Unspecified vulnerability in Mozilla Firefox before 1.5.0.8 Thunderbird before 1.5.0.8 and SeaMonkey before 1.0.6 allows remote attackers to execute arbitrary code via the XML.prototype.hasOwnProperty JavaScript function.


Unspecified vulnerability in Mozilla Firefox before 2.0.0.13 Thunderbird before 2.0.0.13 and SeaMonkey before 1.1.9 allows remote attackers to execute arbitrary code via \XPCNativeWrapper pollution.\


Unspecified vulnerability in Novell iPrint Client before 5.82 allows remote attackers to execute arbitrary code via an op-client-interface-version action.


Unspecified vulnerability in Novell Vibe OnPrem 3.0 before Hot Patch 1 allows remote attackers to execute arbitrary code via unknown vectors.


Unspecified vulnerability in Opera before 9.25 allows remote attackers to execute arbitrary code via crafted TLS certificates.


Unspecified vulnerability in Opera Mail before 2016-02-16 on Windows allows user-assisted remote attackers to execute arbitrary code via a crafted e-mail message.


Unspecified vulnerability in Opera before 9.51 on Windows allows attackers to execute arbitrary code via unknown vectors.


Unspecified vulnerability in SAP Sybase Adaptive Server Enterprise (ASE) before 15.0.3 ESD#4.3. 15.5 before 15.5 ESD#5.3 and 15.7 before 15.7 SP50 or 15.7 SP100 allows remote authenticated users to execute arbitrary code via unspecified vectors.


Unspecified vulnerability in Sun Java System Access Manager 7.1 when installed in a Sun Java System Application Server 8.x container allows remote attackers to execute arbitrary code via unspecified vectors.


Unspecified vulnerability in Sun OpenSolaris snv_100 through snv_101 allows local users with privileges in a non-global zone to execute arbitrary code in the global zone when a global-zone user is using mdb on a non-global zone process.


A Vulnerability in the firmware of COMMAX WallPad(CDP-1020MB) allow an unauthenticated adjacent attacker to execute arbitrary code because of a using the old version of MySQL.


Unspecified vulnerability in the Archive Query Server in HP Application Information Optimizer (formerly HP Database Archiving) 6.2 6.3 6.4 and 7.0 allows remote attackers to execute arbitrary code via unknown vectors aka ZDI-CAN-1666.


Unspecified vulnerability in the Integration Service in HP Universal Configuration Management Database 10.01 and 10.10 allows remote authenticated users to execute arbitrary code via unknown vectors aka ZDI-CAN-1977.


Unspecified vulnerability in the vsflex8l ActiveX control in IBM SPSS SamplePower 3.0.1 before FP1 IF1 allows remote attackers to execute arbitrary code via a crafted ComboList property value.


Unspecified vulnerability in the client component in HP Application LifeCycle Management (ALM) before 11 p11 allows remote attackers to execute arbitrary code via unknown vectors aka ZDI-CAN-1327.


Unspecified vulnerability in the GossipService SOAP Request implementation in the Synchronizer component before 1.4.2 in HP Application LifeCycle Management (ALM) allows remote attackers to execute arbitrary code via unknown vectors aka ZDI-CAN-1759.


Unspecified vulnerability in the olch2x32 ActiveX control in IBM SPSS SamplePower 3.0 before 3.0-IM-S3SAMPC-WIN32-FP001 allows remote attackers to execute arbitrary code via unknown vectors.


A vulnerability in the Snake YAML parser of Magnolia CMS v6.2.3 and below allows attackers to execute arbitrary code via a crafted YAML file.


Unspecified vulnerability in the client components in Citrix Access Gateway Standard Edition before 4.5.5 and Advanced Edition before 4.5 HF1 allows attackers to execute arbitrary code via unspecified vectors.


Unspecified vulnerability in the skype4com URI handler in Skype before 3.6 GOLD allows remote attackers to execute arbitrary code via \short string values\ that result in heap corruption.


Unspecified vulnerability in the Win32 API on Microsoft Windows 2000 XP SP2 and Server 2003 SP1 and SP2 allows remote attackers to execute arbitrary code via certain parameters to an unspecified function.


Unspecified vulnerability in the HP Power Manager Remote Agent (RA) 4.0Build10 and earlier in HP-UX B.11.11 and B.11.23 allows local users to execute arbitrary code via unspecified vectors.


Unspecified vulnerability in the authentication mechanism in Solaris Management Console (SMC) on Sun Solaris 8 through 10 before 20070605 allows remote authenticated users to execute arbitrary code via unspecified vectors related to the WBEM server.


Unspecified vulnerability in the logging mechanism in Solaris Management Console (SMC) on Sun Solaris 8 through 10 before 20070605 allows remote attackers to execute arbitrary code via unspecified vectors related to the WBEM server.


Unspecified vulnerability in the WebTier component in HP Service Manager (SM) 7.21 and 9.x before 9.34 allows remote attackers to execute arbitrary code via unknown vectors.


Unspecified vulnerability in the NSM XDB service in Juniper NSM before 2012.2R8 allows remote attackers to execute arbitrary code via unspecified vectors.


Unspecified vulnerability in the server in IBM Rational Software Architect Design Manager 4.0.6 allows remote authenticated users to execute arbitrary code via a crafted update site.


Unspecified vulnerability in the management interface in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway 10.x before 10.1-129.11 and 10.5 before 10.5-50.10 allows remote attackers to execute arbitrary code via unknown vectors.


Unspecified vulnerability in the ke DomPDF extension before 0.0.5 for TYPO3 allows remote attackers to execute arbitrary code via unknown vectors.


Unspecified vulnerability in the CWT Frontend Edit (cwt_feedit) extension before 1.2.5 for TYPO3 allows remote authenticated users to execute arbitrary code via unknown vectors.


Unspecified vulnerability in the Broadcom Integrated NIC Management Firmware 1.x before 1.40.0.0 and 8.x before 8.08 on the HP Small Form Factor and Microtower platforms allows remote attackers to execute arbitrary code via unknown vectors.


Unspecified vulnerability in the SIP implementation in Cisco IOS 12.3 and 12.4 allows remote attackers to execute arbitrary code via a malformed SIP message aka Bug ID CSCsz48680 the \SIP Message Processing Arbitrary Code Execution Vulnerability.\


Unspecified vulnerability in the SIP implementation in Cisco IOS 12.3 and 12.4 allows remote attackers to execute arbitrary code via a malformed SIP message aka Bug ID CSCsz89904 the \SIP Packet Parsing Arbitrary Code Execution Vulnerability.\


Unspecified vulnerability in the BIOS in Intel Desktop Board DB DG DH DP and DQ Series allows local administrators to execute arbitrary code in System Management Mode (SSM) via unknown attack vectors.


Unspecified vulnerability in the Agent in HP LoadRunner before 9.50 and HP Performance Center before 9.50 allows remote attackers to execute arbitrary code via unknown vectors.


Unspecified vulnerability in the JW Calendar (jw_calendar) extension 1.3.20 and earlier for TYPO3 allows remote attackers to execute arbitrary code via unknown vectors.


Unspecified vulnerability in the Tiny Market (hm_tinymarket) extension 0.5.4 and earlier for TYPO3 allows attackers to execute arbitrary code via unknown vectors.


A vulnerability in the component /languages/index.php of WBCE CMS v1.5.2 allows attackers to execute arbitrary code via a crafted PHP file.


A vulnerability in the component /templates/install.php of WBCE CMS v1.5.2 allows attackers to execute arbitrary code via a crafted PHP file.


Unspecified vulnerability in the Sender module in HP Remote Graphics Software (RGS) 5.1.3 through 5.2.6 allows remote authenticated users to execute arbitrary code via unknown vectors.


Unspecified vulnerability in the wberuntimeear application in the test servlet in IBM WebSphere Business Events 6.1 and 6.2 allows remote attackers to execute arbitrary code via unknown vectors.


Unspecified vulnerability in the Mozilla plug-in in Adobe Reader and Acrobat 8.x before 8.1.7 and possibly 7.x before 7.1.4 and 9.x before 9.2 might allow remote attackers to execute arbitrary code via unknown vectors.


Unspecified vulnerability in the Solaris Trusted Extensions Policy configuration in Sun Solaris 10 and OpenSolaris snv_37 through snv_125 might allow remote attackers to execute arbitrary code by leveraging access to the X server.


Unspecified vulnerability in the Indeo codec in Microsoft Windows 2000 SP4 XP SP2 and SP3 and Server 2003 SP2 allows remote attackers to execute arbitrary code via crafted media content as reported to Microsoft by Dave Lenoe of Adobe.


Unknown vulnerability in the rwho daemon (in.rwhod) for Solaris 7 through 9 allows remote attackers to execute arbitrary code.


Unknown vulnerability in the H.323 protocol implementation in Windows 98 Windows 2000 Windows XP and Windows Server 2003 allows remote attackers to execute arbitrary code.


A vulnerability in the backup and restore functionality of Cisco FireSIGHT System Software could allow an authenticated local attacker to execute arbitrary code on a targeted system. More Information: CSCvc91092. Known Affected Releases: 6.2.0 6.2.1.


Unspecified vulnerability in the Business Rules Framework (CRM-BF-BRF) in SAP CRM allows attackers to execute arbitrary code via unknown vectors aka SAP Security Note 2097534.


Unspecified vulnerability in the image module in Exponent CMS before 0.96.5 RC 1 allows remote attackers to execute arbitrary code via unknown vectors involving \parsed PHP.\


Unspecified vulnerability in the Server service in Microsoft Windows 2000 SP4 Server 2003 SP1 and earlier and XP SP2 and earlier allows remote attackers to execute arbitrary code via a crafted packet aka \SMB Rename Vulnerability.\


Unspecified vulnerability in the Webservices for TYPO3 (typo3_webservice) extension before 0.3.8 for TYPO3 allows remote authenticated users to execute arbitrary code via unknown vectors.


Unspecified vulnerability in the client in Novell GroupWise 8.0 before Support Pack 3 and 2012 before Support Pack 1 on Windows allows user-assisted remote attackers to execute arbitrary code via a crafted file.


Unspecified vulnerability in the Render method in the ExportHTML.ocx ActiveX control in ExportHTML.dll in IBM SPSS Dimensions 5.5 and SPSS Data Collection 5.6 6.0 and 6.0.1 allows remote attackers to execute arbitrary code via a crafted HTML document.


Unspecified vulnerability in the RV40 codec in RealNetworks RealPlayer 11.x 14.x and 15.x before 15.02.71 and RealPlayer SP 1.0 through 1.1.5 allows remote attackers to execute arbitrary code via a crafted RV40 RealVideo video stream.


Unspecified vulnerability in the SetLicenseInfoEx method in an ActiveX control in mraboutb.dll in IBM SPSS Dimensions 5.5 and SPSS Data Collection 5.6 6.0 and 6.0.1 allows remote attackers to execute arbitrary code via a crafted HTML document.


A vulnerability in the vae_admin_rule database table of vaeThink v1.0.1 allows attackers to execute arbitrary code via a crafted payload in the condition parameter.


Unspecified vulnerability in the (1) Xsun and (2) Xprt commands in Solaris 7 8 9 and 10 allows local users to execute arbitrary code.


Unknown vulnerability in the net-svc script on Solaris 10 allows remote authenticated users to execute arbitrary code on a DHCP client via certain DHCP responses.


Unspecified vulnerability in the www_add method in Asset.pm in Plain Black WebGUI 6.3.0 and other versions before 6.7.6 allows attackers to execute arbitrary code via unknown attack vectors.


Unknown vulnerability in the rlogin KIO subsystem (rlogin.protocol) of KDE 2.x 2.1 and later and KDE 3.x 3.0.4 and earlier allows local and remote attackers to execute arbitrary code via a certain URL.


Unknown vulnerability in the telnet KIO subsystem (telnet.protocol) of KDE 2.x 2.1 and later allows local and remote attackers to execute arbitrary code via a certain URL.


Unspecified vulnerability in the Dictionary (rtgdictionary) extension 0.1.9 and earlier for TYPO3 allows attackers to execute arbitrary code via unknown vectors.


Unspecified vulnerability in the Simba MDrmSap ActiveX control in mdrmsap.dll in SAP SAPgui allows remote attackers to execute arbitrary code via unknown vectors involving instantiation by Internet Explorer.


Unspecified vulnerability in the TYPO3 Secure Directory (kw_secdir) extension before 1.0.2 allows remote attackers to execute arbitrary code via unknown vectors related to \injection of control characters.\


Unspecified vulnerability in the WEC Discussion Forum (wec_discussion) extension 1.6.2 and earlier for TYPO3 allows attackers to execute arbitrary code via vectors related to \certain file types.\


Unspecified vulnerability in the Fileshare module for Drupal allows remote authenticated users with node-creation privileges to execute arbitrary code via unspecified vectors.


Unspecified vulnerability in the ADMIN_SP_C procedure (SYSPROC.ADMIN_SP_C) in IBM DB2 UDB before 8.2 Fixpak 16 9.1 before FP4a and 9.5 before FP1 allows remote authenticated users to execute arbitrary code via unspecified attack vectors.


Unspecified vulnerability in the Meta Tags (aka Nodewords) 5.x-1.6 module for Drupal when images are permitted in node bodies allows remote authenticated users to execute arbitrary code via unspecified vectors involving creation of a node.


Unspecified vulnerability in the file browser in Kiwi before 3.74.2 as used in SUSE Studio 1.1 before 1.1.4 allows remote attackers to execute arbitrary code via a crafted filename.


Unspecified vulnerability in the Oracle GlassFish Server component in Oracle Sun Products Suite 2.1.1 and 3.0.1 allows remote attackers to execute arbitrary code via unknown vectors related to Administration.


Unspecified vulnerability in the ATRC codec in RealNetworks RealPlayer before 15.0.0 and Mac RealPlayer before 12.0.0.1703 allows remote attackers to execute arbitrary code via unknown vectors.


Unspecified vulnerability in the RV20 codec in RealNetworks RealPlayer before 15.0.0 and Mac RealPlayer before 12.0.0.1703 allows remote attackers to execute arbitrary code via unknown vectors.


Unspecified vulnerability in Trend Micro ServerProtect 5.7 and 5.58 allows remote attackers to execute arbitrary code via vectors related to obtaining \administrative access to the RPC interface.\


A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow remote attackers to execute arbitrary code on affected installations. Authentication is required to exploit this vulnerability.


Unspecified vulnerability on the HP LeftHand Virtual SAN Appliance hydra with software before 10.0 allows remote attackers to execute arbitrary code via unknown vectors aka ZDI-CAN-1510.


Unspecified vulnerability on the TANDBERG Video Communication Server (VCS) before X5.0 allows remote attackers to execute arbitrary code via unknown vectors aka Reference ID 69773.


Unspecified vulnerability on the HP LeftHand Virtual SAN Appliance hydra with software before 10.0 allows remote attackers to execute arbitrary code via unknown vectors aka ZDI-CAN-1512.


Unspecified vulnerability on the HP LeftHand Virtual SAN Appliance hydra with software before 10.0 allows remote attackers to execute arbitrary code via unknown vectors aka ZDI-CAN-1513.


Unspecified vulnerability on the HP LeftHand Virtual SAN Appliance hydra with software before 10.0 allows remote attackers to execute arbitrary code via unknown vectors aka ZDI-CAN-1511.


Unspecified vulnerability on the HP LeftHand Virtual SAN Appliance hydra with software before 10.0 allows remote attackers to execute arbitrary code via unknown vectors aka ZDI-CAN-1468.


The web interface for AWStats 6.4 and 6.5 when statistics updates are enabled allows remote attackers to execute arbitrary code via shell metacharacters in the migrate parameter.


The web server on Cisco DPC3010 DPC3212 DPC3825 DPC3925 DPQ3925 EPC3010 EPC3212 EPC3825 and EPC3925 Wireless Residential Gateway products allows remote attackers to execute arbitrary code via a crafted HTTP request aka Bug ID CSCup40808.


Cisco WebEx Meetings Server 2.5MR1 allows remote authenticated users to execute arbitrary code via a crafted command parameter aka Bug ID CSCus56138.


Cisco WebEx Meetings Server 2.6 allows remote attackers to execute arbitrary commands by injecting these commands into an application script aka Bug ID CSCuy83130.


BEA WebLogic Server and Express 6.0 through 7.0 does not properly restrict access to certain internal servlets that perform administrative functions which allows remote attackers to read arbitrary files or execute arbitrary code.


Microsoft Windows Media Player 10 through 12 allows remote attackers to execute arbitrary code via a crafted DataObject on a web site aka \Windows Media Player RCE via DataObject Vulnerability.\


Unquoted Windows search path vulnerability in NSClient++ before 0.4.1.73 allows non-privileged local users to execute arbitrary code with elevated privileges on the system via a malicious program.exe executable in the %SYSTEMDRIVE% folder.


CVS 1.12.x when configured to use SSH for remote repositories might allow remote attackers to execute arbitrary code via a repository URL with a crafted hostname as demonstrated by \-oProxyCommand=id;localhost:/bar.\


xorg-x11-server before 1.19.5 was missing length validation in MIT-SCREEN-SAVER extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code.


xorg-x11-server before 1.19.5 was missing length validation in XFree86 DGA extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code.


xorg-x11-server before 1.19.5 had wrong extra length check in ProcXIChangeHierarchy function allowing malicious X client to cause X server to crash or possibly execute arbitrary code.


xorg-x11-server before 1.19.5 was missing length validation in XINERAMA extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code.


xorg-x11-server before 1.19.5 was missing length validation in XFree86 VidModeExtension allowing malicious X client to cause X server to crash or possibly execute arbitrary code.


xorg-x11-server before 1.19.5 was missing length validation in X-Resource extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code.


xorg-x11-server before 1.19.5 was missing length validation in XFree86 DRI extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code.


xorg-x11-server before 1.19.5 was missing length validation in RENDER extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code.


xorg-x11-server before 1.19.5 was missing extra length validation in ProcEstablishConnection function allowing malicious X client to cause X server to crash or possibly execute arbitrary code.


xorg-x11-server before 1.19.5 was missing length validation in XFIXES extension allowing malicious X client to cause X server to crash or possibly execute arbitrary code.


Microsoft XML Core Services (aka MSXML) 3.0 5.0 and 6.0 does not properly parse XML content which allows remote attackers to execute arbitrary code via a crafted web page aka \MSXML Integer Truncation Vulnerability.\


Microsoft XML Core Services (aka MSXML) 4.0 5.0 and 6.0 does not properly parse XML content which allows remote attackers to execute arbitrary code via a crafted web page aka \MSXML XSLT Vulnerability.\


An arbitrary code execution vulnerability exists in Micro Focus Application Performance Management affecting versions 9.40 9.50 and 9.51. The vulnerability could allow remote attackers to execute arbitrary code on affected installations of APM.


An arbitrary code execution vulnerability exists in Liquibase Runner Plugin version 1.3.0 and older that allows an attacker with permission to configure jobs to load and execute arbitrary code on the Jenkins master JVM.


A arbitrary code execution vulnerability exists in the way that the Stove client improperly validates input value. An attacker could execute arbitrary code when the user access to crafted web page. This issue affects: Smilegate STOVE Client 0.0.4.72.


Blink XT2 Sync Module firmware prior to 2.13.11 allows remote attackers to execute arbitrary commands on the device due to improperly sanitized input when retrieving internal network configuration data.

arbitrary code execution
arbitrary command execution


Adobe ColdFusion 9.0 9.0.1 and 9.0.2 when a password is not configured allows remote attackers to bypass authentication and possibly execute arbitrary code via unspecified vectors as exploited in the wild in January 2013.

arbitrary code execution
bypass authentication


The APISiteScopeImpl SOAP service in HP SiteScope 10.1x and 11.x before 11.22 allows remote attackers to bypass authentication and execute arbitrary code via a direct request to the issueSiebelCmd method aka ZDI-CAN-1765.


administrator.cfc in Adobe ColdFusion 9.0 9.0.1 9.0.2 and 10 allows remote attackers to bypass authentication and possibly execute arbitrary code by logging in to the RDS component using the default empty password and leveraging this session to access the administrative web interface as exploited in the wild in January 2013.


in

Ruby

on

Rails

before

and

before

does

not

properly

convert

JSON

data

to

YAML

data

for

processing

by

a

YAML

parser

which

allows

remote

attackers

to

execute

arbitrary

code

conduct

SQL

injection

attacks

or

bypass

authentication

via

crafted

data

that

triggers

unsafe

decoding

a

different

vulnerability

than


This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of multiple NETGEAR routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the mini_httpd service which listens on TCP port 80 by default. The issue results from incorrect string matching logic when accessing protected pages. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root. Was ZDI-CAN-13313.


This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R7800. Authentication is not required to exploit this vulnerability. The specific flaw exists within the apply_save.cgi endpoint. This issue results from the use of hard-coded encryption key. An attacker can leverage this vulnerability to execute arbitrary code in the context of root. Was ZDI-CAN-12287.


The

Scheduler

Service

(VxSchedService.exe)

in

Symantec

Storage

Foundation

for

Windows

allows

remote

attackers

to

bypass

authentication

and

execute

arbitrary

code

via

certain

requests

to

the

service

socket

that

create

PreScript

or

PostScript

registry

values

under

Veritas\\VxSvc\\CurrentVersion\\Schedules

specifying

future

command

execution.


Unspecified vulnerability in Rational Soft Hidden Administrator 1.7 and earlier allows remote attackers to bypass authentication and execute arbitrary code via unspecified vectors. NOTE: this issue has no actionable information and perhaps should not be included in CVE.


HP HP-UX B.11.11 B.11.23 and B.11.31 when the PAM configuration includes libpam_updbe allows remote authenticated users to bypass authentication and consequently execute arbitrary code via unspecified vectors.


The administrative web console on the TANDBERG Video Communication Server (VCS) before X4.3 uses predictable session cookies in (1) tandberg/web/lib/secure.php and (2) tandberg/web/user/lib/secure.php which makes it easier for remote attackers to bypass authentication and execute arbitrary code by loading a custom software update via a crafted \Cookie: tandberg_login=\ HTTP header.


This vulnerability allows remote attackers to bypass authentication on vulnerable installations of NetGain Systems Enterprise Manager 7.2.699 build 1001. User interaction is required to exploit this vulnerability. The specific flaw exists within the MainFilter servlet. The issue results from the lack of proper string matching inside the doFilter method. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of Administrator. Was ZDI-CAN-5099.


PlaNet Concept planetNews allows remote attackers to bypass authentication and execute arbitrary code via a direct request to news/admin/planetnews.php.


This vulnerability allows remote attackers to bypass authentication on vulnerable installations of Quest NetVault Backup 11.2.0.13. The specific flaw exists within JSON RPC Request handling. By setting the checksession parameter to a specific value it is possible to bypass authentication to critical functions. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-4752.


This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DAP-2610 Firmware v2.01RC067 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of passwords. The issue results from the lack of proper password checking. An attacker can leverage this vulnerability to execute arbitrary code in the context of root. Was ZDI-CAN-10082.


This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DAP-1330 1.10B01 BETA Wi-Fi range extenders. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of HNAP login requests. The issue results from the lack of proper handling of cookies. An attacker can leverage this vulnerability to execute arbitrary code on the router. Was ZDI-CAN-9554.


This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-867 DIR-878 and DIR-882 routers with firmware 1.10B04. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of HNAP login requests. The issue results from the lack of proper handling of empty passwords. An attacker can leverage this vulnerability to execute arbitrary code on the router. Was ZDI-CAN-9471.


This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-842 3.13B05 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of HNAP GetCAPTCHAsetting requests. The issue results from the lack of proper handling of sessions. An attacker can leverage this vulnerability to execute arbitrary code in the context of the device. Was ZDI-CAN-10083.


This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the UPnP service which listens on TCP port 5000. A crafted UPnP message can be used to bypass authentication. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-9642.


The logcheck function in session.inc in AlienVault OSSIM before 5.3.1 when an action has been created and USM before 5.3.1 allows remote attackers to bypass authentication and consequently obtain sensitive information modify the application or execute arbitrary code as root via an \AV Report Scheduler\ HTTP User-Agent header.


The Java Console in IBM Domino 8.5.x before 8.5.3 FP6 IF13 and 9.x before 9.0.1 FP6 when a certain unsupported configuration involving UNC share pathnames is used allows remote attackers to bypass authentication and possibly execute arbitrary code via unspecified vectors aka SPR KLYHA7MM3J. NOTE: this vulnerability exists because of an incomplete fix for CVE-2011-0920.


index.php in Fusion SBX 1.2 and earlier does not properly use the extract function which allows remote attackers to bypass authentication by setting the is_logged parameter or execute arbitrary code via the maxname2 parameter.


includes/library.php in netOffice Dwins 1.3 p2 compares the demoSession variable to the 'true' string literal instead of the true boolean literal which allows remote attackers to bypass authentication and execute arbitrary code by setting this variable to 1 as demonstrated by uploading a PHP script via an add action to projects_site/uploadfile.php.


The remote console in the Server Controller in IBM Lotus Domino 7.x and 8.x verifies credentials against a file located at a UNC share pathname specified by the client which allows remote attackers to bypass authentication and consequently execute arbitrary code by placing this pathname in the COOKIEFILE field. NOTE: this might overlap CVE-2011-0920.


The Remote Console in IBM Lotus Domino when a certain unsupported configuration involving UNC share pathnames is used allows remote attackers to bypass authentication and execute arbitrary code via unspecified vectors aka SPR PRAD89WGRS.


admin.php in PHP Outburst Easynews 4.4.1 and earlier when register_globals is enabled allows remote attackers to bypass authentication and gain the ability to execute arbitrary code via the en_login_id parameter.


Unspecified vulnerability in the command-line management interface on Siemens Scalance W7xx devices with firmware before 4.5.4 allows remote attackers to bypass authentication and execute arbitrary code via a (1) SSH or (2) TELNET connection.


Code injection in SonicWall SMA100 allows an authenticated user to execute arbitrary code in viewcacert CGI script. This vulnerability impacted SMA100 version 9.0.0.4 and earlier.


A CWE-94: Code Injection vulnerability exists in ProClima (all versions prior to version 8.0.0) which could allow an unauthenticated remote attacker to execute arbitrary code on the targeted system in all versions of ProClima prior to version 8.0.0.


Unspecified vulnerability in the Statutory Reporting for Insurance (FS_SR) component in the Financial Services module for SAP ERP Central Component (ECC) allows attackers to execute arbitrary code via unspecified vectors related to a \code injection vulnerability.\


PHP Code Injection vulnerability in FUDforum Bulletin Board Software 3.0.4 could allow remote attackers to execute arbitrary code on the system.


Chamilo LMS v1.11.14 was discovered to contain a zero click code injection vulnerability which allows attackers to execute arbitrary code via a crafted plugin. This vulnerability is triggered through user interaction with the attacker's profile page.


cpie.php in XCMS 1.83 and earlier sends a redirect to the web browser but does not exit which allows remote attackers to conduct direct static code injection attacks and execute arbitrary code via the testo_0 parameter in a cpie admin action to index.php which writes to dati/generali/footer.dtb (aka the XCMS footer).


Cloud Foundry Foundation BOSH Azure CPI v22 could potentially allow a maliciously crafted stemcell to execute arbitrary code on VMs created by the director aka a \CPI code injection vulnerability.\


module/shout/jafshout.php (aka the shoutbox) in ph03y3nk just another flat file (JAF) CMS 4.0 RC1 allows remote attackers to execute arbitrary code within sections bounded by \<?php\ and \?>\ possibly due to a static code injection vulnerability involving admin/data_inc.php.


Centers for Disease Control and Prevention MicrobeTRACE 0.1.11 allows remote attackers to execute arbitrary code related to code injection via a crafted CSV file with an initial 'Source<script type=\text/javascript\ src=' line. Fix released on 2018-03-28.


io/mongo/parser.py in Eve (aka pyeve) before 0.7.5 allows remote attackers to execute arbitrary code via Code Injection in the where parameter.


Centers for Disease Control and Prevention MicrobeTRACE 0.1.12 allows remote attackers to execute arbitrary code related to code injection via a crafted CSV file with an initial '><script type=\text/javascript\ src=' line. Fix released on 2018-03-29.


Citrix Secure Mail for Android before 20.11.0 suffers from Improper Control of Generation of Code ('Code Injection') by allowing unauthenticated access to read data stored within Secure Mail. Note that a malicious app would need to be installed on the Android device or a threat actor would need to execute arbitrary code on the Android device.


wifiscanner.js in thingsSDK WiFi Scanner 1.0.1 allows Code Injection because it can be used with options to overwrite the default executable/binary path and its arguments. An attacker can abuse this functionality to execute arbitrary code.


A code injection flaw was found in the way capacity and utilization imported control files are processed. A remote authenticated attacker with access to the capacity and utilization feature could use this flaw to execute arbitrary code as the user CFME runs as.


Code injection vulnerability in INTEL-SA-00086 Detection Tool before version 1.2.7.0 may allow a privileged user to potentially execute arbitrary code via local access.


The management console in Symantec IM Manager before 8.4.18 allows remote attackers to execute arbitrary code via unspecified vectors related to a \code injection issue.\


Command Injection vulnerability in McAfee Enterprise Security Manager (ESM) prior to 11.2.0 and prior to 10.4.0 allows authenticated user to execute arbitrary code via specially crafted parameters.

arbitrary code execution
command injection


devcert-sanscache before 0.4.7 allows remote attackers to execute arbitrary code or cause a Command Injection via the exec function. The variable `commonName` controlled by user input is used as part of the `exec` function without any sanitization.


An issue was discovered on Motorola C1 and M2 devices with firmware 1.01 and 1.07 respectively. This issue is a Command Injection allowing a remote attacker to execute arbitrary code and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the system function with untrusted input from the request body for the SetNTPServerSettings API function as demonstrated by shell metacharacters in the system_time_timezone field.


An issue was discovered on Motorola C1 and M2 devices with firmware 1.01 and 1.07 respectively. This issue is a Command Injection allowing a remote attacker to execute arbitrary code and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the system function with untrusted input from the request body for the SetSmartQoSSettings API function as demonstrated by shell metacharacters in the smartqos_priority_devices field.


An issue was discovered on Motorola C1 and M2 devices with firmware 1.01 and 1.07 respectively. This issue is a Command Injection allowing a remote attacker to execute arbitrary code and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the system function with untrusted input from the request body for the SetWLanACLSettings API function as demonstrated by shell metacharacters in the wl(0).(0)_maclist field.


An issue was discovered on Motorola C1 and M2 devices with firmware 1.01 and 1.07 respectively. This issue is a Command Injection allowing a remote attacker to execute arbitrary code and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the system function with untrusted input from the request body for the SetStaticRouteSettings API function as demonstrated by shell metacharacters in the staticroute_list field.


An issue was discovered on Motorola C1 and M2 devices with firmware 1.01 and 1.07 respectively. This issue is a Command Injection allowing a remote attacker to execute arbitrary code and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the system function with untrusted input from the request body for the SetNetworkTomographySettings API function as demonstrated by shell metacharacters in the tomography_ping_number field.


An OS command injection vulnerability in the discover_and_manage CGI script in NETSAS Enigma NMS 65.0.0 and prior allows an attacker to execute arbitrary code because of improper neutralization of shell metacharacters in the ip_address variable within an snmp_browser action.


In SaltStack Salt through 2019.2.0 the salt-api NET API with the ssh client enabled is vulnerable to command injection. This allows an unauthenticated attacker with network access to the API endpoint to execute arbitrary code on the salt-api host.


An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the system function with untrusted input from the request body for the SetStaticRouteIPv4Settings API function as demonstrated by shell metacharacters in the Gateway field.


An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the twsystem function with untrusted input from the request body for the SetIPv4FirewallSettings API function as demonstrated by shell metacharacters in the SrcIPv4AddressRangeStart field.


An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the system function with untrusted input from the request body for the SetQoSSettings API function as demonstrated by shell metacharacters in the IPAddress field.


An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the twsystem function with untrusted input from the request body for the SetSysEmailSettings API function as demonstrated by shell metacharacters in the SMTPServerPort field.


An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the twsystem function with untrusted input from the request body for the SetSysLogSettings API function as demonstrated by shell metacharacters in the IPAddress field.


An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the system function with untrusted input from the request body for the SetWebFilterSettings API function as demonstrated by shell metacharacters in the WebFilterURLs field.


An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the twsystem function with untrusted input from the request body for the SetIPv6FirewallSettings API function as demonstrated by shell metacharacters in the SrcIPv6AddressRangeStart field.


An issue was discovered on D-Link DIR-878 devices with firmware 1.12A1. This issue is a Command Injection allowing a remote attacker to execute arbitrary code and get a root shell. A command Injection vulnerability allows attackers to execute arbitrary OS commands via a crafted /HNAP1 POST request. This occurs when any HNAP API function triggers a call to the system function with untrusted input from the request body for the SetStaticRouteIPv6Settings API function as demonstrated by shell metacharacters in the DestNetwork field.


An OS command injection vulnerability in the Simple Certificate Enrollment Protocol (SCEP) feature of PAN-OS software allows an unauthenticated network-based attacker with specific knowledge of the firewall configuration to execute arbitrary code with root user privileges. The attacker must have network access to the GlobalProtect interfaces to exploit this issue. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.20-h1; PAN-OS 9.0 versions earlier than PAN-OS 9.0.14-h3; PAN-OS 9.1 versions earlier than PAN-OS 9.1.11-h2; PAN-OS 10.0 versions earlier than PAN-OS 10.0.8; PAN-OS 10.1 versions earlier than PAN-OS 10.1.3. Prisma Access customers with Prisma Access 2.1 Preferred and Prisma Access 2.1 Innovation firewalls are impacted by this issue.


Improper neutralization of special elements used in a command ('Command Injection') vulnerability in task management component in Synology Download Station before 3.8.16-3566 allows remote authenticated users to execute arbitrary code via unspecified vectors.


A Remote Command Injection vulnerability exists in DrayTek Vigor 2960 1.5.1.3 DrayTek Vigor 3900 1.5.1.3 and DrayTek Vigor 300B 1.5.1.3 via a crafted HTTP message containing malformed QUERY STRING in mainfunction.cgi which could let a remote malicious user execute arbitrary code.


A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2). The affected application incorrectly neutralizes special elements when creating batch operations which could lead to command injection. An authenticated remote attacker with administrative privileges could exploit this vulnerability to execute arbitrary code on the system with system privileges.


A vulnerability has been identified in Desigo CC (All versions with OIS Extension Module) GMA-Manager (All versions with OIS running on Debian 9 or earlier) Operation Scheduler (All versions with OIS running on Debian 9 or earlier) Siveillance Control (All versions with OIS running on Debian 9 or earlier) Siveillance Control Pro (All versions). The affected application incorrectly neutralizes special elements in a specific HTTP GET request which could lead to command injection. An unauthenticated remote attacker could exploit this vulnerability to execute arbitrary code on the system with root privileges.


Command Injection in Open PLC Webserver v3 allows remote attackers to execute arbitrary code via the \Hardware Layer Code Box\ component on the \/hardware\ page of the application.


Mesa Labs AmegaView version 3.0 is vulnerable to a command injection which may allow an attacker to remotely execute arbitrary code.


Proxy command injection vulnerability in Trend Micro OfficeScan 11 and XG (12) allows remote attackers to execute arbitrary code on vulnerable installations. The specific flaw can be exploited by parsing the tr parameter within Proxy.php. Formerly ZDI-CAN-4543.


Proxy command injection vulnerability in Trend Micro InterScan Messaging Virtual Appliance 9.0 and 9.1 allows remote attackers to execute arbitrary code on vulnerable installations. The specific flaw can be exploited by parsing the \T\ parameter within modTMCSS Proxy. Formerly ZDI-CAN-4745.


Proxy command injection vulnerability in Trend Micro OfficeScan 11 and XG (12) allows remote attackers to execute arbitrary code on vulnerable installations. The specific flaw can be exploited by parsing the T parameter within Proxy.php. Formerly ZDI-CAN-4544.


Proxy command injection vulnerability in Trend Micro InterScan Messaging Virtual Appliance 9.0 and 9.1 allows remote attackers to execute arbitrary code on vulnerable installations. The specific flaw can be exploited by parsing the \t\ parameter within modTMCSS Proxy. Formerly ZDI-CAN-4744.


Proxy command injection vulnerabilities in Trend Micro Mobile Security (Enterprise) versions before 9.7 Patch 3 allow remote attackers to execute arbitrary code on vulnerable installations.


An issue was discovered in certain Apple products. Safari before 11.0.2 is affected. The issue involves the \WebKit Web Inspector\ component. It allows remote attackers to execute arbitrary code via special characters that trigger command injection.


Ohcount 3.0.0 is prone to a command injection via specially crafted filenames containing shell metacharacters which can be exploited by an attacker (providing a source tree for Ohcount processing) to execute arbitrary code as the user running Ohcount.


The Shell in Microsoft Windows XP SP2 and SP3 Windows Server 2003 SP2 Windows Vista SP2 Windows Server 2008 SP2 R2 and R2 SP1 and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code via a crafted name for a (1) file or (2) directory aka \Command Injection Vulnerability.\


In some Lenovo ThinkServer-branded servers a command injection vulnerability exists in the BMC firmware download command. This allows a privileged user to download and execute arbitrary code inside the BMC. This can only be exploited by authorized privileged users.


A command injection remote command execution vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow a remote attacker to execute arbitrary code on vulnerable installations due to a flaw in the LauncherServer. Authentication is required to exploit this vulnerability.


A Command Injection issue was discovered in Nortek Linear eMerge E3 series Versions V0.32-07e and prior. A remote attacker may be able to execute arbitrary code on a target machine with elevated privileges.


A Command Injection issue in the traceroute feature on TP-Link TL-WR841N V13 (JP) with firmware versions prior to 201216 allows authenticated users to execute arbitrary code as root via shell metacharacters a different vulnerability than CVE-2018-12577.


Command Injection in Jfinal CMS v4.7.1 and earlier allows remote attackers to execute arbitrary code by uploading a malicious HTML template file via the component 'jfinal_cms/admin/filemanager/list'.


Command Injection in PHPMyWind v5.6 allows remote attackers to execute arbitrary code via the \text color\ field of the component '/admin/web_config.php'.


An issue was discovered in Rubrik 5.0.3-2296. An OS command injection vulnerability allows an authenticated attacker to remotely execute arbitrary code on Rubrik-managed systems.


Command Injection in PPGo_Jobs v2.8.0 allows remote attackers to execute arbitrary code via the 'AjaxRun()' function.


Two OS command injection vulnerabilities in the User Portal of Sophos XG Firewall through 2020-08-05 potentially allow an authenticated attacker to remotely execute arbitrary code.


A remote unauthenticated network based attacker with access to Junos Space may execute arbitrary code on Junos Space or gain access to devices managed by Junos Space using cross site request forgery (CSRF) default authentication credentials information leak and command injection attack vectors. All versions of Juniper Networks Junos Space prior to 15.1R3 are affected.


Cisco TelePresence Manager 1.2.x through 1.6.x allows remote attackers to perform unspecified actions and consequently execute arbitrary code via a crafted request to the Java RMI interface related to a \command injection vulnerability \ aka Bug ID CSCtf97085.


Insufficient data validation in crosh could lead to a command injection under chronos privileges in Networking in Google Chrome on Chrome OS prior to 61.0.3163.113 allowed a local attacker to execute arbitrary code via a crafted HTML page.


Command Injection vulnerability in McAfee Enterprise Security Manager (ESM) prior to 11.2.0 and prior to 10.4.0 allows authenticated user to execute arbitrary code via specially crafted parameters.


Command injection vulnerability in firmware_cgi in GL.iNet GL-AR300M-Lite devices with firmware 2.27 allows remote attackers to execute arbitrary code.


Command injection vulnerability in login_cgi in GL.iNet GL-AR300M-Lite devices with firmware 2.27 allows remote attackers to execute arbitrary code.


Command injection vulnerability in Trend Micro Smart Protection Server (Standalone) 3.1 and 3.2 server administration UI allows attackers with authenticated access to execute arbitrary code on vulnerable installations.


Command injection vulnerability in login.php in Synology Photo Station before 6.5.3-3226 allows remote attackers to execute arbitrary code via shell metacharacters in the crafted 'X-Forwarded-For' header.


Command injection vulnerability in Junos Space before 15.2R2 allows attackers to execute arbitrary code as a root user.


The ESS/ Network Controller and MicroServer Web Server components of Xerox WorkCentre and WorkCentre Pro 232 238 245 255 265 and 275 allow remote attackers to bypass authentication and execute arbitrary code via \WebUI command injection on TCP/IP hostname.\

arbitrary code execution
command injection
bypass authentication


A

cross-site

request

forgery

vulnerability

exists

in

Jenkins

Warnings

Next

Generation

Plugin

and

earlier

in

that

allows

attackers

to

execute

arbitrary

code

via

a

form

validation

HTTP

endpoint.

arbitrary code execution
cross site request forgery


Multiple

cross-site

request

forgery

(CSRF)

vulnerabilities

in

allow

remote

attackers

to

hijack

the

authentication

of

administrators

for

requests

that

execute

arbitrary

code

as

demonstrated

by

a

request

to

db/data/ext/GremlinPlugin/graphdb/execute_script

or

db/manage/server/console/.


Multiple cross-site request forgery (CSRF) vulnerabilities in HP Service Manager 9.30 9.31 9.32 and 9.33 allow remote attackers to hijack the authentication of unspecified victims for requests that (1) insert XSS sequences or (2) execute arbitrary code.


Multiple cross-site request forgery (CSRF) vulnerabilities in Jenkins before 1.514 LTS before 1.509.1 and Enterprise 1.466.x before 1.466.14.1 and 1.480.x before 1.480.4.1 allow remote attackers to hijack the authentication of administrators for requests that (1) execute arbitrary code or (2) initiate deployment of binaries to a Maven repository via unspecified vectors.


** DISPUTED ** The Command Line Interface (aka Server CLI or administration interface) in the master process in the reverse proxy server in Varnish before 2.1.0 does not require authentication for commands received through a TCP port which allows remote attackers to (1) execute arbitrary code via a vcl.inline directive that provides a VCL configuration file containing inline C code; (2) change the ownership of the master process via param.set stop and start directives; (3) read the initial line of an arbitrary file via a vcl.load directive; or (4) conduct cross-site request forgery (CSRF) attacks that leverage a victim's location on a trusted network and improper input validation of directives. NOTE: the vendor disputes this report saying that it is \fundamentally misguided and pointless.\


Cross-site request forgery (CSRF) vulnerabilities in (1) cp_forums.php (2) cp_usergroup.php (3) cp_ipbans.php (4) myhome.php (5) post.php or (6) moderator.php in Open Bulletin Board (OpenBB) 1.0.6 and earlier allow remote attackers to execute arbitrary code by including the code in an image tag or a link.


Cross-site request forgery (CSRF) vulnerability in Mongoose Web Server before 6.9 allows remote attackers to hijack the authentication of users for requests that modify Mongoose.conf via a request to __mg_admin?save. NOTE: this issue can be leveraged to execute arbitrary code remotely.


Cross-site request forgery (CSRF) vulnerability in NETGEAR DGN2200 routers with firmware 10.0.0.20 through 10.0.0.50 allows remote attackers to hijack the authentication of users for requests that perform DNS lookups via the host_name parameter to dnslookup.cgi. NOTE: this issue can be combined with CVE-2017-6334 to execute arbitrary code remotely.


Multiple cross-site request forgery (CSRF) vulnerabilities in Wing FTP Server before 4.4.7 allow remote attackers to hijack the authentication of administrators for requests that (1) execute arbitrary code via a crafted request to admin_lua_script.html or (2) add a domain administrator via a crafted request to admin_addadmin.html.


Cross-site request forgery (CSRF) vulnerability in Symantec Endpoint Protection Manager (SEPM) 12.1 before RU6-MP4 allows remote authenticated users to hijack the authentication of administrators for requests that execute arbitrary code by adding lines to a logging script.


Cross-site request forgery (CSRF) vulnerability in servlet/admin/AuthServlet.java in OpenKM 5.1.7 and other versions before 5.1.8-2 allows remote attackers to hijack the authentication of administrators for requests that execute arbitrary code via the script parameter to admin/scripting.jsp.


Multiple cross-site request forgery (CSRF) vulnerabilities in web@all 2.0 as downloaded before May 30 2012 allow remote attackers to hijack the authentication of administrators for requests that add delete or modify sensitive information as demonstrated by adding a file to execute arbitrary code via a do_addfile action to inc/browser/action.php.


In Honeywell WIN-PAK 4.7.2 Web and prior versions the affected product is vulnerable to a cross-site request forgery which may allow an attacker to remotely execute arbitrary code.


An issue was discovered in Gradle Enterprise 2018.2 - 2020.2.4. The CSRF prevention token is stored in a request cookie that is not annotated as HttpOnly. An attacker with the ability to execute arbitrary code in a user's browser could impose an arbitrary value for this token allowing them to perform cross-site request forgery.


Cross-site request forgery (CSRF) vulnerability in phpMyAdmin 2.11.x before 2.11.9.4 and 3.x before 3.1.1.0 allows remote attackers to perform unauthorized actions as the administrator via a link or IMG tag to tbl_structure.php with a modified table parameter. NOTE: other unspecified pages are also reachable but they have the same root cause. NOTE: this can be leveraged to conduct SQL injection attacks and execute arbitrary code.


Multiple cross-site request forgery (CSRF) vulnerabilities in cPanel possibly 11.18.3 and 11.19.3 allow remote attackers to (1) execute arbitrary code via the command1 parameter to frontend/x2/cron/editcronsimple.html and perform various administrative actions via (2) frontend/x2/sql/adddb.html (3) frontend/x2/sql/adduser.html and (4) frontend/x2/ftp/doaddftp.html.


Cross-site request forgery (CSRF) vulnerability in the JMX Console (jmx-console) in JBoss Enterprise Portal Platform before 5.2.2 BRMS Platform 5.3.0 before roll up patch1 and SOA Platform 5.3.0 allows remote authenticated users to hijack the authentication of arbitrary users for requests that perform operations on MBeans and possibly execute arbitrary code via unspecified vectors.


Best Practical Solutions RT 3.8.0 through 3.8.9 and 4.0.0rc through 4.0.0rc7 when the CustomFieldValuesSources (aka external custom field) option is enabled allows remote authenticated users to execute arbitrary code via unspecified vectors as demonstrated by a cross-site request forgery (CSRF) attack.


mappy.py in Splunk Web in Splunk 4.2.x before 4.2.5 does not properly restrict use of the mappy command to access Python classes which allows remote authenticated administrators to execute arbitrary code by leveraging the sys module in a request to the search application as demonstrated by a cross-site request forgery (CSRF) attack aka SPL-45172.


A vulnerability in the Guest Shell of Cisco IOS XE Software could allow an authenticated local attacker to perform directory traversal on the base Linux operating system of Cisco IOS XE Software. The vulnerability is due to incomplete validation of certain commands. An attacker could exploit this vulnerability by first accessing the Guest Shell and then entering specific commands. A successful exploit could allow the attacker to execute arbitrary code on the base Linux operating system.

arbitrary code execution
directory traversal


In Pulse Secure Pulse Connect Secure (PCS) before 8.1R15.1 8.2 before 8.2R12.1 8.3 before 8.3R7.1 and 9.0 before 9.0R3.4 an authenticated attacker (via the admin web interface) can exploit Directory Traversal to execute arbitrary code on the appliance.


util/src/zip.rs in Grin before 1.0.2 mishandles suspicious files. An attacker can execute arbitrary code via directory traversal in a ZIP archive.


JEUS 7 Fix#0~5 and JEUS 8Fix#0~1 versions contains a directory traversal vulnerability caused by improper input parameter check when uploading installation file in administration web page. That leads remote attacker to execute arbitrary code via uploaded file.


Directory traversal vulnerability in /res/I18nMsg AjxMsg ZMsg ZmMsg AjxKeys ZmKeys ZdMsg Ajx%20TemplateMsg.js.zgz in Zimbra 7.2.2 and 8.0.2 allows remote attackers to read arbitrary files via a .. (dot dot) in the skin parameter. NOTE: this can be leveraged to execute arbitrary code by obtaining LDAP credentials and accessing the service/admin/soap API.


Directory traversal vulnerability in CommunicationServlet in HP Service Virtualization 3.x before 3.50.1 when the AutoPass license server is enabled allows remote attackers to create arbitrary files and consequently execute arbitrary code via unspecified vectors aka ZDI-CAN-2031.


gitjacker before 0.1.0 allows remote attackers to execute arbitrary code via a crafted .git directory because of directory traversal.


An issue was discovered in Aviatrix Controller 6.x before 6.5-1804.1922. Unrestricted upload of a file with a dangerous type is possible which allows an unauthenticated user to execute arbitrary code via directory traversal.


Directory traversal vulnerability in OpenBase 10.0.5 and earlier allows remote authenticated users to create files with arbitrary contents via a .. (dot dot) in the first argument to the GlobalLog stored procedure. NOTE: this can be leveraged to execute arbitrary code using CVE-2007-5926.


Directory traversal vulnerability in the PersistenceService in Sun Java Web Start in JDK and JRE 5.0 Update 11 and earlier and Java Web Start in SDK and JRE 1.4.2_13 and earlier for Windows allows remote attackers to perform unauthorized actions via an application that grants file overwrite privileges to itself. NOTE: this can be leveraged to execute arbitrary code by overwriting a .java.policy file.


Directory traversal vulnerability in SQL-Ledger and LedgerSMB before 1.1.5 allows remote attackers to read and overwrite arbitrary files and execute arbitrary code via . (dot) characters adjacent to (1) users and (2) users/members strings which are removed by blacklisting functions that filter these strings and collapse into .. (dot dot) sequences.


Multiple directory traversal vulnerabilities in SeedDMS (formerly LetoDMS and MyDMS) before 4.3.4 allow (1) remote authenticated users with access to the LogManagement functionality to read arbitrary files via a .. (dot dot) in the logname parameter to out/out.LogManagement.php or (2) remote attackers to write to arbitrary files via a .. (dot dot) in the fileId parameter to op/op.AddFile2.php. NOTE: vector 2 can be leveraged to execute arbitrary code by using CVE-2014-2278.


Directory traversal vulnerability in the Admin Center for Tivoli Storage Manager (TSM) in Rocket ServerGraph 1.2 allows remote attackers to (1) create arbitrary files via a .. (dot dot) in the query parameter in a writeDataFile action to the fileRequestor servlet execute arbitrary files via a .. (dot dot) in the query parameter in a (2) run or (3) runClear action to the fileRequestor servlet (4) read arbitrary files via a readDataFile action to the fileRequestor servlet (5) execute arbitrary code via a save_server_groups action to the userRequest servlet or (6) delete arbitrary files via a del action in the fileRequestServlet servlet.


Directory traversal vulnerability in gefebt.exe in the WebView CimWeb components in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY through 8.2 SIM 24 and Proficy Process Systems with CIMPLICITY allows remote attackers to execute arbitrary code via a crafted HTTP request aka ZDI-CAN-1622.


Directory traversal vulnerability in CimWebServer.exe (aka the WebView component) in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY before 8.2 SIM 24 and Proficy Process Systems with CIMPLICITY allows remote attackers to execute arbitrary code via a crafted message to TCP port 10212 aka ZDI-CAN-1623.


Directory traversal vulnerability in the Send Screen Capture implementation in Cisco Jabber 9.2(.1) and earlier on Windows allows remote attackers to upload arbitrary types of files and consequently execute arbitrary code via modified packets aka Bug ID CSCug48056.


Multiple directory traversal vulnerabilities in the file-upload feature in IBM PureApplication System 1.0 before 1.0.0.4 iFix 10 1.1 before 1.1.0.5 and 2.0 before 2.0.0.1 and Workload Deployer 3.1.0.7 before IF5 allow remote authenticated users to execute arbitrary code via a (1) Script Package (2) Add-On or (3) Emergency Fixes component.


Directory traversal vulnerability in the agentUpload servlet in ZOHO ManageEngine EventLog Analyzer 9.0 build 9002 and 8.2 build 8020 allows remote attackers to execute arbitrary code by uploading a ZIP file which contains an executable file with .. (dot dot) sequences in its name then accessing the executable via a direct request to the file under the web root. Fixed in Build 11072.


Directory traversal vulnerability in the getEntry method in the PortalModuleInstallManager component in a servlet in nps.jar in the Administration Console (aka Access Management Console) in Novell Access Manager 3.1 before 3.1.2-281 on Windows allows remote attackers to create arbitrary files with any contents and consequently execute arbitrary code via a .. (dot dot) in a parameter aka ZDI-CAN-678.


Directory traversal vulnerability in the SSL Service in EMC HomeBase Server 6.2.x before 6.2.3 and 6.3.x before 6.3.2 allows remote attackers to overwrite arbitrary files with any content and consequently execute arbitrary code via a .. (dot dot) in an unspecified parameter.


Directory traversal vulnerability in UploadServlet in the Remote Management component in Novell ZENworks Configuration Management (ZCM) 10 before 10.3 allows remote attackers to execute arbitrary code via a zenworks-fileupload request with a crafted directory name in the type parameter in conjunction with a WAR filename in the filename parameter and WAR content in the POST data a different vulnerability than CVE-2010-5323.


Directory traversal vulnerability in the Community Builder Enhanced (CBE) (com_cbe) component 1.4.8 1.4.9 and 1.4.10 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the tabname parameter in a userProfile action to index.php. NOTE: this can be leveraged to execute arbitrary code by using the file upload feature.


Directory traversal vulnerability in UploadServlet in the Remote Management component in Novell ZENworks Configuration Management (ZCM) 10 before 10.3 allows remote attackers to execute arbitrary code via a crafted WAR pathname in the filename parameter in conjunction with WAR content in the POST data a different vulnerability than CVE-2010-5324.


Directory traversal vulnerability in an unspecified servlet in the Inventory component in ZENworks Asset Management (ZAM) in Novell ZENworks Configuration Management 10.3 before 10.3.2 and 11 allows remote attackers to overwrite files and subsequently execute arbitrary code via directory traversal sequences in a filename field in an upload request.


Directory traversal vulnerability in Microsoft Windows Media Player 7.1 and Windows Media Player for Windows XP allows remote attackers to execute arbitrary code via a skins file with a URL containing hex-encoded backslash characters (%5C) that causes an executable to be placed in an arbitrary location.


HelpViewer in Mac OS X 10.3.3 and 10.2.8 processes scripts that it did not initiate which can allow attackers to execute arbitrary code an issue that was originally reported as a directory traversal vulnerability in the Safari web browser using the runscript parameter in a help: URI handler.


Nitro Pro 11.0.3.173 allows remote attackers to execute arbitrary code via saveAs and launchURL calls with directory traversal sequences.


Multiple directory traversal vulnerabilities in Samsung SyncThru 6 before 1.0 allow remote attackers to delete arbitrary files via unspecified parameters to (1) upload/updateDriver or (2) upload/addDriver or to execute arbitrary code with SYSTEM privileges via unspecified parameters to (3) uploadCloning.html (4) fileupload.html (5) uploadFirmware.html or (6) upload/driver.


Directory traversal vulnerability in the SwiftKey language-pack update implementation on Samsung Galaxy S4 S4 Mini S5 and S6 devices allows remote web servers to write to arbitrary files and consequently execute arbitrary code in a privileged context by leveraging control of the skslm.swiftkey.net domain name and providing a .. (dot dot) in an entry in a ZIP archive as demonstrated by a traversal to the /data/dalvik-cache directory.


Directory traversal vulnerability in UploadServlet in Novell ZENworks Configuration Management (ZCM) 10 and 11 before 11.3.2 allows remote attackers to execute arbitrary code via a crafted directory name in the uid parameter in conjunction with a WAR filename in the filename parameter and WAR content in the POST data a different vulnerability than CVE-2010-5323 and CVE-2010-5324.


Directory traversal vulnerability in the Management Server in Symantec Embedded Security: Critical System Protection (SES:CSP) 1.0.x before 1.0 MP5 Embedded Security: Critical System Protection for Controllers and Devices (SES:CSP) 6.5.0 before MP1 Critical System Protection (SCSP) before 5.2.9 MP6 Data Center Security: Server Advanced Server (DCS:SA) 6.x before 6.5 MP1 and 6.6 before MP1 and Data Center Security: Server Advanced Server and Agents (DCS:SA) through 6.6 MP1 allows remote authenticated users to execute arbitrary code via unspecified vectors.


Directory traversal vulnerability in the set_skin function in program/include/rcmail_output_html.php in Roundcube before 1.0.8 and 1.1.x before 1.1.4 allows remote authenticated users with certain permissions to read arbitrary files or possibly execute arbitrary code via a .. (dot dot) in the _skin parameter to index.php.


MITRE is populating this ID because it was assigned prior to Lenovo becoming a CNA. A directory traversal vulnerability was discovered (fixed and publicly disclosed in 2015) in Lenovo Solution Center (LSC) prior to version 3.3.002 that could allow a user to execute arbitrary code with elevated privileges.


Microsoft Internet Explorer 6.0 does not properly handle Drag and Drop events which allows remote user-assisted attackers to execute arbitrary code via a link to an SMB file share with a filename that contains encoded ..\\ (%2e%2e%5c) sequences and whose extension contains the CLSID Key identifier for HTML Applications (HTA) aka \Folder GUID Code Execution Vulnerability.\ NOTE: directory traversal sequences were used in the original exploit although their role is not clear.


NOCC Webmail 1.0 stores e-mail attachments in temporary files with predictable filenames which makes it easier for remote attackers to execute arbitrary code by accessing the e-mail attachment via directory traversal vulnerabilities.


Multiple directory traversal vulnerabilities in document/rqmkhtml.php in Claroline 1.7.4 and earlier allow remote attackers to use \..\ (dot dot) sequences to (1) read arbitrary files via the file parameter in a rqEditHtml command to document/rqmkhtml.php or (2) execute arbitrary code via the includePath parameter to learnPath/include/scormExport.inc.php.


Directory traversal vulnerability in the DeploymentFileRepository class in JBoss Application Server (jbossas) 3.2.4 through 4.0.5 allows remote authenticated users to read or modify arbitrary files and possibly execute arbitrary code via unspecified vectors related to the console manager.


Directory traversal vulnerability in chat/getStartOptions.php in AlstraSoft E-friends 4.85 allows remote attackers to include arbitrary local files and possibly execute arbitrary code via a .. (dot dot) sequence and trailing null (%00) byte in the lang parameter as demonstrated by injecting PHP code into a log file.


Multiple directory traversal vulnerabilities in fm.php in Simple File Manager (SFM) 0.24a allow remote attackers to use \..\ sequences to (1) read arbitrary files via the filename parameter in a download action (2) delete arbitrary files via the delete parameter and (3) modify arbitrary files via the edit parameter which can be leveraged to execute arbitrary code.


Directory traversal vulnerability in ld.so.1 in Sun Solaris 8 9 and 10 allows local users to execute arbitrary code via a .. (dot dot) sequence in the LANG environment variable that points to a locale file containing attacker-controlled format string specifiers.


Variable extraction vulnerability in include/common.php in exV2 2.0.4.3 and earlier allows remote attackers to overwrite arbitrary program variables and conduct directory traversal attacks to execute arbitrary code by modifying the $xoopsOption'pagetype' variable.


Multiple directory traversal vulnerabilities in Dolibarr CMS 3.2.0 Alpha allow remote attackers to read arbitrary files and possibly execute arbitrary code via a .. (dot dot) in the (1) file parameter to document.php or (2) backtopage parameter in a create action to comm/action/fiche.php.


Multiple directory traversal vulnerabilities in the (1) twikidraw (action/twikidraw.py) and (2) anywikidraw (action/anywikidraw.py) actions in MoinMoin before 1.9.6 allow remote authenticated users with write permissions to overwrite arbitrary files via unspecified vectors. NOTE: this can be leveraged with CVE-2012-6081 to execute arbitrary code.


EmpireCMS V7.5 allows remote attackers to upload and execute arbitrary code via ..%2F directory traversal in a .php filename in the upload/e/admin/ecmscom.php path parameter.


WordPress through 4.9.6 allows Author users to execute arbitrary code by leveraging directory traversal in the wp-admin/post.php thumb parameter which is passed to the PHP unlink function and can delete the wp-config.php file. This is related to missing filename validation in the wp-includes/post.php wp_delete_attachment function. The attacker must have capabilities for files and posts that are normally available only to the Author Editor and Administrator roles. The attack methodology is to delete wp-config.php and then launch a new installation process to increase the attacker's privileges.


A directory traversal flaw in SeedDMS (formerly LetoDMS and MyDMS) before 5.1.8 allows an authenticated attacker to write to (or potentially delete) arbitrary files via a .. (dot dot) in the \op/op.UploadChunks.php\ \qquuid\ parameter. NOTE: this can be leveraged to execute arbitrary code by using CVE-2018-12940.


The \program extension upload\ feature in OpenCart through 3.0.2.0 has a six-step process (upload install unzip move xml remove) that allows attackers to execute arbitrary code if the remove step is skipped because the attacker can discover a secret temporary directory name (containing 10 random digits) via a directory traversal attack involving language_info'code'.


A directory traversal vulnerability in Trend Micro Endpoint Application Control 2.0 could allow a remote attacker to execute arbitrary code on vulnerable installations due to a flaw in the FileDrop servlet. Authentication is required to exploit this vulnerability.


WADashboard API in Advantech WebAccess 8.3.1 and 8.3.2 allows remote authenticated attackers to write or overwrite any file on the filesystem due to a directory traversal vulnerability in the writeFile API. An attacker can use this vulnerability to remotely execute arbitrary code.


Directory traversal vulnerability in the Import/Export function in the Portal Site Manager in Apache Jetspeed before 2.3.1 allows remote authenticated administrators to write to arbitrary files and consequently execute arbitrary code via a .. (dot dot) in a ZIP archive entry as demonstrated by \../../webapps/x.jsp.\


Directory traversal vulnerability in the Heartbeat Web Service in CA.Itm.Server.ManagementWS.dll in the Management Server in CA Total Defense (TD) r12 before SE2 allows remote attackers to execute arbitrary code via directory traversal sequences in the GUID parameter in an upload request to FileUploadHandler.ashx.


Multiple directory traversal vulnerabilities in the vendor daemon in Rational Common Licensing in Telelogic License Server 2.0 Rational License Server 7.x and ibmratl in IBM Rational License Key Server (RLKS) 8.0 through 8.1.2 allow remote attackers to execute arbitrary code via vectors related to save rename and load operations on log files. NOTE: this might overlap CVE-2011-4135.


Multiple directory traversal vulnerabilities in lmgrd in Flexera FlexNet Publisher 11.10 (aka FlexNet License Server Manager) allow remote attackers to execute arbitrary code via vectors related to save rename and load operations on log files. NOTE: this might overlap CVE-2011-1389.


Directory traversal vulnerability in Blue Coat Reporter 9.x before 9.2.4.13 9.2.5.x before 9.2.5.1 and 9.3 before 9.3.1.2 on Windows allows remote attackers to read arbitrary files and consequently execute arbitrary code via an unspecified HTTP request.


Directory traversal vulnerability in PHP 5.2.4 and earlier allows attackers to bypass open_basedir restrictions and possibly execute arbitrary code via a .. (dot dot) in the dl function.


Directory traversal vulnerability in the CollectorConfInfoServlet servlet in ManageEngine NetFlow Analyzer allows remote attackers to execute arbitrary code via a .. (dot dot) in the filename.


Directory traversal vulnerability in the Content Acceleration Pack (CAP) web application in HP Executive Scorecard 9.40 and 9.41 allows remote authenticated users to execute arbitrary code by uploading an executable file aka ZDI-CAN-2117.


Directory traversal vulnerability in the fndwar web application in HP Executive Scorecard 9.40 and 9.41 allows remote authenticated users to execute arbitrary code or obtain sensitive information or delete data via unspecified vectors aka ZDI-CAN-2120.


Directory traversal vulnerability in the toServerObject function in HP Network Virtualization 8.6 (aka Shunra Network Virtualization) allows remote attackers to create files and consequently execute arbitrary code via crafted input aka ZDI-CAN-2024.


Directory traversal vulnerability in the DumpToFile method in the NQMcsVarSet ActiveX control in Agent Manager in NetIQ Sentinel allows remote attackers to create arbitrary files and consequently execute arbitrary code via a crafted pathname.


Directory traversal vulnerability in the DumpToFile method in the NQMcsVarSet ActiveX control in NetIQ Security Manager through 6.5.4 allows remote attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2014-3460.


Directory traversal vulnerability in EMC VPLEX GeoSynchrony 4.x and 5.x before 5.3 allows remote authenticated users to execute arbitrary code via unspecified vectors.


Directory traversal vulnerability in NTWebServer in InduSoft Web Studio 7.1 before SP2 Patch 4 allows remote attackers to read administrative passwords in APP files and consequently execute arbitrary code via unspecified web requests.


Directory traversal vulnerability in the rftpcom.dll ActiveX control in Attachmate Reflection FTP Client before 14.1.429 allows remote attackers to execute arbitrary code via unspecified vectors to the SaveSettings method.


Directory traversal vulnerability in the rftpcom.dll ActiveX control in Attachmate Reflection FTP Client before 14.1.429 allows remote attackers to execute arbitrary code via unspecified vectors to the StartLog method.


Directory traversal vulnerability in ZOHO ManageEngine Desktop Central (DC) before 9 build 90055 allows remote attackers to execute arbitrary code via a .. (dot dot) in the fileName parameter to mdm/mdmLogUploader.


Directory traversal vulnerability in ZOHO ManageEngine Desktop Central (DC) before 9 build 90055 allows remote attackers to execute arbitrary code via a .. (dot dot) in the fileName parameter in an LFU action to statusUpdate.


Directory traversal vulnerability in ServiceDesk Plus and Plus MSP v5 through v9.0 v9030; AssetExplorer v4 to v6.1; SupportCenter v5 to v7.9; IT360 v8 to v10.4 allows remote authenticated users to execute arbitrary code.


Directory traversal vulnerability in AFP Server in Apple Mac OS X 10.5.8 and 10.6.x before 10.6.5 allows remote authenticated users to execute arbitrary code by creating files that are outside the bounds of a share.


Directory traversal vulnerability in goform/formExportDataLogs in HP Power Manager before 4.2.10 allows remote attackers to overwrite arbitrary files and execute arbitrary code via directory traversal sequences in the fileName parameter.


Directory traversal vulnerability in GSAPAK.EXE for GameSpy Arcade possibly versions before 1.3e allows remote attackers to overwrite arbitrary files and execute arbitrary code via .. (dot dot) sequences in filenames in a .APK (Zip) file.


Directory traversal vulnerability in ajaxfileupload.php in Kayson Group Ltd. phpGrid before 7.2.5 allows remote attackers to execute arbitrary code by uploading a crafted file with a .. (dot dot) in the file name.


Directory traversal vulnerability in the BOM (aka Bill of Materials) component in Apple iOS before 9.1 OS X before 10.11.1 and watchOS before 2.0.1 allows remote attackers to execute arbitrary code via a crafted CPIO archive.


Directory traversal vulnerability in the routing component in ownCloud Server before 7.0.6 and 8.0.x before 8.0.4 when running on Windows allows remote attackers to reinstall the application or execute arbitrary code via unspecified vectors.


Directory traversal vulnerability in the FileSession object in Mod_python module 3.2.7 for Apache allows local users to execute arbitrary code via a crafted session cookie.


Directory traversal vulnerability in Un-CGI 1.9 and earlier allows remote attackers to execute arbitrary code via a .. (dot dot) in an HTML form.


Directory traversal vulnerability in r.pl (aka r.cgi) of Randy Parker Power Up HTML 0.8033beta allows remote attackers to read arbitrary files and possibly execute arbitrary code via a .. (dot dot) in the FILE parameter.


Directory traversal vulnerability in phpMyAdmin 2.2.0 and earlier versions allows remote attackers to execute arbitrary code via a .. (dot dot) in an argument to the sql.php script.


Directory traversal vulnerability in phpPgAdmin 2.2.1 and earlier versions allows remote attackers to execute arbitrary code via a .. (dot dot) in an argument to the sql.php script.


Directory traversal vulnerability in an unspecified ActiveX control in Ecava IntegraXor before 3.71.4200 allows remote attackers to execute arbitrary code via vectors involving an HTML document on the server.


Directory traversal vulnerability in EMC RSA Archer SmartSuite Framework 4.x and RSA Archer GRC 5.x before 5.2SP1 allows remote authenticated users to upload files and consequently execute arbitrary code via a relative path.


Directory traversal vulnerability in Tridium Niagara AX 3.5 3.6 and 3.7 allows remote attackers to read sensitive files and consequently execute arbitrary code by leveraging (1) valid credentials or (2) the guest feature.


Directory traversal vulnerability in 3S CODESYS Gateway-Server before 2.3.9.27 allows remote attackers to execute arbitrary code via vectors involving a crafted pathname.


Directory traversal vulnerability in upload.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code via a .. (dot dot) in the dID parameter.


Directory traversal vulnerability in eFileGo 3.01 allows remote attackers to execute arbitrary code read arbitrary files and upload arbitrary files via a ... (triple dot) in (1) the URL on port 608 and (2) the argument to upload.exe.


Directory traversal vulnerability in priocntl system call in Solaris does allows local users to execute arbitrary code via \..\ sequences in the pc_clname field of a pcinfo_t structure which cause priocntl to load a malicious kernel module.


Directory traversal vulnerability in the rtrlet component in Novell ZENworks Asset Management (ZAM) 7.5 allows remote attackers to execute arbitrary code by uploading an executable file.


Directory traversal vulnerability in NTWebServer in InduSoft Web Studio 6.1 and 7.x before 7.0+Patch 1 allows remote attackers to execute arbitrary code via an invalid request.


Directory traversal vulnerability in modules/profile/user.php in Ax Developer CMS (AxDCMS) 0.1.1 allows remote attackers to execute arbitrary code via a .. (dot dot) in the aXconfdefault_language parameter.


Directory traversal vulnerability in Spip_RSS.PHP in SPIP 1.8.2g and earlier allows remote attackers to read or include arbitrary files via \..\ sequences in the GLOBALStype_urls parameter which could then be used to execute arbitrary code via resultant direct static code injection in the file parameter to spip_acces_doc.php3.

arbitrary code execution
directory traversal
code injection


A logic issue was addressed with improved state management. This issue is fixed in Security Update 2021-002 Catalina Security Update 2021-003 Mojave iOS 14.5 and iPadOS 14.5 watchOS 7.4 tvOS 14.5 macOS Big Sur 11.3. An application may be able to execute arbitrary code with kernel privileges.


Multiple issues were addressed with improved logic. This issue is fixed in macOS Big Sur 11.2 Security Update 2021-001 Catalina Security Update 2021-001 Mojave watchOS 7.3 tvOS 14.4 iOS 14.4 and iPadOS 14.4. An application may be able to execute arbitrary code with kernel privileges.


A double free issue was addressed with improved memory management. This issue is fixed in tvOS 14.6 iOS 14.6 and iPadOS 14.6 Security Update 2021-004 Catalina Security Update 2021-005 Mojave macOS Big Sur 11.4 watchOS 7.5. An application may be able to execute arbitrary code with kernel privileges.


A type confusion issue was addressed with improved state handling. This issue is fixed in iOS 12.5.5 iOS 14.4 and iPadOS 14.4 macOS Big Sur 11.2 Security Update 2021-001 Catalina Security Update 2021-001 Mojave Security Update 2021-006 Catalina. A malicious application may be able to execute arbitrary code with kernel privileges. Apple is aware of reports that an exploit for this issue exists in the wild.


A memory consumption issue was addressed with improved memory handling. This issue is fixed in iOS 15 and iPadOS 15 watchOS 8 tvOS 15. An application may be able to execute arbitrary code with kernel privileges.


A type confusion issue was addressed with improved state handling. This issue is fixed in iOS 14.8 and iPadOS 14.8 macOS Big Sur 11.6 Security Update 2021-005 Catalina. A malicious application may be able to execute arbitrary code with kernel privileges.


A logic issue was addressed with improved state management. This issue is fixed in tvOS 14.6 Security Update 2021-004 Mojave iOS 14.6 and iPadOS 14.6 Security Update 2021-003 Catalina macOS Big Sur 11.4 watchOS 7.5. An application may be able to execute arbitrary code with kernel privileges.


A use after free issue was addressed with improved memory management. This issue is fixed in macOS Big Sur 11.6.2 tvOS 15.2 macOS Monterey 12.1 Security Update 2021-008 Catalina iOS 15.2 and iPadOS 15.2 watchOS 8.3. An application may be able to execute arbitrary code with kernel privileges.


The DataLoader::doStart function in dataloader.cpp in QGit 1.5.6 and other versions up to 2pre1 allows local users to overwrite arbitrary files and execute arbitrary code via a symlink attack on temporary files with predictable filenames.


TmComm.sys 1.5.0.1052 in the Trend Micro Anti-Rootkit Common Module (RCM) with the VsapiNI.sys 3.320.0.1003 scan engine as used in Trend Micro PC-cillin Internet Security 2007 Antivirus 2007 Anti-Spyware for SMB 3.2 SP1 Anti-Spyware for Consumer 3.5 Anti-Spyware for Enterprise 3.0 SP2 Client / Server / Messaging Security for SMB 3.5 Damage Cleanup Services 3.2 and possibly other products assigns Everyone write permission for the \\\\.\\TmComm DOS device interface which allows local users to access privileged IOCTLs and execute arbitrary code or overwrite arbitrary memory in the kernel context.


An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in tvOS 15.4 iOS 15.4 and iPadOS 15.4 macOS Big Sur 11.6.5 Security Update 2022-003 Catalina watchOS 8.5 macOS Monterey 12.3. An application may be able to execute arbitrary code with kernel privileges.


A use after free issue was addressed with improved memory management. This issue is fixed in tvOS 15.4 iOS 15.4 and iPadOS 15.4 macOS Big Sur 11.6.5 Security Update 2022-003 Catalina watchOS 8.5 macOS Monterey 12.3. An application may be able to execute arbitrary code with kernel privileges.


Autodesk 3D Studio Max (3DSMax) 6 through 9 and 2008 through 2010 allows remote attackers to execute arbitrary code via a .max file with a MAXScript statement that calls the DOSCommand method related to \application callbacks.\


Sambar Server before 6.0 beta 3 allows attackers with physical access to execute arbitrary code via a request with an MS-DOS device name such as com1.pl con.pl or aux.pl which causes Perl to read the code from the associated device.


The component for the Virtual DOS Machine (VDM) subsystem in Windows NT 4.0 and Windows 2000 does not properly validate system structures which allows local users to access protected kernel memory and execute arbitrary code.


Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue. It could occur while copying VGA data via bitblt copy in backward mode. A privileged user inside a guest could use this flaw to crash the QEMU process resulting in DoS or potentially execute arbitrary code on the host with privileges of QEMU process on the host.


A memory consumption issue was addressed with improved memory handling. This issue is fixed in iOS 13.5.1 and iPadOS 13.5.1 macOS Catalina 10.15.5 Supplemental Update tvOS 13.4.6 watchOS 6.2.6. An application may be able to execute arbitrary code with kernel privileges.


This issue was addressed by encrypting communications over the network to devices running iOS 14 iPadOS 14 tvOS 14 and watchOS 7. This issue is fixed in iOS 14.0 and iPadOS 14.0 Xcode 12.0. An attacker in a privileged network position may be able to execute arbitrary code on a paired device during a debug session over the network.


A use after free issue was addressed with improved memory management. This issue is fixed in macOS Big Sur 11.0.1 tvOS 14.0 macOS Big Sur 11.1 Security Update 2020-001 Catalina Security Update 2020-007 Mojave watchOS 7.0 iOS 14.0 and iPadOS 14.0. An application may be able to execute arbitrary code with kernel privileges.


A use after free issue was addressed with improved memory management. This issue is fixed in macOS Big Sur 11.0.1 watchOS 7.0 iOS 14.0 and iPadOS 14.0 macOS Catalina 10.15.6 Security Update 2020-004 Mojave Security Update 2020-004 High Sierra tvOS 14.0. An application may be able to execute arbitrary code with kernel privileges.


A S+ Operations and S+ Historian service is subject to a DoS by special crafted messages. An attacker might use this flaw to make it crash or even execute arbitrary code on the machine where the service is hosted.


In S+ Operations and S+ Historian not all client commands correctly check user permission as expected. Authenticated but Unauthorized remote users could execute a Denial-of-Service (DoS) attack execute arbitrary code or obtain more privilege than intended on the machines.


A type confusion issue was addressed with improved state handling. This issue is fixed in macOS Big Sur 11.0.1 watchOS 7.1 iOS 12.4.9 watchOS 6.2.9 Security Update 2020-006 High Sierra Security Update 2020-006 Mojave iOS 14.2 and iPadOS 14.2 watchOS 5.3.9 macOS Catalina 10.15.7 Supplemental Update macOS Catalina 10.15.7 Update. A malicious application may be able to execute arbitrary code with kernel privileges.


Global TechStream (GTS) for TOYOTA dealers version 15.10.032 and earlier allows an attacker to cause a denial-of-service (DoS) condition and execute arbitrary code via unspecified vectors.


A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1 macOS Catalina 10.15.3 tvOS 13.3.1 watchOS 6.1.2. A malicious application may be able to execute arbitrary code with system privileges.


A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 13.4 and iPadOS 13.4 macOS Catalina 10.15.4 tvOS 13.4 watchOS 6.2. A malicious application may be able to execute arbitrary code with kernel privileges.


Format string vulnerability in the dosyslog function in the OBEX server (obexsrv.c) for Sobexsrv before 1.0.0-pre4 when the syslog (-S) function is enabled allows remote attackers to execute arbitrary code via format string specifiers in file name arguments to OBEX commands.


The issue was addressed with improved permissions logic. This issue is fixed in iOS 13.3.1 and iPadOS 13.3.1 macOS Catalina 10.15.3 tvOS 13.3.1 watchOS 6.1.2. An application may be able to execute arbitrary code with system privileges.


A logic issue was addressed with improved validation. This issue is fixed in iOS 14.5 and iPadOS 14.5. A malicious application may be able to execute arbitrary code with system privileges.


A logic issue was addressed with improved state management. This issue is fixed in iOS 14.5 and iPadOS 14.5. An application may be able to execute arbitrary code with kernel privileges.


A logic issue was addressed with improved validation. This issue is fixed in macOS Big Sur 11.4 tvOS 14.6 watchOS 7.5 iOS 14.6 and iPadOS 14.6. A malicious application may be able to execute arbitrary code with kernel privileges.


A logic issue was addressed with improved state management. This issue is fixed in tvOS 14.0 iOS 14.0 and iPadOS 14.0. An application may be able to execute arbitrary code with kernel privileges.


Multiple vulnerabilities in Cisco SPA100 Series Analog Telephone Adapters (ATAs) could allow an authenticated adjacent attacker to execute arbitrary code with elevated privileges. The vulnerabilities are due to improper validation of user-supplied input to the web-based management interface. An attacker could exploit these vulnerabilities by authenticating to the web-based management interface and sending crafted requests to an affected device. A successful exploit could allow the attacker to execute arbitrary code with elevated privileges. Note: The web-based management interface is enabled by default.

arbitrary code execution
improper user input validation


Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W RV130 RV130W and RV215W Routers could allow an authenticated remote attacker to inject arbitrary commands that are executed with root privileges. The vulnerabilities are due to improper validation of user-supplied input in the web-based management interface. An attacker could exploit these vulnerabilities by sending crafted HTTP requests to a targeted device. A successful exploit could allow the attacker to execute arbitrary code as the root user on the underlying operating system. To exploit these vulnerabilities an attacker would need to have valid administrator credentials on an affected device. Cisco has not released software updates that address these vulnerabilities.


Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV016 RV042 RV042G RV082 RV320 and RV325 Routers could allow an authenticated remote attacker to inject arbitrary commands that are executed with root privileges. These vulnerabilities are due to improper validation of user-supplied input in the web-based management interface. An attacker could exploit these vulnerabilities by sending crafted HTTP requests to a targeted device. A successful exploit could allow the attacker to execute arbitrary code as the root user on the underlying operating system. To exploit these vulnerabilities an attacker would need to have valid administrator credentials on an affected device.


A vulnerability in the web-based management interface of Cisco Small Business RV110W RV130 RV130W and RV215W Routers could allow an unauthenticated remote attacker to execute arbitrary code on an affected device. The vulnerability is due to improper validation of user-supplied input in the web-based management interface. An attacker could exploit this vulnerability by sending crafted HTTP requests to a targeted device. A successful exploit could allow the attacker to execute arbitrary code as the root user on the underlying operating system of the affected device. Cisco has not released software updates that address this vulnerability.


A vulnerability in the web-based management interface of Cisco RV110W Wireless-N VPN Firewall and Cisco RV215W Wireless-N VPN Router could allow an unauthenticated remote attacker to execute arbitrary code on an affected device. The vulnerability is due to improper validation of user-supplied input data by the web-based management interface. An attacker could exploit this vulnerability by sending crafted requests to a targeted device. A successful exploit could allow the attacker to execute arbitrary code with the privileges of the root user.


A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated remote attacker with administrative privileges to execute arbitrary code with root privileges on the underlying Linux shell. The vulnerability is due to improper validation of user-supplied input. An attacker could exploit this vulnerability by first creating a malicious file on the affected device itself and then uploading a second malicious file to the device. A successful exploit could allow the attacker to execute arbitrary code with root privileges or bypass licensing requirements on the device.


A vulnerability in the web-based management interface of Cisco Small Business RV110W RV130 RV130W and RV215W Routers could allow an unauthenticated remote attacker to execute arbitrary code on an affected device. The vulnerability is due to improper validation of user-supplied input in the web-based management interface. An attacker could exploit this vulnerability by sending crafted HTTP requests to a targeted device. A successful exploit could allow the attacker to execute arbitrary code as the root user on the underlying operating system of the affected device.


Entes EMG12 versions 2.57 and prior an information exposure through query strings vulnerability in the web interface has been identified which may allow an attacker to impersonate a legitimate user and execute arbitrary code.

arbitrary code execution
information exposure


Liferay Portal before 7.3.0 and Liferay DXP 7.0 before fix pack 90 7.1 before fix pack 17 and 7.2 before fix pack 5 allows man-in-the-middle attackers to execute arbitrary code via crafted serialized payloads because of insecure deserialization.

arbitrary code execution
man in the middle


GUP (generic update process) in LightySoft LogMX before 7.4.0 does not properly verify the authenticity of updates which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update. The update process relies on cleartext HTTP. The attacker could replace the LogMXUpdater.class file.


upgrade.py in the hp-upgrade service in HP Linux Imaging and Printing (HPLIP) 3.x through 3.13.11 launches a program from an http URL which allows man-in-the-middle attackers to execute arbitrary code by gaining control over the client-server data stream.


easy_install in setuptools before 0.7 uses HTTP to retrieve packages from the PyPI repository and does not perform integrity checks on package contents which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to the default use of the product.


pip before 1.3 uses HTTP to retrieve packages from the PyPI repository and does not perform integrity checks on package contents which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to a \pip install\ operation.


pyshop before 0.7.1 uses HTTP to retrieve packages from the PyPI repository and does not perform integrity checks on package contents which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to a download operation.


The client in Schneider Electric Software Update (SESU) Utility 1.0.x and 1.1.x does not ensure that updates have a valid origin which allows man-in-the-middle attackers to spoof updates and consequently execute arbitrary code by modifying the data stream on TCP port 80.


A vulnerability in the Cisco Adaptive Security Device Manager (ASDM) Launcher could allow an unauthenticated remote attacker to execute arbitrary code on a user's operating system. This vulnerability is due to a lack of proper signature verification for specific code exchanged between the ASDM and the Launcher. An attacker could exploit this vulnerability by leveraging a man-in-the-middle position on the network to intercept the traffic between the Launcher and the ASDM and then inject arbitrary code. A successful exploit could allow the attacker to execute arbitrary code on the user's operating system with the level of privileges assigned to the ASDM Launcher. A successful exploit may require the attacker to perform a social engineering attack to persuade the user to initiate communication from the Launcher to the ASDM.