A SQL Injection vulnerability has been identified which may allow remote code execution.


An Authentication Bypass issue was discovered in Geutebruck IP Camera G-Cam/EFD-2250 Version 1.11.0.12. An authentication bypass vulnerability has been identified. The existing file system architecture could allow attackers to bypass the access control that may allow remote code execution.


An issue was discovered in Hanwha Techwin Smart Security Manager Versions 1.5 and prior. Multiple Path Traversal vulnerabilities have been identified. The flaws exist within the ActiveMQ Broker service that is installed as part of the product. By issuing specific HTTP requests if a user visits a malicious page an attacker can gain access to arbitrary files on the server. Smart Security Manager Versions 1.4 and prior to 1.31 are affected by these vulnerabilities. These vulnerabilities can allow for remote code execution.


PEAR HTML_AJAX 0.3.0 through 0.5.7 has a PHP Object Injection Vulnerability in the PHP Serializer. It allows remote code execution. In one viewpoint the root cause is an incorrect regular expression.


An unauthenticated remote code execution vulnerability in HPE Aruba ClearPass Policy Manager version 6.6.x was found.


Previous versions of Apache Flex BlazeDS (4.7.2 and earlier) did not restrict which types were allowed for AMF(X) object deserialization by default. During the deserialization process code is executed that for several known types has undesired side-effects. Other unknown types may also exhibit such behaviors. One vector in the Java standard library exists that allows an attacker to trigger possibly further exploitable Java deserialization of untrusted data. Other known vectors in third party libraries can be used to trigger remote code execution.


An Improper Neutralization of Special Elements (in an OS command) issue was discovered in Geutebruck IP Camera G-Cam/EFD-2250 Version 1.11.0.12. An improper neutralization of special elements vulnerability has been identified. If special elements are not properly neutralized an attacker can call multiple parameters that can allow access to the root level operating system which could allow remote code execution.


ROOT version 6.9.03 and below is vulnerable to an authenticated shell metacharacter injection in the rootd daemon resulting in remote code execution


Awstats version 7.6 and earlier is vulnerable to a path traversal flaw in the handling of the \config\ and \migrate\ parameters resulting in unauthenticated remote code execution.


Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to an unauthenticated remote code execution. An unauthenticated remote code execution vulnerability allowed attackers to transfer a serialized Java `SignedObject` object to the Jenkins CLI that would be deserialized using a new `ObjectInputStream` bypassing the existing blacklist-based protection mechanism. We're fixing this issue by adding `SignedObject` to the blacklist. We're also backporting the new HTTP CLI protocol from Jenkins 2.54 to LTS 2.46.2 and deprecating the remoting-based (i.e. Java serialization) CLI protocol disabling it by default.


Linux foundation ONOS 1.9.0 is vulnerable to unauthenticated upload of applications (.oar) resulting in remote code execution.


The native Bluetooth stack in the Linux Kernel (BlueZ) starting at the Linux kernel version 2.6.32 and up to and including 4.13.1 are vulnerable to a stack overflow vulnerability in the processing of L2CAP configuration responses resulting in Remote code execution in kernel space.


Elixir's vim plugin alchemist.vim is vulnerable to remote code execution in the bundled alchemist-server. A malicious website can execute requests against an ephemeral port on localhost that are then evaluated as elixir code.


Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution


Akka versions <=2.4.16 and 2.5-M1 are vulnerable to a java deserialization attack in its Remoting component resulting in remote code execution in the context of the ActorSystem.


WordPress version <4.9 contains a CWE-20 Input Validation vulnerability in thumbnail processing that can result in remote code execution. This attack appears to be exploitable via thumbnail upload by an authenticated user and may require additional plugins in order to be exploited however this has not been confirmed at this time. This issue appears to have been partially but not completely fixed in WordPress 4.9


QuickerBB version <= 0.7.2 is vulnerable to arbitrary file writes which can lead to remote code execution. This can lead to the complete takeover of the server hosting QuickerBB.


nodejs ejs versions older than 2.5.3 is vulnerable to remote code execution due to weak input validation in ejs.renderFile() function


The shortcodes-ultimate plugin before 5.0.1 for WordPress has remote code execution via a filter in a meta post or user shortcode.


Remote Code Execution is possible in Code42 CrashPlan 5.4.x via the org.apache.commons.ssl.rmi.DateRMI Java class because (upon instantiation) it creates an RMI server that listens on a TCP port and deserializes objects sent by TCP clients.


The REST Plugin in Apache Struts 2.1.1 through 2.3.x before 2.3.34 and 2.5.x before 2.5.13 uses an XStreamHandler with an instance of XStream for deserialization without any type filtering which can lead to Remote Code Execution when deserializing XML payloads.


The server in Dropbear before 2017.75 might allow post-authentication root remote code execution because of a double free in cleanup of TCP listeners when the -a option is enabled.


import.php (aka the Phonebook import feature) in PlaySMS 1.4 allows remote code execution via vectors involving the User-Agent HTTP header and PHP code in the name of a file.


A remote code execution vulnerability exists in Schneider Electric's StruxureOn Gateway versions 1.1.3 and prior. Uploading a zip which contains carefully crafted metadata allows for the file to be uploaded to any directory on the host machine information which could lead to remote code execution.


An issue was discovered in adns before 1.5.2. It corrupts a pointer when a nameserver speaks first because of a wrong number of pointer dereferences. This bug may well be exploitable as a remote code execution.


An Improper Restriction of Operations within the Bounds of a Memory Buffer issue was discovered in the Continental AG Infineon S-Gold 2 (PMB 8876) chipset on BMW several models produced between 2009-2010 Ford a limited number of P-HEV vehicles Infiniti 2013 JX35 Infiniti 2014-2016 QX60 Infiniti 2014-2016 QX60 Hybrid Infiniti 2014-2015 QX50 Infiniti 2014-2015 QX50 Hybrid Infiniti 2013 M37/M56 Infiniti 2014-2016 Q70 Infiniti 2014-2016 Q70L Infiniti 2015-2016 Q70 Hybrid Infiniti 2013 QX56 Infiniti 2014-2016 QX 80 and Nissan 2011-2015 Leaf. A vulnerability in the temporary mobile subscriber identity (TMSI) may allow an attacker to access and control memory. This may allow remote code execution on the baseband radio processor of the TCU.


Untrusted Java serialization in Soffid IAM console before 1.7.5 allows remote attackers to achieve arbitrary remote code execution via a crafted authentication request.


Shell metacharacter injection vulnerability in /usr/www/include/ajax/GetTest.php in TerraMaster TOS before 3.0.34 leads to remote code execution as root.


The Struts 1 plugin in Apache Struts 2.1.x and 2.3.x might allow remote code execution via a malicious field value passed in a raw message to the ActionMessage.


When an Apache Geode cluster before v1.3.0 is operating in secure mode a user with read access to specific regions within a Geode cluster may execute OQL queries that allow read and write access to objects within unauthorized regions. In addition a user could invoke methods that allow remote code execution.


Csrf.cs in NancyFX Nancy before 1.4.4 and 2.x before 2.0-dangermouse has Remote Code Execution via Deserialization of JSON data in a CSRF Cookie.


Remote Code Execution was found in Horde_Image 2.x before 2.5.0 via a crafted GET request. Exploitation requires authentication.


OpenWebif 1.2.5 allows remote code execution via a URL to the CallOPKG function in the IpkgController class in plugin/controllers/ipkg.py when the URL refers to an attacker-controlled web site with a Trojan horse package. This has security implications in cases where untrusted users can trigger CallOPKG calls and these users can enter an arbitrary URL in an input field even though that input field was only intended for a package name. This threat model may be relevant in the latest versions of third-party products that bundle OpenWebif i.e. set-top box products. The issue of Trojan horse packages does NOT have security implications in cases where the attacker has full OpenWebif access.


DNN (aka DotNetNuke) before 9.1.1 has Remote Code Execution via a cookie aka \2017-08 (Critical) Possible remote code execution on DNN sites.\


SPIP 3.1.x before 3.1.6 and 3.2.x before Beta 3 does not remove shell metacharacters from the host field allowing a remote attacker to cause remote code execution.


Firmware upgrade authentication bypass vulnerability was found in Dahua IPC-HDW4300S and some IP products. The vulnerability was caused by internal Debug function. This particular function was used for problem analysis and performance tuning during product development phase. It allowed the device to receive only specific data (one direction no transmit) and therefore it was not involved in any instance of collecting user privacy data or allowing remote code execution.


A remote code execution vulnerability exists in Microsoft PowerPoint 2016 Microsoft SharePoint Enterprise Server 2016 and Office Online Server when they fail to properly handle objects in memory aka \PowerPoint Remote Code Execution Vulnerability\. This CVE ID is unique from CVE-2017-8742.


The Windows Hyper-V component on Microsoft Windows 8.1 Windows Server 2012 Gold and R2 Windows 10 1607 and Windows Server 2016 allows a remote code execution vulnerability when it fails to properly validate input from an authenticated user on a guest operating system aka \Remote Desktop Virtual Host Remote Code Execution Vulnerability\.


Windows Shell in Microsoft Windows 7 SP1 Windows Server 2008 and R2 SP1 Windows 8.1 and Windows RT 8.1 Windows Server 2012 and R2 Windows 10 Gold 1511 1607 1703 and Windows Server 2016 allows an attacker to run arbitrary code in the context of the current user due to the way that Windows Shell validates file copy destinations aka \Windows Shell Remote Code Execution Vulnerability\.


The Microsoft JET Database Engine in Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8.1 and RT 8.1 Windows Server 2012 and R2 Windows 10 Gold 1511 1607 1703 and Windows Server 2016 allows an attacker to take control of an affected system due to how it handles objects in memory aka \Microsoft JET Database Engine Remote Code Execution Vulnerability\. This CVE ID is unique from CVE-2017-8717.


Microsoft Windows XP SP3 Windows XP x64 XP2 Windows Server 2003 SP2 Windows Vista Windows 7 SP1 Windows Server 2008 SP2 and R2 SP1 Windows 8 Windows 8.1 and Windows RT 8.1 Windows Server 2012 and R2 Windows 10 Gold 1511 1607 and 1703 and Windows Server 2016 allow an attacker to take control of the affected system when Windows Search fails to handle objects in memory aka \Windows Search Remote Code Execution Vulnerability\.


Windows Hyper-V in Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 Windows 10 Gold 1511 1607 and 1703 and Windows Server 2016 allows a remote code execution vulnerability when it fails to properly validate input from a privileged user on a guest operating system aka \Windows Hyper-V Remote Code Execution Vulnerability\.


A remote code execution vulnerability exists in Microsoft Office when the software fails to properly handle objects in memory aka \Office Remote Code Execution Vulnerability\. This CVE ID is unique from CVE-2017-8509 CVE-2017-8511 CVE-2017-8512 CVE-2017-0260 and CVE-2017-8506.


Windows Server 2008 SP2 and R2 SP1 and Windows 7 SP1 allow an attacker to execute code remotely on a target system when the Windows font library fails to properly handle specially crafted embedded fonts aka \Express Compressed Fonts Remote Code Execution Vulnerability.\


A remote code execution vulnerability exists in Microsoft Office when the software fails to properly handle objects in memory aka \Office Remote Code Execution Vulnerability\. This CVE ID is unique from CVE-2017-8510 CVE-2017-8511 CVE-2017-8512 CVE-2017-0260 and CVE-2017-8506.


A remote code execution vulnerability exists in Microsoft Office when the software fails to properly handle objects in memory aka \Office Remote Code Execution Vulnerability\. This CVE ID is unique from CVE-2017-8509 CVE-2017-8510 CVE-2017-8512 CVE-2017-0260 and CVE-2017-8506.


Uniscribe in Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 Windows 10 Gold 1511 1607 Windows Server 2016 Microsoft Office 2007 SP3 and Microsoft Office 2010 SP2 allows a remote code execution vulnerability due to the way it handles objects in memory aka \Windows Uniscribe Remote Code Execution Vulnerability\. This CVE ID is unique from CVE-2017-0283.


A remote code execution vulnerability exists in Microsoft PowerPoint 2007 Service Pack 3 Microsoft PowerPoint 2010 Service Pack 2 Microsoft PowerPoint 2013 Service Pack 1 Microsoft PowerPoint 2013 RT Service Pack 1 Microsoft PowerPoint 2016 Microsoft PowerPoint Viewer 2007 Microsoft SharePoint Server 2013 Service Pack 1 Microsoft SharePoint Enterprise Server 2016 Microsoft Office Web Apps 2010 Service Pack 2 and Microsoft Office Compatibility Pack Service Pack 3 when they fail to properly handle objects in memory aka \PowerPoint Remote Code Execution Vulnerability\. This CVE ID is unique from CVE-2017-8743.


Quick Heal Internet Security 10.1.0.316 Quick Heal Total Security 10.1.0.316 and Quick Heal AntiVirus Pro 10.1.0.316 are vulnerable to Out of Bounds Write on a Heap Buffer due to improper validation of dwCompressionSize of Microsoft WIM Header WIMHEADER_V1_PACKED. This vulnerability can be exploited to gain Remote Code Execution as well as Privilege Escalation.


Microsoft Edge in Windows 10 1703 Microsoft Edge allows a remote code execution vulnerability in the way affected Microsoft scripting engines render when handling objects in memory aka \Microsoft Edge Remote Code Execution Vulnerability.\


In Pivotal Spring AMQP versions prior to 1.7.4 1.6.11 and 1.5.7 an org.springframework.amqp.core.Message may be unsafely deserialized when being converted into a string. A malicious payload could be crafted to exploit this and enable a remote code execution attack.


Windows RPC with Routing and Remote Access enabled in Windows XP and Windows Server 2003 allows an attacker to execute code on a targeted RPC server which has Routing and Remote Access enabled via a specially crafted application aka \Windows RPC Remote Code Execution Vulnerability.\


A remote code execution vulnerability was identified in HPE Intelligent Management Center (iMC) Wireless Service Manager (WSM) Software earlier than version WSM 7.3 (E0506). This issue was resolved in HPE IMC Wireless Services Manager Software IMC WSM 7.3 E0506P01 or subsequent version.


EMC NetWorker may potentially be vulnerable to an unauthenticated remote code execution vulnerability in the Networker Client execution service (nsrexecd) when oldauth authentication method is used. An unauthenticated remote attacker could send arbitrary commands via RPC service to be executed on the host system with the privileges of the nsrexecd service which runs with administrative privileges.


Windows Uniscribe in Microsoft Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Office 2007 SP3; Office 2010 SP2; Word Viewer; Office for Mac 2011 and 2016; Skype for Business 2016; Lync 2013 SP1; Lync 2010; Lync 2010 Attendee; and Live Meeting 2007 Add-in and Console allows an attacker to execute code remotely via a specially crafted website or a specially crafted document or email attachment aka \Microsoft Graphics Component Remote Code Execution.\


The Windows Uniscribe component on Microsoft Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 Windows 10 Gold 1511 1607 and 1703 and Windows Server 2016 allows remote code execution vulnerability when it fails to properly handle objects in memory aka \Uniscribe Remote Code Execution Vulnerability\.


Windows 10 1607 and Windows Server 2016 allow an attacker to execute code remotely via a specially crafted WiFi packet aka \HoloLens Remote Code Execution Vulnerability.\


Microsoft WordPad in Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 Windows 10 Gold 1511 1607 1703 and Windows Server 2016 allows a remote code execution vulnerability due to the way it parses specially crafted files aka \WordPad Remote Code Execution Vulnerability\.


Windows PowerShell in Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 Windows 10 Gold 1511 1607 1703 and Windows Server 2016 allows a remote code execution vulnerability when PSObject wraps a CIM Instance aka \Windows PowerShell Remote Code Execution Vulnerability\.


Windows graphics on Microsoft Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 Windows 10 Gold 1511 1607 and 1703 Windows Server 2016 Microsoft Office Word Viewer Microsoft Office 2007 Service Pack 3 and Microsoft Office 2010 Service Pack 2 allows an attacker to execute remote code by the way it handles embedded fonts aka \Win32k Graphics Remote Code Execution Vulnerability\. This CVE ID is unique from CVE-2017-8683.


Windows Shell in Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 Windows 10 Gold 1511 1607 1703 and Windows Server 2016 allows a remote code execution vulnerability due to the way it improperly handles executable files and shares during rename operations aka \Windows Explorer Remote Code Execution Vulnerability\.


The Microsoft JET Database Engine in Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8.1 and RT 8.1 Windows Server 2012 and R2 Windows 10 Gold 1511 1607 1703 and Windows Server 2016 allows an attacker to take control of an affected system due to how it handles objects in memory aka \Microsoft JET Database Engine Remote Code Execution Vulnerability\. This CVE ID is unique from CVE-2017-8718.


Microsoft Windows 7 SP1 Windows Server 2008 SP2 and R2 SP1 Windows 8.1 and Windows RT 8.1 Windows Server 2012 and R2 Windows 10 Gold 1511 1607 1703 and Windows Server 2016 allows a remote code execution vulnerability due to the way that Windows Search handles objects in memory aka \Windows Search Remote Code Execution Vulnerability\.


An issue was discovered on Accellion FTA devices before FTA_9_12_180. seos/1000/find.api allows Remote Code Execution with shell metacharacters in the method parameter.


Windows Input Method Editor (IME) in Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 Windows 10 Gold 1511 1607 and 1703 and Windows Server 2016 allows an remote code execution vulnerability when it fails to properly handle objects in memory aka \Windows IME Remote Code Execution Vulnerability\.


Microsoft .NET Framework 2.0 3.5 3.5.1 4.5.2 4.6 4.6.1 4.6.2 and 4.7 allow an attacker to execute code remotely via a malicious document or application aka \.NET Framework Remote Code Execution Vulnerability.\


Windows graphics on Microsoft Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 Windows 10 Gold 1511 1607 and 1703 and Windows Server 2016 allows an attacker to execute remote code by the way it handles embedded fonts aka \Win32k Graphics Remote Code Execution Vulnerability\. This CVE ID is unique from CVE-2017-8682.


A remote code execution vulnerability exists in Microsoft Office when the software fails to properly handle objects in memory aka \Office Remote Code Execution Vulnerability\. This CVE ID is unique from CVE-2017-8509 CVE-2017-8510 CVE-2017-8511 CVE-2017-8512 and CVE-2017-0260.


Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory aka \Microsoft Office Remote Code Execution Vulnerability\. This CVE ID is unique from CVE-2017-0243.


Windows OLE in Windows XP and Windows Server 2003 allows an attacker to execute code when a victim opens a specially crafted file or program aka \Windows olecnv32.dll Remote Code Execution Vulnerability.\


A remote code execution vulnerability exists in Microsoft Office when the software fails to properly handle objects in memory aka \Office Remote Code Execution Vulnerability\. This CVE ID is unique from CVE-2017-8509 CVE-2017-8510 CVE-2017-8511 CVE-2017-0260 and CVE-2017-8506.


TP-Link C2 and C20i devices through firmware 0.9.1 4.2 v0032.0 Build 160706 Rel.37961n allow remote code execution with a single HTTP request by placing shell commands in a \host=\ line within HTTP POST data.


Graphics in Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 Windows 10 Gold 1511 1607 1703 and Windows Server 2016 allows a remote code execution vulnerability due to the way it handles objects in memory aka \Windows Graphics Remote Code Execution Vulnerability\.


Microsoft Windows 8 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT Gold and 8.1 and Windows 10 Gold and 1511 mishandle library loading which allows local users to gain privileges via a crafted application aka \Windows Library Loading Remote Code Execution Vulnerability.\


Microsoft Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT Gold and 8.1 and Windows 10 Gold and 1511 mishandle library loading which allows local users to gain privileges via a crafted application aka \Windows Library Loading Remote Code Execution Vulnerability.\


win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2008 R2 SP1 Windows 7 SP1 Windows 8 Windows 8.1 Windows Server 2012 Gold and R2 and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted TrueType font aka \TrueType Font Parsing Remote Code Execution Vulnerability.\


Untrusted search path vulnerability in Microsoft Windows Server 2003 SP2 Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8 Windows 8.1 Windows Server 2012 Gold and R2 and Windows RT Gold and 8.1 allows local users to gain privileges via a Trojan horse DLL in the current working directory leading to DLL loading during Windows Explorer access to the icon of a crafted shortcut aka \DLL Planting Remote Code Execution Vulnerability.\


Datto ALTO and SIRIS devices allow Remote Code Execution via unauthenticated requests to PHP scripts.


Untrusted search path vulnerability in Microsoft Excel 2007 SP3 Excel 2010 SP2 Excel Viewer 2007 SP3 and Office Compatibility Pack SP3 allows local users to gain privileges via a Trojan horse DLL in the current working directory aka \Microsoft Excel DLL Remote Code Execution Vulnerability.\


Untrusted search path vulnerability in Microsoft Windows 7 SP1 Windows Server 2008 R2 SP1 Windows 8.1 Windows Server 2012 R2 and Windows RT 8.1 allows local users to gain privileges via a Trojan horse DLL in the current working directory aka \Windows DLL Remote Code Execution Vulnerability.\


Untrusted search path vulnerability in the client in Remote Desktop Protocol (RDP) through 8.1 in Microsoft Windows 7 SP1 and Windows Server 2008 R2 SP1 allows local users to gain privileges via a Trojan horse DLL in the current working directory as demonstrated by a directory that contains a .rdp file aka \Remote Desktop Protocol DLL Planting Remote Code Execution Vulnerability.\


An exploitable remote code execution vulnerability exists in the Trane ComfortLink II firmware version 2.0.2 in DSS service. An attacker who can connect to the DSS service on the Trane ComfortLink II device can send an overly long REG request that can overflow a fixed size stack buffer resulting in arbitrary code execution.


Untrusted search path vulnerability in Windows Media Device Manager in Microsoft Windows Server 2003 SP2 Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 and Windows 7 SP1 allows local users to gain privileges via a Trojan horse DLL in the current working directory as demonstrated by a directory that contains a .rtf file aka \DLL Planting Remote Code Execution Vulnerability.\


An issue was discovered on TOTOLINK A850R-V1 through 1.0.1-B20150707.1612 and F1-V2 through 1.1-B20150708.1646 devices. There is Remote Code Execution in the management interface via the formSysCmd sysCmd parameter.


Chamilo

LMS

version

contains

an

Unserialization

vulnerability

in

the

\hash\

GET

parameter

for

the

api

endpoint

located

at

that

can

result

in

Unauthenticated

remote

code

execution.

This

attack

appear

to

be

exploitable

via

a

simple

GET

request

to

the

api

endpoint.

This

vulnerability

appears

to

have

been

fixed

in

After

commit


A use after free in the TextBox field Mouse Enter action in IReader_ContentProvider can occur for specially crafted PDF files in Foxit Reader SDK (ActiveX) Professional 5.4.0.1031. An attacker can leverage this to gain remote code execution. Relative to CVE-2018-19444 this has a different free location and requires different JavaScript code for exploitation.


A File Write can occur for specially crafted PDF files in Foxit Reader SDK (ActiveX) Professional 5.4.0.1031 when the JavaScript API Doc.createDataObject is used. An attacker can leverage this to gain remote code execution.


An issue was discovered in Symfony 2.7.x before 2.7.50 2.8.x before 2.8.49 3.x before 3.4.20 4.0.x before 4.0.15 4.1.x before 4.1.9 and 4.2.x before 4.2.1. When using the scalar type hint `string` in a setter method (e.g. `setName(string $name)`) of a class that's the `data_class` of a form and when a file upload is submitted to the corresponding field instead of a normal text input then `UploadedFile::__toString()` is called which will then return and disclose the path of the uploaded file. If combined with a local file inclusion issue in certain circumstances this could escalate it to a Remote Code Execution.


Vanilla before 2.5.5 and 2.6.x before 2.6.2 allows Remote Code Execution because authenticated administrators have a reachable call to unserialize in the Gdn_Format class.


A File Write can occur for specially crafted PDF files in Foxit Reader SDK (ActiveX) Professional 5.4.0.1031 when the JavaScript API Doc.exportAsFDF is used. An attacker can leverage this to gain remote code execution.


In

Foxit

Reader

SDK

(ActiveX)

Professional

an

uninitialized

object

in

IReader_ContentProvider::GetDocEventHandler

occurs

when

embedding

the

control

into

Office

documents.

By

opening

a

specially

crafted

document

an

attacker

can

trigger

an

out

of

bounds

write

condition

possibly

leveraging

this

to

gain

remote

code

execution.


Passing an absolute path to a file_exists check in phpBB before 3.2.4 allows Remote Code Execution through Object Injection by employing Phar deserialization when an attacker has access to the Admin Control Panel with founder permissions.


An issue was discovered in the MQTT server in Contiki-NG before 4.2. The function parse_publish_vhdr() that parses MQTT PUBLISH messages with a variable length header uses memcpy to input data into a fixed size buffer. The allocated buffer can fit only MQTT_MAX_TOPIC_LENGTH (default 64) bytes and a length check is missing. This could lead to Remote Code Execution via a stack-smashing attack (overwriting the function return address). Contiki-NG does not separate the MQTT server from other servers and the OS modules so access to all memory regions is possible.


A use after free in the TextBox field Validate action in IReader_ContentProvider can occur for specially crafted PDF files in Foxit Reader SDK (ActiveX) Professional 5.4.0.1031. An attacker can leverage this to gain remote code execution. Relative to CVE-2018-19452 this has a different free location and requires different JavaScript code for exploitation.


NETGEAR XR500 devices before 2.3.2.32 are affected by remote code execution by unauthenticated attackers via the traceroute handler.


An issue was discovered in Foxit PhantomPDF before 8.3.6. It allows Remote Code Execution via a GoToE or GoToR action.


NETGEAR XR500 devices before 2.3.2.32 are affected by remote code execution by unauthenticated attackers.


A remote code execution vulnerability exists when Windows does not properly handle specially crafted image files aka \Windows Remote Code Execution Vulnerability.\ This affects Windows 7 Windows Server 2012 R2 Windows RT 8.1 Windows Server 2008 Windows Server 2012 Windows 8.1 Windows Server 2016 Windows Server 2008 R2 Windows 10 Windows 10 Servers.


A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory aka \Microsoft Excel Remote Code Execution Vulnerability.\ This affects Microsoft Office Microsoft Excel. This CVE ID is unique from CVE-2018-8147 CVE-2018-8148.


A remote code execution vulnerability exists in the way that Microsoft Outlook parses specially modified rule export files aka \Microsoft Outlook Remote Code Execution Vulnerability.\ This affects Office 365 ProPlus Microsoft Office Microsoft Outlook. This CVE ID is unique from CVE-2018-8522 CVE-2018-8524 CVE-2018-8576.


A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory aka \Microsoft Excel Remote Code Execution Vulnerability.\ This affects Office 365 ProPlus Microsoft Office Microsoft Excel. This CVE ID is unique from CVE-2018-8597.


A remote code execution vulnerability exists when Microsoft Publisher fails to utilize features that lock down the Local Machine zone when instantiating OLE objects aka \Microsoft Publisher Remote Code Execution Vulnerability.\ This affects Microsoft Publisher.


A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory aka \Microsoft Word Remote Code Execution Vulnerability.\ This affects Microsoft Word Office 365 ProPlus Microsoft Office. This CVE ID is unique from CVE-2018-8539.


A remote code execution vulnerability exists in Microsoft Outlook software when it fails to properly handle objects in memory aka \Microsoft Outlook Remote Code Execution Vulnerability.\ This affects Office 365 ProPlus Microsoft Office Microsoft Outlook. This CVE ID is unique from CVE-2018-8522 CVE-2018-8576 CVE-2018-8582.


A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory aka \Microsoft Office Remote Code Execution Vulnerability.\ This affects Microsoft Office. This CVE ID is unique from CVE-2018-8158 CVE-2018-8161.


A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory aka \Microsoft Office Remote Code Execution Vulnerability.\ This affects Microsoft Excel Viewer Microsoft PowerPoint Viewer Microsoft Office Microsoft Office Word Viewer.


A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory aka \Microsoft Excel Remote Code Execution Vulnerability.\ This affects Microsoft Office Office 365 ProPlus Microsoft Excel Microsoft Excel Viewer Excel. This CVE ID is unique from CVE-2018-8574.


A remote code execution vulnerability exists when \Windows Theme API\ does not properly decompress files aka \Windows Theme API Remote Code Execution Vulnerability.\ This affects Windows 7 Windows Server 2012 R2 Windows RT 8.1 Windows Server 2019 Windows Server 2012 Windows 8.1 Windows Server 2016 Windows Server 2008 R2 Windows 10 Windows 10 Servers.


A remote code execution vulnerability exists in Microsoft PowerPoint software when the software fails to properly handle objects in Protected View aka \Microsoft PowerPoint Remote Code Execution Vulnerability.\ This affects Office 365 ProPlus PowerPoint Viewer Microsoft Office Microsoft PowerPoint.


A remote code execution vulnerability exists in Visual Studio software when the software does not check the source markup of a file for an unbuilt project aka \Visual Studio Remote Code Execution Vulnerability.\ This affects Microsoft Visual Studio Expression Blend 4.


A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input aka \MS XML Remote Code Execution Vulnerability.\ This affects Windows 7 Windows Server 2012 R2 Windows RT 8.1 Windows Server 2008 Windows Server 2019 Windows Server 2012 Windows 8.1 Windows Server 2016 Windows Server 2008 R2 Windows 10 Windows 10 Servers.


A remote code execution vulnerability exists in Windows Domain Name System (DNS) servers when they fail to properly handle requests aka \Windows DNS Server Heap Overflow Vulnerability.\ This affects Windows Server 2012 R2 Windows Server 2019 Windows Server 2016 Windows 10 Windows 10 Servers.


A remote code execution vulnerability exists when Windows Search handles objects in memory aka \Windows Search Remote Code Execution Vulnerability.\ This affects Windows 7 Windows Server 2012 R2 Windows RT 8.1 Windows Server 2008 Windows Server 2012 Windows 8.1 Windows Server 2016 Windows Server 2008 R2 Windows 10 Windows 10 Servers.


A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory aka \Microsoft Excel Remote Code Execution Vulnerability.\ This affects Microsoft Office Microsoft Excel. This CVE ID is unique from CVE-2018-8148 CVE-2018-8162.


A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest operating system aka \Windows Hyper-V Remote Code Execution Vulnerability.\ This affects Windows Server 2016 Windows 10 Windows Server 2019 Windows 10 Servers. This CVE ID is unique from CVE-2018-8489.


A remote code execution vulnerability exists in the way that Microsoft Graphics Components handle objects in memory aka \Microsoft Graphics Components Remote Code Execution Vulnerability.\ This affects Windows 7 Microsoft Office Microsoft Office Word Viewer Office 365 ProPlus Microsoft Excel Viewer Microsoft PowerPoint Viewer Windows Server 2019 Windows Server 2008 R2 Windows 10 Windows Server 2008.