SMB in the Server service in Microsoft Windows 2000 SP4 XP SP2 and SP3 Server 2003 SP1 and SP2 Vista Gold and SP1 and Server 2008 allows remote attackers to execute arbitrary code via malformed values of unspecified \fields inside the SMB packets\ in an NT Trans2 request related to \insufficiently validating the buffer size \ aka \SMB Validation Remote Code Execution Vulnerability.\


Microsoft Internet Explorer 6 through 9 does not properly handle objects in memory which allows remote attackers to execute arbitrary code via an attempted access to a virtual function table after corruption of this table has occurred aka \Virtual Function Table Corruption Remote Code Execution Vulnerability.\

remote code execution
arbitrary code execution


The Microsoft Time component in DATIME.DLL in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allows remote attackers to execute arbitrary code via a crafted web site that leverages an unspecified \binary behavior\ in Internet Explorer aka \Microsoft Time Remote Code Execution Vulnerability.\


Microsoft Internet Explorer 8 does not properly allocate and access memory which allows remote attackers to execute arbitrary code via vectors involving a \dereferenced memory address \ aka \Select Element Remote Code Execution Vulnerability.\


Microsoft Internet Explorer 9 does not properly handle objects in memory which allows remote attackers to execute arbitrary code by accessing an object that was not properly initialized aka \Jscript9.dll Remote Code Execution Vulnerability.\


Microsoft Internet Explorer 6 does not properly handle objects in memory which allows remote attackers to execute arbitrary code by accessing a deleted object aka \OnLoad Event Remote Code Execution Vulnerability.\


Microsoft Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 and Windows 10 Gold and 1511 allow remote attackers to execute arbitrary code via unspecified vectors aka \Win32k Remote Code Execution Vulnerability.\


Microsoft XML Core Services 3.0 allows remote attackers to execute arbitrary code via a crafted web site aka \MSXML 3.0 Remote Code Execution Vulnerability.\


Pydio 4.2.1 through 8.2.1 has an authenticated remote code execution vulnerability in which an attacker with administrator access to the web application can execute arbitrary code on the underlying system via Command Injection.

remote code execution
arbitrary code execution
command injection


Multiple ZyXEL network-attached storage (NAS) devices running firmware version 5.21 contain a pre-authentication command injection vulnerability which may allow a remote unauthenticated attacker to execute arbitrary code on a vulnerable device. ZyXEL NAS devices achieve authentication by using the weblogin.cgi CGI executable. This program fails to properly sanitize the username parameter that is passed to it. If the username parameter contains certain characters it can allow command injection with the privileges of the web server that runs on the ZyXEL device. Although the web server does not run as the root user ZyXEL devices include a setuid utility that can be leveraged to run any command with root privileges. As such it should be assumed that exploitation of this vulnerability can lead to remote code execution with root privileges. By sending a specially-crafted HTTP POST or GET request to a vulnerable ZyXEL device a remote unauthenticated attacker may be able to execute arbitrary code on the device. This may happen by directly connecting to a device if it is directly exposed to an attacker. However there are ways to trigger such crafted requests even if an attacker does not have direct connectivity to a vulnerable devices. For example simply visiting a website can result in the compromise of any ZyXEL device that is reachable from the client system. Affected products include: NAS326 before firmware V5.21(AAZF.7)C0 NAS520 before firmware V5.21(AASZ.3)C0 NAS540 before firmware V5.21(AATB.4)C0 NAS542 before firmware V5.21(ABAG.4)C0 ZyXEL has made firmware updates available for NAS326 NAS520 NAS540 and NAS542 devices. Affected models that are end-of-support: NSA210 NSA220 NSA220+ NSA221 NSA310 NSA310S NSA320 NSA320S NSA325 and NSA325v2


A remote code execution issue was discovered in PublicCMS V4.0.20180210. An attacker can upload a ZIP archive that contains a .jsp file with a directory traversal pathname. After an unzip operation the attacker can execute arbitrary code by visiting a .jsp URI.

remote code execution
arbitrary code execution
directory traversal


A Directory Traversal Remote Code Execution vulnerability in Trend Micro Control Manager (versions 6.0 and 7.0) could allow an attacker to execute arbitrary code on vulnerable installations.


A remote code execution vulnerability in Mitel MiVoice Connect Client before 214.100.1223.0 could allow an attacker to execute arbitrary code in the chat notification window due to improper rendering of chat messages. A successful exploit could allow an attacker to steal session cookies perform directory traversal and execute arbitrary scripts in the context of the Connect client.


Remote code execution in Lenovo Updates (not Lenovo System Update) allows man-in-the-middle attackers to execute arbitrary code.

remote code execution
arbitrary code execution
man in the middle


The Print Spooler service in Microsoft Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 and Windows 10 Gold and 1511 allows man-in-the-middle attackers to execute arbitrary code by providing a crafted print driver during printer installation aka \Windows Print Spooler Remote Code Execution Vulnerability.\


Bentley MicroStation CONNECT 10.16.0.80 J2K File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of J2K images. Crafted data in a J2K image can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15408.

remote code execution
arbitrary code execution
out of bound read


Bitbucket Server and Bitbucket Data Center versions starting from 1.0.0 before 5.16.11 from version 6.0.0 before 6.0.11 from version 6.1.0 before 6.1.9 from version 6.2.0 before 6.2.7 from version 6.3.0 before 6.3.6 from version 6.4.0 before 6.4.4 from version 6.5.0 before 6.5.3 from version 6.6.0 before 6.6.3 from version 6.7.0 before 6.7.3 from version 6.8.0 before 6.8.2 from version 6.9.0 before 6.9.1 had a Remote Code Execution vulnerability via the post-receive hook. A remote attacker with permission to clone and push files to a repository on the victim's Bitbucket Server or Bitbucket Data Center instance can exploit this vulnerability to execute arbitrary commands on the Bitbucket Server or Bitbucket Data Center systems using a file with specially crafted content.

remote code execution
arbitrary command execution


Slanger

is

affected

by:

Remote

Code

Execution

(RCE).

The

impact

is:

A

remote

attacker

can

execute

arbitrary

commands

by

sending

a

crafted

request

to

the

server.

The

component

is:

Message

handler

request

validator.

The

attack

vector

is:

Remote

unauthenticated.

The

fixed

version

is:

after

commit


Bitbucket Server and Bitbucket Data Center versions starting from version 3.0.0 before version 5.16.11 from version 6.0.0 before 6.0.11 from version 6.1.0 before 6.1.9 from version 6.2.0 before 6.2.7 from version 6.3.0 before 6.3.6 from version 6.4.0 before 6.4.4 from version 6.5.0 before 6.5.3 from version 6.6.0 before 6.6.3 from version 6.7.0 before 6.7.3 from version 6.8.0 before 6.8.2 and from version 6.9.0 before 6.9.1 had a Remote Code Execution vulnerability via certain user input fields. A remote attacker with user level permissions can exploit this vulnerability to run arbitrary commands on the victim's systems. Using a specially crafted payload as user input the attacker can execute arbitrary commands on the victim's Bitbucket Server or Bitbucket Data Center instance.


Remote Code Execution (RCE) vulnerability exists in D-Link Router DIR-846 DIR846A1_FW100A43.bin and DIR846enFW100A53DLA-Retail.bin. Malicious users can use this vulnerability to use \\\ \ or backticks to bypass the shell metacharacters in the ssid0 or ssid1 parameters to execute arbitrary commands.This vulnerability is due to the fact that CVE-2019-17509 is not fully patched and can be bypassed by using line breaks or backticks on its basis.


Pydio

version

and

prior

contains

an

Unvalidated

user

input

leading

to

Remote

Code

Execution

(RCE)

vulnerability

in

Line

scanNow($nodeObject)

that

can

result

in

An

attacker

gaining

admin

access

and

can

then

execute

arbitrary

commands

on

the

underlying

OS.

This

attack

appear

to

be

exploitable

via

The

attacker

edits

the

Antivirus

Command

in

the

antivirus

plugin

and

executes

the

payload

by

uploading

any

file

within

Pydio.


** DISPUTED ** An issue was discovered in the Merlin.PHP component 0.6.6 for Asuswrt-Merlin devices. An attacker can execute arbitrary commands because exec.php has a popen call. NOTE: the vendor indicates that Merlin.PHP is designed only for use on a trusted intranet network and intentionally allows remote code execution.


DISPUTED

An

issue

was

discovered

in

the

Merlin.PHP

component

for

Asuswrt-Merlin

devices.

An

attacker

can

execute

arbitrary

commands

because

api.php

has

an

eval

call

as

demonstrated

by

the

/6/api.php?function=command&class=remote&Cc='ls'

URI.

NOTE:

the

vendor

indicates

that

Merlin.PHP

is

designed

only

for

use

on

a

trusted

intranet

network

and

intentionally

allows

remote

code

execution.


Dell EMC Avamar Client Manager in Dell EMC Avamar Server versions 7.2.0 7.2.1 7.3.0 7.3.1 7.4.0 7.4.1 7.5.0 7.5.1 18.1 and Dell EMC Integrated Data Protection Appliance (IDPA) versions 2.0 2.1 and 2.2 contain a Remote Code Execution vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability to execute arbitrary commands on the server.


A vulnerability has been identified in Desigo CC (V4.x) Desigo CC (V3.x) Desigo CC Compact (V4.x) Desigo CC Compact (V3.x). Affected applications are delivered with a 3rd party component (BIRT) that contains a remote code execution vulnerability if the Advanced Reporting Engine is enabled. The vulnerability could allow a remote unauthenticated attacker to execute arbitrary commands on the server with SYSTEM privileges.


Fuji Electric FRENIC LOADER v3.3 v7.3.4.1a of FRENIC-Mini (C1) FRENIC-Mini (C2) FRENIC-Eco FRENIC-Multi FRENIC-MEGA FRENIC-Ace. A buffer over-read vulnerability may allow remote code execution on the device.


Advantech WebAccess/SCADA Versions 8.3.5 and prior. Multiple stack-based buffer overflow vulnerabilities caused by a lack of proper validation of the length of user-supplied data may allow remote code execution.


In WebAccess/SCADA Versions 8.3.5 and prior multiple stack-based buffer overflow vulnerabilities are caused by a lack of proper validation of the length of user-supplied data. Exploitation of these vulnerabilities may allow remote code execution.


In Advantech WebAccess Versions 8.4.2 and prior. A stack-based buffer overflow vulnerability caused by a lack of proper validation of the length of user-supplied data may allow remote code execution.


Heap-based buffer overflow vulnerabilities in Advantech WebAccess HMI Designer 2.1.7.32 and prior caused by processing specially crafted .pm3 files may allow remote code execution.


A Buffer Overflow in VLC Media Player < 3.0.7 causes a crash which can possibly be further developed into a remote code execution exploit.


A buffer overflow in D-Link DIR-615 C2 3.03WW. The ping_ipaddr parameter in ping_response.cgi POST request allows an attacker to crash the webserver and might even gain remote code execution.


Several buffer overflow vulnerabilities have been identified in Moxa IKS and EDS which may allow remote code execution.


A buffer overflow vulnerability in CDataList of the jwwlib component of LibreCAD 2.2.0-rc3 and older allows an attacker to achieve Remote Code Execution using a crafted JWW document.


A buffer overflow vulnerability in CDataMoji of the jwwlib component of LibreCAD 2.2.0-rc3 and older allows an attacker to achieve Remote Code Execution using a crafted JWW document.


An Buffer Overflow vulnerability leading to remote code execution was discovered in MEX01. Remote attackers can use this vulnerability by using the property that the target program copies parameter values to memory through the strcpy() function.


A buffer overflow vulnerability exists in the Microsoft SQL Server that could allow remote code execution on an affected system aka \Microsoft SQL Server Remote Code Execution Vulnerability.\ This affects Microsoft SQL Server.


Fuji Electric V-Server 4.0.3.0 and prior A heap-based buffer overflow vulnerability has been identified which may allow remote code execution.


Fuji Electric V-Server 4.0.3.0 and prior A stack-based buffer overflow vulnerability has been identified which may allow remote code execution.


A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RTCP packets sent to a target phone number. The issue affects WhatsApp for Android prior to v2.19.134 WhatsApp Business for Android prior to v2.19.44 WhatsApp for iOS prior to v2.19.51 WhatsApp Business for iOS prior to v2.19.51 WhatsApp for Windows Phone prior to v2.18.348 and WhatsApp for Tizen prior to v2.18.15.


In the Lustre file system before 2.12.3 the ptlrpc module has a buffer overflow and panic and possibly remote code execution due to the lack of validation for specific fields of packets sent by a client. Interaction between req_capsule_get_size and tgt_brw_write leads to a tgt_shortio2pages integer signedness error.


Panasonic FPWIN Pro version 7.3.0.0 and prior allows attacker-created project files to be loaded by an authenticated user causing heap-based buffer overflows which may lead to remote code execution.


A heap-based buffer overflow in cosa_dhcpv4_dml.c in the RDK RDKB-20181217-1 CcspPandM module may allow attackers with login credentials to achieve remote code execution by crafting a long buffer in the \Comment\ field of an IP reservation form in the admin panel. This is related to the CcspCommonLibrary module.


An exploitable Stack Based Buffer Overflow vulnerability exists in the EnumMetaInfo function of Aspose Aspose.Words library version 18.11.0.0. A specially crafted doc file can cause a stack-based buffer overflow resulting in remote code execution. An attacker needs to provide a malformed file to the victim to trigger this vulnerability.


In WebAccess versions 8.4.1 and prior multiple stack-based buffer overflow vulnerabilities are caused by a lack of proper validation of the length of user-supplied data. Exploitation of these vulnerabilities may allow remote code execution.


In WebAccess/SCADA Versions 8.3.5 and prior multiple heap-based buffer overflow vulnerabilities are caused by a lack of proper validation of the length of user-supplied data. Exploitation of these vulnerabilities may allow remote code execution. Note: A different vulnerability than CVE-2019-10991.


An attacker could send a crafted HTTP/HTTPS request to render the web server unavailable and/or lead to remote code execution caused by a stack-based buffer overflow vulnerability. A cold restart is required for recovering CompactLogix 5370 L1 L2 and L3 Controllers Compact GuardLogix 5370 controllers and Armor Compact GuardLogix 5370 Controllers Versions 20 to 30.014 and earlier systems.


eQ-3 HomeMatic CCU2 devices before 2.41.9 and CCU3 devices before 3.43.16 have buffer overflows in the ReGa ise GmbH HTTP-Server 2.0 component aka HMCCU-179. This may lead to remote code execution.


wolfSSL 4.0.0 has a Buffer Overflow in DoPreSharedKeys in tls13.c when a current identity size is greater than a client identity size. An attacker sends a crafted hello client packet over the network to a TLSv1.3 wolfSSL server. The length fields of the packet: record length client hello length total extensions length PSK extension length total identity length and identity length contain their maximum value which is 2^16. The identity data field of the PSK extension of the packet contains the attack data to be stored in the undefined memory (RAM) of the server. The size of the data is about 65 kB. Possibly the attacker can perform a remote code execution attack.


TigerVNC version prior to 1.10.1 is vulnerable to heap buffer overflow which could be triggered from DecodeManager::decodeRect. Vulnerability occurs due to the signdness error in processing MemOutStream. Exploitation of this vulnerability could potentially result into remote code execution. This attack appear to be exploitable via network connectivity.


TigerVNC version prior to 1.10.1 is vulnerable to stack buffer overflow which could be triggered from CMsgReader::readSetCursor. This vulnerability occurs due to insufficient sanitization of PixelFormat. Since remote attacker can choose offset from start of the buffer to start writing his values exploitation of this vulnerability could potentially result into remote code execution. This attack appear to be exploitable via network connectivity.


TigerVNC version prior to 1.10.1 is vulnerable to heap buffer overflow which occurs in TightDecoder::FilterGradient. Exploitation of this vulnerability could potentially result into remote code execution. This attack appear to be exploitable via network connectivity.


TurboVNC

server

code

contains

stack

buffer

overflow

vulnerability

in

commit

prior

to

This

could

possibly

result

into

remote

code

execution

since

stack

frame

is

not

protected

with

stack

canary.

This

attack

appear

to

be

exploitable

via

network

connectivity.

To

exploit

this

vulnerability

authorization

on

server

is

required.

These

issues

have

been

fixed

in

commit


TigerVNC version prior to 1.10.1 is vulnerable to heap buffer overflow. Vulnerability could be triggered from CopyRectDecoder due to incorrect value checks. Exploitation of this vulnerability could potentially result into remote code execution. This attack appear to be exploitable via network connectivity.


An issue was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5. In a CGI program running under the HTTPD web server a buffer overflow in the param parameter leads to remote code execution in the context of the nobody account.


An issue was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5. A buffer overflow in the action parameter leads to remote code execution in the context of the nobody account.


In MatrixSSL 3.8.3 Open through 4.2.1 Open the DTLS server mishandles incoming network messages leading to a heap-based buffer overflow of up to 256 bytes and possible Remote Code Execution in parseSSLHandshake in sslDecode.c. During processing of a crafted packet the server mishandles the fragment length value provided in the DTLS message.


In libstagefright there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-128433933


GStreamer before 1.16.0 has a heap-based buffer overflow in the RTSP connection parser via a crafted response from a server potentially allowing remote code execution.


Exim 4.92 through 4.92.2 allows remote code execution a different vulnerability than CVE-2019-15846. There is a heap-based buffer overflow in string_vformat in string.c involving a long EHLO command.


Medium by Adobe version 2.4.5.331 (and earlier) is affected by a buffer overflow vulnerability when parsing a crafted file. An unauthenticated attacker could leverage this vulnerability to achieve remote code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


TP-Link TL-WR802N(US) Archer_C50v5_US v4_200 <= 2020.06 contains a buffer overflow vulnerability in the httpd process in the body message. The attack vector is: The attacker can get shell of the router by sending a message through the network which may lead to remote code execution.


A flaw was found in mbsync versions prior to 1.4.4. Due to inadequate handling of extremely large (>=2GiB) IMAP literals malicious or compromised IMAP servers and hypothetically even external email senders could cause several different buffer overflows which could conceivably be exploited for remote code execution.


Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely.


In ih264d_parse_pslice of ih264d_parse_pslice.c there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11Android ID: A-174238784


In avrc_msg_cback of avrc_api.cc there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-8.1 Android-9 Android-10Android ID: A-177611958


A specially crafted TCP/IP packet may cause a camera recovery image telnet interface to crash. It may also cause a buffer overflow which could enable remote code execution. The recovery image can only be booted with administrative rights or with physical access to the camera and allows the upload of a new firmware in case of a damaged firmware.


A specially crafted TCP/IP packet may cause the camera recovery image web interface to crash. It may also cause a buffer overflow which could enable remote code execution. The recovery image can only be booted with administrative rights or with physical access to the camera and allows the upload of a new firmware in case of a damaged firmware.


A vulnerability has been identified in POWER METER SICAM Q100 (All versions < V2.41) POWER METER SICAM Q100 (All versions < V2.41) POWER METER SICAM Q100 (All versions < V2.41) POWER METER SICAM Q100 (All versions < V2.41). The affected firmware contains a buffer overflow vulnerability in the web application that could allow a remote attacker with engineer or admin priviliges to potentially perform remote code execution.


Matrix libolm before 3.2.3 allows a malicious Matrix homeserver to crash a client (while it is attempting to retrieve an Olm encrypted room key backup from the homeserver) because olm_pk_decrypt has a stack-based buffer overflow. Remote code execution might be possible for some nonstandard build configurations.


Scalabium dBase Viewer version 2.6 (Build 5.751) is vulnerable to remote code execution via a crafted DBF file that triggers a buffer overflow. An attacker can use the Structured Exception Handler (SEH) records and redirect execution to attacker-controlled code.


A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists in the EcoStruxure Power Build - Rapsody software (V2.1.13 and prior) that could allow a stack-based buffer overflow to occur which could result in remote code execution when a malicious SSD file is uploaded and improperly parsed.


Buffer overflow vulnerability in the compatible API with previous versions CLUSTERPRO X 4.3 for Windows and earlier EXPRESSCLUSTER X 4.3 for Windows and earlier CLUSTERPRO X 4.3 SingleServerSafe for Windows and earlier EXPRESSCLUSTER X 4.3 SingleServerSafe for Windows and earlier allows attacker to remote code execution via a network.


Buffer overflow vulnerability in the Disk Agent CLUSTERPRO X 4.3 for Windows and earlier EXPRESSCLUSTER X 4.3 for Windows and earlier CLUSTERPRO X 4.3 SingleServerSafe for Windows and earlier EXPRESSCLUSTER X 4.3 SingleServerSafe for Windows and earlier allows attacker to remote code execution via a network.


Buffer overflow vulnerability in the Transaction Server CLUSTERPRO X 4.3 for Windows and earlier EXPRESSCLUSTER X 4.3 for Windows and earlier CLUSTERPRO X 4.3 SingleServerSafe for Windows and earlier EXPRESSCLUSTER X 4.3 SingleServerSafe for Windows and earlier allows attacker to remote code execution via a network.


A buffer overflow issue was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus Panel operated by released versions of software before Nexus Software 7.2.5.7. When a message is sent to the HMI TCP socket it is forwarded to the hmiProcessMsg function through the pendingQ and may lead to remote code execution.


A buffer overflow issue was discovered in the HMI3 Control Panel contained within the Swisslog Healthcare Nexus Panel operated by released versions of software before Nexus Software 7.2.5.7. A buffer overflow allows an attacker to overwrite an internal queue data structure and can lead to remote code execution.


There is a stack buffer overflow vulnerability in the formSetPPTPServer function of Tenda-AX3 router V16.03.12.10_CN. The v13 variable is directly retrieved from the http request parameter startIp. Then v13 will be splice to stack by function sscanf without any security check which causes stack overflow. By POSTing the page /goform/SetPptpServerCfg with proper startIp the attacker can easily perform remote code execution with carefully crafted overflow data.


There is a stack buffer overflow vulnerability in the formSetPPTPServer function of Tenda-AX3 router V16.03.12.10_CN. The v10 variable is directly retrieved from the http request parameter startIp. Then v10 will be splice to stack by function sscanf without any security check which causes stack overflow. By POSTing the page /goform/SetPptpServerCfg with proper startIp the attacker can easily perform remote code execution with carefully crafted overflow data.


There is a Buffer overflow vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability by sending malicious images and inducing users to open the images may cause remote code execution.


A stack-based buffer overflow vulnerability exists in both the LLMNR functionality of Sealevel Systems Inc. SeaConnect 370W v1.3.34. A specially-crafted network packet can lead to remote code execution. An attacker can send a malicious packet to trigger this vulnerability.


A stack-based buffer overflow vulnerability exists in the Web Manager SslGenerateCSR functionality of Lantronix PremierWave 2050 8.9.0.0R4 (in QEMU). A specially crafted HTTP request can lead to remote code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.


A stack-based buffer overflow vulnerability exists in the NBNS functionality of Sealevel Systems Inc. SeaConnect 370W v1.3.34. A specially-crafted network packet can lead to remote code execution. An attacker can send a malicious packet to trigger this vulnerability.


A stack-based buffer overflow vulnerability exists in the Web Manager FsUnmount functionality of Lantronix PremierWave 2050 8.9.0.0R4 (in QEMU). A specially crafted HTTP request can lead to remote code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.


A stack-based buffer overflow vulnerability exists in the Web Manager FsBrowseClean functionality of Lantronix PremierWave 2050 8.9.0.0R4 (in QEMU). A specially crafted HTTP request can lead to remote code execution in the vulnerable portion of the branch (deletedir). An attacker can make an authenticated HTTP request to trigger this vulnerability.


A stack-based buffer overflow vulnerability exists in the Web Manager FsBrowseClean functionality of Lantronix PremierWave 2050 8.9.0.0R4 (in QEMU). A specially crafted HTTP request can lead to remote code execution in the vulnerable portion of the branch (deletefile). An attacker can make an authenticated HTTP request to trigger this vulnerability.


A stack-based buffer overflow vulnerability exists in the Web Manager Ping functionality of Lantronix PremierWave 2050 8.9.0.0R4 (in QEMU). A specially crafted HTTP request can lead to remote code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.


A vulnerability has been identified in RUGGEDCOM RM1224 (All versions >= V4.3 and < V6.4) SCALANCE M-800 (All versions >= V4.3 and < V6.4) SCALANCE S615 (All versions >= V4.3 and < V6.4) SCALANCE SC-600 Family (All versions >= V2.0 and < V2.1.3) SCALANCE XB-200 (All versions < V4.1) SCALANCE XC-200 (All versions < V4.1) SCALANCE XF-200BA (All versions < V4.1) SCALANCE XM400 (All versions < V6.2) SCALANCE XP-200 (All versions < V4.1) SCALANCE XR-300WG (All versions < V4.1) SCALANCE XR500 (All versions < V6.2). Affected devices contain a stack-based buffer overflow vulnerability in the handling of STP BPDU frames that could allow a remote attacker to trigger a denial-of-service condition or potentially remote code execution. Successful exploitation requires the passive listening feature of the device to be active.


In the SCEP Server of RouterOS in certain Mikrotik products an attacker can trigger a heap-based buffer overflow that leads to remote code execution. The attacker must know the scep_server_name value. This affects RouterOS 6.46.8 6.47.9 and 6.47.10.


A vulnerability has been identified in SIMATIC PCS 7 V8.2 and earlier (All versions) SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3) SIMATIC PDM (All versions < V9.2) SIMATIC STEP 7 V5.X (All versions < V5.6 SP2 HF3) SINAMICS STARTER (containing STEP 7 OEM version) (All versions < V5.4 HF2). The affected software contains a buffer overflow vulnerability while handling certain files that could allow a local attacker to trigger a denial-of-service condition or potentially lead to remote code execution.


FFmpeg <=4.3 contains a buffer overflow vulnerability in libavcodec through a crafted file that may lead to remote code execution.


Rsyslog is a rocket-fast system for log processing. Modules for TCP syslog reception have a potential heap buffer overflow when octet-counted framing is used. This can result in a segfault or some other malfunction. As of our understanding this vulnerability can not be used for remote code execution. But there may still be a slight chance for experts to do that. The bug occurs when the octet count is read. While there is a check for the maximum number of octets digits are written to a heap buffer even when the octet count is over the maximum This can be used to overrun the memory buffer. However once the sequence of digits stop no additional characters can be added to the buffer. In our opinion this makes remote exploits impossible or at least highly complex. Octet-counted framing is one of two potential framing modes. It is relatively uncommon but enabled by default on receivers. Modules `imtcp` `imptcp` `imgssapi` and `imhttp` are used for regular syslog message reception. It is best practice not to directly expose them to the public. When this practice is followed the risk is considerably lower. Module `imdiag` is a diagnostics module primarily intended for testbench runs. We do not expect it to be present on any production installation. Octet-counted framing is not very common. Usually it needs to be specifically enabled at senders. If users do not need it they can turn it off for the most important modules. This will mitigate the vulnerability.


A buffer overflow vulnerability exists in the httpd parse_ping_result API functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted file can lead to remote code execution. An attacker can send a sequence of requests to trigger this vulnerability.


A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow potentially leading to remote code execution when an attacker sends a specially crafted message. Affected Product: Interactive Graphical SCADA System Data Server (V15.0.0.22020 and prior)


Prime95 30.7 build 9 suffers from a Buffer Overflow vulnerability that could lead to Remote Code Execution.


** UNSUPPORTED WHEN ASSIGNED ** A heap-based buffer overflow exists in XML Decompression DecodeTreeBlock in AT&T Labs Xmill 0.7. A crafted input file can lead to remote code execution. This is not the same as any of: CVE-2021-21810 CVE-2021-21811 CVE-2021-21812 CVE-2021-21815 CVE-2021-21825 CVE-2021-21826 CVE-2021-21828 CVE-2021-21829 or CVE-2021-21830. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.


A stack-based buffer overflow vulnerability exists in the console factory functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted network request can lead to remote code execution. An attacker can send a sequence of malicious packets to trigger this vulnerability.


A CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability exists that could cause remote code execution when an improperly handled TLS packet is reassembled. Affected Product: SmartConnect Family: SMT Series (SMT Series ID=1015: UPS 04.5 and prior) SMC Series (SMC Series ID=1018: UPS 04.2 and prior) SMTL Series (SMTL Series ID=1026: UPS 02.9 and prior) SCL Series (SCL Series ID=1029: UPS 02.5 and prior / SCL Series ID=1030: UPS 02.5 and prior / SCL Series ID=1036: UPS 02.5 and prior / SCL Series ID=1037: UPS 03.1 and prior) SMX Series (SMX Series ID=1031: UPS 03.1 and prior)


A Stack-based Buffer Overflow issue was discovered in GE CIMPLICITY Versions 9.0 and prior. A function reads a packet to indicate the next packet length. The next packet length is not verified allowing a buffer overwrite that could lead to an arbitrary remote code execution.


A Classic Buffer Overflow issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump Version 1.1 1.5 and 1.6. A third-party component used in the pump does not verify input buffer size prior to copying leading to a buffer overflow allowing remote code execution on the target device. The pump receives the potentially malicious input infrequently and under certain conditions increasing the difficulty of exploitation.


In CProgramConfig_ReadHeightExt of tpdec_asc.cpp there is a possible stack buffer overflow due to a missing bounds check. This could lead to a remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: 6.0 6.0.1 7.0 7.1.1 7.1.2 8.0 8.1. Android ID: A-70637599.


In avrc_ctrl_pars_vendor_rsp of avrc_pars_ct.cc there is a possible stack buffer overflow due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 7.0 7.1.1 7.1.2 8.0 8.1. Android ID: A-71603315.


In avrc_pars_browsing_cmd of avrc_pars_tg.cc there is a possible stack buffer overflow due to an incorrect bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 8.0 8.1. Android ID: A-71603262.


Microsoft JET Database Engine in Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 Windows 10 Gold 1511 1607 1703 and Windows Server 2016 allows a remote code execution vulnerability due to buffer overflow aka \Microsoft JET Database Engine Remote Code Execution Vulnerability\.


A buffer overflows exists in the psnotifyd application of the Pharos PopUp printer client version 9.0. A specially crafted packet can be sent to the victim's computer and can lead to a heap based buffer overflow resulting in potential remote code execution. This client is always listening has root privileges and requires no user interaction to exploit.


An exploitable stack buffer overflow vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6.8. A specially crafted MQTT SUBSCRIBE packet can cause a stack buffer overflow resulting in remote code execution. An attacker needs to send a specially crafted MQTT packet over the network to trigger this vulnerability.


An exploitable heap buffer overflow vulnerability exists in the X509 certificate parsing functionality of InsideSecure MatrixSSL 3.8.7b. A specially crafted x509 certificate can cause a buffer overflow on the heap resulting in remote code execution. To trigger this vulnerability a specially crafted x509 certificate must be presented to the vulnerable client or server application when initiating secure connection.


An exploitable buffer overflow exists in the psnotifyd application of the Pharos PopUp printer client version 9.0. A specially crafted packet can be sent to the victim's computer and can lead to a heap based buffer overflow resulting in remote code execution. This client is always listening has root privileges and requires no user interaction to exploit.


An exploitable stack based buffer overflow vulnerability exists in the GNOME libsoup 2.58. A specially crafted HTTP request can cause a stack overflow resulting in remote code execution. An attacker can send a special HTTP request to the vulnerable server to trigger this vulnerability.


Dahua

IP

camera

products

using

firmware

versions

prior

to

include

a

version

of

the

Sonia

web

interface

that

may

be

vulnerable

to

a

stack

buffer

overflow.

Dahua

IP

camera

products

include

an

application

known

as

Sonia

(/usr/bin/sonia)

that

provides

the

web

interface

and

other

services

for

controlling

the

IP

camera

remotely.

Versions

of

Sonia

included

in

firmware

versions

prior

to

DH_IPC-Consumer-Zi-Themis_Eng_P_V2.408.0000.11.R.20170621

do

not

validate

input

data

length

for

the

'password'

field

of

the

web

interface.

A

remote

unauthenticated

attacker

may

submit

a

crafted

POST

request

to

the

IP

camera's

Sonia

web

interface

that

may

lead

to

out-of-bounds

memory

operations

and

loss

of

availability

or

remote

code

execution.

The

issue

was

originally

identified

by

the

researcher

in

firmware

version


A Stack-based Buffer Overflow issue was discovered in Schneider Electric InduSoft Web Studio v8.0 SP2 Patch 1 and prior versions and InTouch Machine Edition v8.0 SP2 Patch 1 and prior versions. The stack-based buffer overflow vulnerability has been identified which may allow remote code execution with high privileges.


Remote code execution can occur in Asterisk Open Source 13.x before 13.14.1 and 14.x before 14.3.1 and Certified Asterisk 13.13 before 13.13-cert3 because of a buffer overflow in a CDR user field related to X-ClientCode in chan_sip the CDR dialplan function and the AMI Monitor action.


An issue was discovered in Fatek Automation PLC Ethernet Module. The affected Ether_cfg software configuration tool runs on the following Fatek PLCs: CBEH versions prior to V3.6 Build 170215 CBE versions prior to V3.6 Build 170215 CM55E versions prior to V3.6 Build 170215 and CM25E versions prior to V3.6 Build 170215. A stack-based buffer overflow vulnerability has been identified which may allow remote code execution or crash the affected device.


Remote Code Execution was discovered in FTPShell Client 6.53. By default the client sends a PWD command to the FTP server it is connecting to; however it doesn't check the response's length leading to a buffer overflow situation.


NETGEAR WNR2000v3 devices before 1.1.2.14 WNR2000v4 devices before 1.0.0.66 and WNR2000v5 devices before 1.0.0.42 allow authentication bypass and remote code execution via a buffer overflow that uses a parameter in the administration webapp. The NETGEAR ID is PSV-2016-0261.


In Azure Data Expert Ultimate 2.2.16 the SMTP verification function suffers from a buffer overflow vulnerability leading to remote code execution. The attack vector is a crafted SMTP daemon that sends a long 220 (aka \Service ready\) string.


On the Broadcom Wi-Fi HardMAC SoC with fbt firmware a stack buffer overflow occurs when handling an 802.11r (FT) authentication response leading to remote code execution via a crafted access point that sends a long R0KH-ID field in a Fast BSS Transition Information Element (FT-IE).


A Buffer Overflow issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1400 Controllers Series B and C Versions 21.002 and earlier. The stack-based buffer overflow vulnerability has been identified which may allow remote code execution.


A Heap-based Buffer Overflow issue was discovered in WECON LeviStudio HMI. The heap-based buffer overflow vulnerability has been identified which may allow remote code execution.


An issue was discovered in WECON Technology LEVI Studio HMI Editor v1.8.29 and prior. Specially-crafted malicious files may be able to cause stack-based buffer overflow vulnerabilities which may allow remote code execution.


A Stack Buffer Overflow issue was discovered in VIPA Controls WinPLC7 5.0.45.5921 and prior. A stack-based buffer overflow vulnerability has been identified where an attacker with a specially crafted packet could overflow the fixed length buffer. This could allow remote code execution.


Creolabs Gravity 1.0 contains a stack based buffer overflow in the operator_string_add function resulting in remote code execution.


A Heap-Based Buffer Overflow was discovered in Fuji Electric Monitouch V-SFT versions prior to Version 5.4.43.0. A heap-based buffer overflow vulnerability has been identified which may cause a crash or allow remote code execution.


A Stack-Based Buffer Overflow issue was discovered in Fuji Electric Monitouch V-SFT versions prior to Version 5.4.43.0. The stack-based buffer overflow vulnerability has been identified which may cause a crash or allow remote code execution.


Moxa SoftCMS 1.3 and prior is susceptible to a buffer overflow condition that may crash or allow remote code execution. Moxa released SoftCMS version 1.4 on June 1 2015 to address the vulnerability.


A specially crafted configuration file could be used to cause a stack-based buffer overflow condition in the OPCTest.exe which may allow remote code execution on Opto 22 PAC Project Professional versions prior to R9.4008 PAC Project Basic versions prior to R9.4008 PAC Display Basic versions prior to R9.4g PAC Display Professional versions prior to R9.4g OptoOPCServer version R9.4c and prior that were installed by PAC Project installer versions prior to R9.4008 and OptoDataLink version R9.4d and prior that were installed by PAC Project installer versions prior to R9.4008. Opto 22 suggests upgrading to the new product version as soon as possible.


A vulnerable file in Opto 22 PAC Project Professional versions prior to R9.4006 PAC Project Basic versions prior to R9.4006 PAC Display Basic versions prior to R9.4f PAC Display Professional versions prior to R9.4f OptoOPCServer versions prior to R9.4c and OptoDataLink version R9.4d and prior versions that were installed by PAC Project installer versions prior to R9.4006 is susceptible to a heap-based buffer overflow condition that may allow remote code execution on the target system. Opto 22 suggests upgrading to the new product version as soon as possible.


An issue was discovered on Samsung mobile devices with software through 2015-11-12 affecting the Galaxy S6/S6 Edge Galaxy S6 Edge+ and Galaxy Note5 with the Shannon333 chipset. There is a stack-based buffer overflow in the baseband process that is exploitable for remote code execution via a fake base station. The Samsung ID is SVE-2015-5123 (December 2015).


FFmpeg

before

commit

contains

a

Buffer

Overflow

vulnerability

in

format

demuxer

that

can

result

in

heap-buffer-overflow

that

may

result

in

remote

code

execution.

This

attack

appears

to

be

exploitable

via

specially

crafted

ASF

file

that

has

to

be

provided

as

input

to

FFmpeg.

This

vulnerability

appears

to

have

been

fixed

in

and

later.


A buffer overflow vulnerability in the DHCP and PPPOE configuration interface of the Auerswald COMfort 1200 IP phone 3.4.4.1-10589 allows a remote attacker (authenticated as simple user in the same network as the device) to trigger remote code execution via a POST request (ManufacturerName parameter) to the web server on the device. The web server is running with root privileges and the injected code will also run with root privileges.


A buffer overflow vulnerability exists in the Microsoft JET Database Engine that could allow remote code execution on an affected system aka \Microsoft JET Database Engine Remote Code Execution Vulnerability.\ This affects Windows 7 Windows Server 2012 R2 Windows RT 8.1 Windows Server 2008 Windows Server 2012 Windows 8.1 Windows Server 2016 Windows Server 2008 R2 Windows 10 Windows 10 Servers. This CVE ID is unique from CVE-2018-8392.


A buffer overflow vulnerability exists in the Microsoft JET Database Engine that could allow remote code execution on an affected system aka \Microsoft JET Database Engine Remote Code Execution Vulnerability.\ This affects Windows 7 Windows Server 2012 R2 Windows RT 8.1 Windows Server 2008 Windows Server 2012 Windows 8.1 Windows Server 2016 Windows Server 2008 R2 Windows 10 Windows 10 Servers. This CVE ID is unique from CVE-2018-8393.


Eaton 9000X DriveA versions 2.0.29 and prior has a stack-based buffer overflow vulnerability which may allow remote code execution.


In Delta Electronics Automation TPEditor version 1.89 or prior parsing a malformed program file may cause heap-based buffer overflow vulnerability which may allow remote code execution.


In Lantech IDS 2102 2.0 and prior a stack-based buffer overflow vulnerability has been identified which may allow remote code execution. A CVSS v3 base score of 9.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).


D-Link DIR-816 A2 1.10 B05 devices allow arbitrary remote code execution without authentication via the newpass parameter. In the /goform/form2userconfig.cgi handler function a long password may lead to a stack-based buffer overflow and overwrite a return address.


Buffer overflow in PCMan FTP Server 2.0.7 allows for remote code execution via the APPE command.


An exploitable stack-based buffer overflow exists in the Microsoft Word document conversion functionality of the Antenna House Office Server Document Converter version V6.1 Pro MR2 for Linux64 (6 1 2018 0312). A crafted Microsoft Word (DOC) document can lead to a stack-based buffer overflow resulting in remote code execution.


An exploitable remote code execution vulnerability exists in the HTTP header-parsing function of the TP-Link TL-R600VPN HTTP Server. A specially crafted HTTP request can cause a buffer overflow resulting in remote code execution on the device. An attacker can send an authenticated HTTP request to trigger this vulnerability.


An exploitable stack-based buffer overflow vulnerability exists in the 802dot1xclientcert.cgi functionality of Sony IPELA E Series Camera G5 firmware 1.87.00. A specially crafted POST can cause a stack-based buffer overflow resulting in remote code execution. An attacker can send a malicious POST request to trigger this vulnerability.


The mobi_decompress_lz77 function in compression.c in Libmobi 0.3 allows remote attackers to cause remote code execution (heap-based buffer overflow) via a crafted mobi file.


CNCSoft Version 1.00.83 and prior with ScreenEditor Version 1.00.54 has multiple stack-based buffer overflow vulnerabilities that could cause the software to crash due to lacking user input validation before copying data from project files onto the stack. Which may allow an attacker to gain remote code execution with administrator privileges if exploited.


A buffer overflow vulnerability exists in the Microsoft JET Database Engine that could allow remote code execution on an affected system aka \Microsoft JET Database Engine Remote Code Execution Vulnerability.\ This affects Windows 7 Windows Server 2012 R2 Windows RT 8.1 Windows Server 2008 Windows Server 2012 Windows 8.1 Windows Server 2016 Windows Server 2008 R2 Windows 10.


KadNode version version 2.2.0 contains a Buffer Overflow vulnerability in Arguments when starting up the binary that can result in Control of program execution flow leading to remote code execution.


contiki-ng version 4 contains a Buffer Overflow vulnerability in AQL (Antelope Query Language) database engine that can result in Attacker can perform Remote Code Execution on device using Contiki-NG operating system. This attack appear to be exploitable via Attacker must be able to run malicious AQL code (e.g. via SQL-like Injection attack).


rsyslog librelp version 1.2.14 and earlier contains a Buffer Overflow vulnerability in the checking of x509 certificates from a peer that can result in Remote code execution. This attack appear to be exploitable a remote attacker that can connect to rsyslog and trigger a stack buffer overflow by sending a specially crafted x509 certificate.


WECON Technology Co. Ltd. PI Studio HMI versions 4.1.9 and prior and PI Studio versions 4.2.34 and prior have a stack-based buffer overflow vulnerability which may allow remote code execution.


A security vulnerability has been identified with certain HP Inkjet printers. A maliciously crafted file sent to an affected device can cause a static buffer overflow which could allow remote code execution.


A security vulnerability has been identified with certain HP Inkjet printers. A maliciously crafted file sent to an affected device can cause a stack buffer overflow which could allow remote code execution.


An issue was discovered in Polycom Group Series 6.1.6.1 and earlier HDX 3.1.12 and earlier and Pano 1.1.1 and earlier. A remote code execution vulnerability exists in the content sharing functionality because of a Buffer Overflow via crafted packets.


A Buffer Overflow exploited through web interface by remote attacker can cause remote code execution in Kraftway 24F2XG Router firmware 3.5.30.1118.


WebAccess Versions 8.3.2 and prior. The application fails to properly validate the length of user-supplied data causing a buffer overflow condition that allows for arbitrary remote code execution.


A stack-based buffer overflow (Remote Code Execution) issue was discovered in Design Science MathType 6.9c. This occurs in a function call in which the first argument is a corrupted offset value and the second argument is a stack buffer. This is fixed in 6.9d.


A stack-based buffer overflow in Forcepoint Email Security version 8.5 allows an attacker to craft malicious input and potentially crash a process creating a denial-of-service. While no known Remote Code Execution (RCE) vulnerabilities exist as with all buffer overflows the possibility of RCE cannot be completely ruled out. Data Execution Protection (DEP) is already enabled on the Email appliance as a risk mitigation.


There is a buffer overwrite vulnerability in the Quram qmg library of Samsung's Android OS versions O(8.x) P(9.0) and Q(10.0). An unauthenticated unauthorized attacker sending a specially crafted MMS to a vulnerable phone can trigger a heap-based buffer overflow in the Quram image codec leading to an arbitrary remote code execution (RCE) without any user interaction. The Samsung ID is SVE-2020-16747.


There is a buffer overflow vulnerability in some Huawei products. The vulnerability can be exploited by an attacker to perform remote code execution on the affected products when the affected product functions as an optical line terminal (OLT). Affected product versions include:SmartAX MA5600T versions V800R013C10 V800R015C00 V800R015C10 V800R017C00 V800R017C10 V800R018C00 V800R018C10; SmartAX MA5800 versions V100R017C00 V100R017C10 V100R018C00 V100R018C10 V100R019C10; SmartAX EA5800 versions V100R018C00 V100R018C10 V100R019C10.


An unauthenticated stack-based buffer overflow vulnerability in common.c's handle_PORT in uftpd FTP server versions 2.10 and earlier can be abused to cause a crash and could potentially lead to remote code execution.


There are multiple buffer overflow vulnerabilities that could lead to unauthenticated remote code execution by sending especially crafted packets destined to the PAPI (Aruba Networks AP management protocol) UDP port (8211) of access-points or controllers in Aruba 9000 Gateway; Aruba 7000 Series Mobility Controllers; Aruba 7200 Series Mobility Controllers version(s): 2.1.0.1 2.2.0.0 and below; 6.4.4.23 6.5.4.17 8.2.2.9 8.3.0.13 8.5.0.10 8.6.0.5 8.7.0.0 and below; 6.4.4.23 6.5.4.17 8.2.2.9 8.3.0.13 8.5.0.10 8.6.0.5 8.7.0.0 and below.


A tftpserver stack-based buffer overflow remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).


Philips Hue Bridge model 2.X prior to and including version 1935144020 contains a Heap-based Buffer Overflow when handling a long ZCL string during the commissioning phase resulting in a remote code execution.


An exploitable code execution vulnerability exists in the ANI file format parser of Leadtools 20. A specially crafted ANI file can cause a buffer overflow resulting in remote code execution. An attacker can provide a malicious file to trigger this vulnerability.


Advantech WebAccess HMI Designer Versions 2.1.9.31 and prior. Processing specially crafted project files lacking proper validation of user supplied data may cause a stack-based buffer overflow which may allow remote code execution disclosure/modification of information or cause the application to crash.


Advantech WebAccess HMI Designer Versions 2.1.9.31 and prior. Multiple heap-based buffer overflow vulnerabilities may be exploited by opening specially crafted project files that may overflow the heap which may allow remote code execution disclosure/modification of information or cause the application to crash.


The vulnerability function is enabled when the streamer service related to the AfreecaTV communicated through web socket using 21201 port. A stack-based buffer overflow leading to remote code execution was discovered in strcpy() operate by \FanTicket\ field. It is because of stored data without validation of length.


Documalis Free PDF Editor version 5.7.2.26 and Documalis Free PDF Scanner version 5.7.2.122 do not appropriately validate the contents of JPEG images contained within a PDF. Attackers can exploit this vulnerability to trigger a buffer overflow on the stack and gain remote code execution as the user running the Documalis Free PDF Editor or Documalis Free PDF Scanner software.


In NetHack before 3.6.5 unknown options starting with -de and -i can cause a buffer overflow resulting in a crash or remote code execution/privilege escalation. This vulnerability affects systems that have NetHack installed suid/sgid and shared systems that allow users to influence command line options. Users should upgrade to NetHack 3.6.5.


In NetHack before 3.6.5 an invalid extended command in value for the AUTOCOMPLETE configuration file option can cause a buffer overflow resulting in a crash or remote code execution/privilege escalation. This vulnerability affects systems that have NetHack installed suid/sgid and shared systems that allow users to upload their own configuration files. Users should upgrade to NetHack 3.6.5.


It's been found that multiple functions in ipmitool before 1.8.19 neglect proper checking of the data received from a remote LAN party which may lead to buffer overflows and potentially to remote code execution on the ipmitool side. This is especially dangerous if ipmitool is run as a privileged user. This problem is fixed in version 1.8.19.


In NetHack before 3.6.5 an invalid argument to the -w command line option can cause a buffer overflow resulting in a crash or remote code execution/privilege escalation. This vulnerability affects systems that have NetHack installed suid/sgid and shared systems that allow users to influence command line options. Users should upgrade to NetHack 3.6.5.


In NetHack before 3.6.5 detecting an unknown configuration file option can cause a buffer overflow resulting in a crash or remote code execution/privilege escalation. This vulnerability affects systems that have NetHack installed suid/sgid and shared systems that allow users to upload their own configuration files. Users should upgrade to NetHack 3.6.5.


In NetHack before 3.6.5 an extremely long value for the MENUCOLOR configuration file option can cause a buffer overflow resulting in a crash or remote code execution/privilege escalation. This vulnerability affects systems that have NetHack installed suid/sgid and shared systems that allow users to upload their own configuration files. Users should upgrade to NetHack 3.6.5.


In NetHack before 3.6.5 too long of a value for the SYMBOL configuration file option can cause a buffer overflow resulting in a crash or remote code execution/privilege escalation. This vulnerability affects systems that have NetHack installed suid/sgid and shared systems that allow users to upload their own configuration files. Users should upgrade to NetHack 3.6.5.


An issue was discovered on Wavlink WL-WN530HG4 M30HG4.V5030.191116 devices. Multiple buffer overflow vulnerabilities exist in CGI scripts leading to remote code execution with root privileges. (The set of affected scripts is similar to CVE-2020-12266.)


Silicon Labs Bluetooth Low Energy SDK before 2.13.3 has a buffer overflow via packet data. This is an over-the-air remote code execution vulnerability in Bluetooth LE in EFR32 SoCs and associated modules running Bluetooth SDK supporting Central or Observer roles.


Sophos XG Firewall 17.x through v17.5 MR12 allows a Buffer Overflow and remote code execution via the HTTP/S Bookmarks feature for clientless access. Hotfix HF062020.1 was published for all firewalls running v17.x.


In ih264d_release_display_bufs of ih264d_utils.c there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-145364230


In

of

sbrdecoder.cpp

there

is

a

possible

out

of

bounds

write

due

to

a

heap

buffer

overflow.

This

could

lead

to

remote

code

execution

with

no

additional

execution

privileges

needed.

User

interaction

is

needed

for

exploitation.Product:

AndroidVersions:

ID:


In ideint_weave_blk of ideint_utils.c there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-140324890


An issue was discovered on D-Link DIR-825 R1 devices through 3.0.1 before 2020-11-20. A buffer overflow in the web interface allows attackers to achieve pre-authentication remote code execution.


A heap-based buffer overflow vulnerability exists in the configuration server functionality of the Cosori Smart 5.8-Quart Air Fryer CS158-AF 1.1.0. A specially crafted JSON object can lead to remote code execution. An attacker can send a malicious packet to trigger this vulnerability.


ReadyMedia (aka MiniDLNA) before versions 1.3.0 allows remote code execution. Sending a malicious UPnP HTTP request to the miniDLNA service using HTTP chunked encoding can lead to a signedness bug resulting in a buffer overflow in calls to memcpy/memmove.


The Zephyr MQTT parsing code performs insufficient checking of the length field on publish messages allowing a buffer overflow and potentially remote code execution. NCC-ZEP-031 This issue affects: zephyrproject-rtos zephyr version 2.2.0 and later versions.


Ping Identity PingID SSH before 4.0.14 contains a heap buffer overflow in PingID-enrolled servers. This condition can be potentially exploited into a Remote Code Execution vector on the authenticating endpoint.


pam-krb5 before 4.9 has a buffer overflow that might cause remote code execution in situations involving supplemental prompting by a Kerberos library. It may overflow a buffer provided by the underlying Kerberos library by a single '\\0' byte if an attacker responds to a prompt with an answer of a carefully chosen length. The effect may range from heap corruption to stack corruption depending on the structure of the underlying Kerberos library with unknown effects but possibly including code execution. This code path is not used for normal authentication but only when the Kerberos library does supplemental prompting such as with PKINIT or when using the non-standard no_prompt PAM configuration option.


An exploitable stack-based buffer overflow vulnerability exists in the querying functionality of Aerospike Database Server 3.10.0.3. A specially crafted packet can cause a stack-based buffer overflow in the function as_sindex__simatch_list_by_set_binid resulting in remote code execution. An attacker can simply connect to the port to trigger this vulnerability.


An exploitable stack-based buffer overflow vulnerability exists in the querying functionality of Aerospike Database Server 3.10.0.3. A specially crafted packet can cause a stack-based buffer overflow in the function as_sindex__simatch_by_iname resulting in remote code execution. An attacker can simply connect to the port to trigger this vulnerability.


An issue was discovered in Fatek Automation PLC WinProladder Version 3.11 Build 14701. A stack-based buffer overflow vulnerability exists when the software application connects to a malicious server resulting in a stack buffer overflow. This causes an exploitable Structured Exception Handler (SEH) overwrite condition that may allow remote code execution.


The NETGEAR WNR2000v5 router contains a buffer overflow in the hidden_lang_avi parameter when invoking the URL /apply.cgi?/lang_check.html. This buffer overflow can be exploited by an unauthenticated attacker to achieve remote code execution.


An exploitable buffer overflow exists in the XLS parsing of the Lexmark Perspective Document Filters conversion functionality. A crafted XLS document can lead to a stack based buffer overflow resulting in remote code execution.


An exploitable heap-based buffer overflow exists in the handling of TIFF images in LibTIFF's TIFF2PDF tool. A crafted TIFF document can lead to a heap-based buffer overflow resulting in remote code execution. Vulnerability can be triggered via a saved TIFF file delivered by other means.


LAquis SCADA Versions 4.1.0.3870 and prior has several stack-based buffer overflow vulnerabilities which may allow remote code execution.


A stack-based buffer overflow in zap_parse_args in zap.c in zap in Ruckus Unleashed through 200.7.10.102.64 allows remote code execution via an unauthenticated HTTP request.


A stack-based buffer overflow vulnerability in Advantech WebAccess Versions 9.02 and prior caused by a lack of proper validation of the length of user-supplied data may allow remote code execution.


A stack-based buffer overflow in image_load_bmp() in HTMLDOC <= 1.9.13 results in remote code execution if the victim converts an HTML document linking to a crafted BMP file.


A stack-based buffer overflow can occur for specially crafted PDF files in Foxit Reader SDK (ActiveX) 5.4.0.1031 when parsing the URI string. An attacker can leverage this to gain remote code execution.


A stack-based buffer overflow vulnerability in Opto 22 PAC Control Basic and PAC Control Professional versions R10.0a and prior may allow remote code execution.


A Stack-based Buffer Overflow issue was discovered in GE D60 Line Distance Relay devices running firmware Version 7.11 and prior. Multiple stack-based buffer overflow vulnerabilities have been identified which may allow remote code execution.


A Stack-based Buffer Overflow issue was discovered in Fuji Electric V-Server VPR 4.0.1.0 and prior. The stack-based buffer overflow vulnerability has been identified which may allow remote code execution.


A stack-based buffer overflow vulnerability has been identified in Teledyne DALSA Sherlock Version 7.2.7.4 and prior which may allow remote code execution.


Advantech WebAccess Node Version 8.4.4 and prior Version 9.0.0. Multiple heap-based buffer overflow vulnerabilities exist caused by a lack of proper validation of the length of user-supplied data which may allow remote code execution.


Advantech WebAccess Node Version 8.4.4 and prior Version 9.0.0. Multiple stack-based buffer overflow vulnerabilities exist caused by a lack of proper validation of the length of user-supplied data which may allow remote code execution.


A buffer overflow vulnerability in McAfee Data Loss Prevention (DLP) Discover prior to 11.6.100 allows an attacker in the same network as the DLP Discover to execute arbitrary code through placing carefully constructed Ami Pro (.sam) files onto a machine and having DLP Discover scan it leading to remote code execution with elevated privileges. This is caused by the destination buffer being of fixed size and incorrect checks being made on the source size.

remote code execution
buffer overflow
arbitrary code execution


Heap-based buffer overflow in the Wireless LAN AutoConfig Service (aka Wlansvc) in Microsoft Windows Vista Gold SP1 and SP2 and Server 2008 Gold and SP2 allows remote attackers to execute arbitrary code via a malformed wireless frame aka \Wireless Frame Parsing Remote Code Execution Vulnerability.\


** DISPUTED ** Stack-based buffer overflow in Mozilla Firefox allows remote attackers to execute arbitrary code via unspecified vectors involving JavaScript. NOTE: the vendor and original researchers have released a follow-up comment disputing the severity of this issue in which the researcher states that \we mentioned that there was a previously known Firefox vulnerability that could result in a stack overflow ending up in remote code execution. However the code we presented did not in fact do this... I have not succeeded in making this code do anything more than cause a crash and eat up system resources\.


Microsoft Internet Explorer 6 through 9 and 10 Consumer Preview does not properly handle objects in memory which allows remote attackers to execute arbitrary code by attempting to access a nonexistent object leading to a heap-based buffer overflow aka \Col Element Remote Code Execution Vulnerability \ as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2012.


Buffer overflow in SMB in the Server service in Microsoft Windows 2000 SP4 XP SP2 and SP3 and Server 2003 SP1 and SP2 allows remote attackers to execute arbitrary code via malformed values of unspecified \fields inside the SMB packets\ in an NT Trans request aka \SMB Buffer Overflow Remote Code Execution Vulnerability.\


Heap-based buffer overflow in the Microsoft Message Queuing (MSMQ) service (mqsvc.exe) in Microsoft Windows 2000 SP4 allows remote attackers to read memory contents and execute arbitrary code via a crafted RPC call related to improper processing of parameters to string APIs aka \Message Queuing Service Remote Code Execution Vulnerability.\


The DNS feature in InterNiche NicheStack TCP/IP 4.0.1 is affected by: Buffer Overflow. The impact is: execute arbitrary code (remote). The component is: DNS response processing functions: dns_upcall() getoffset() dnc_set_answer(). The attack vector is: a specific DNS response packet. The code does not check the \response data length\ field of individual DNS answers which may cause out-of-bounds read/write operations leading to Information leak Denial-or-Service or Remote Code Execution depending on the context.

remote code execution
buffer overflow
arbitrary code execution
out of bound read


In BIND 9.5.0 -> 9.11.29 9.12.0 -> 9.16.13 and versions BIND 9.11.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND Supported Preview Edition as well as release versions 9.17.0 -> 9.17.1 of the BIND 9.17 development branch BIND servers are vulnerable if they are running an affected version and are configured to use GSS-TSIG features. In a configuration which uses BIND's default settings the vulnerable code path is not exposed but a server can be rendered vulnerable by explicitly setting values for the tkey-gssapi-keytab or tkey-gssapi-credential configuration options. Although the default configuration is not vulnerable GSS-TSIG is frequently used in networks where BIND is integrated with Samba as well as in mixed-server environments that combine BIND servers with Active Directory domain controllers. For servers that meet these conditions the ISC SPNEGO implementation is vulnerable to various attacks depending on the CPU architecture for which BIND was built: For named binaries compiled for 64-bit platforms this flaw can be used to trigger a buffer over-read leading to a server crash. For named binaries compiled for 32-bit platforms this flaw can be used to trigger a server crash due to a buffer overflow and possibly also to achieve remote code execution. We have determined that standard SPNEGO implementations are available in the MIT and Heimdal Kerberos libraries which support a broad range of operating systems rendering the ISC implementation unnecessary and obsolete. Therefore to reduce the attack surface for BIND users we will be removing the ISC SPNEGO implementation in the April releases of BIND 9.11 and 9.16 (it had already been dropped from BIND 9.17). We would not normally remove something from a stable ESV (Extended Support Version) of BIND but since system libraries can replace the ISC SPNEGO implementation we have made an exception in this case for reasons of stability and security.

remote code execution
buffer overflow
buffer overread


A buffer overflow issue was discovered in HMI3 Control Panel in Swisslog Healthcare Nexus Panel operated by released versions of software before Nexus Software 7.2.5.7. If an attacker sends a malformed UDP message a buffer underflow occurs leading to an out-of-bounds copy and possible remote code execution.

remote code execution
buffer overflow
buffer underflow


Grandstream GAC2500 1.0.3.35 GXP2200 1.0.3.27 GVC3202 1.0.3.51 GXV3275 before 1.0.3.219 Beta and GXV3240 before 1.0.3.219 Beta devices allow unauthenticated remote code execution via shell metacharacters in a /manager?action=getlogcat priority field in conjunction with a buffer overflow (via the phonecookie cookie) to overwrite a data structure and consequently bypass authentication. This can be exploited remotely or via CSRF because the cookie can be placed in an Accept HTTP header in an XMLHttpRequest call to lighttpd.

remote code execution
buffer overflow
bypass authentication


On BIG-IP versions 16.0.x before 16.0.1.1 15.1.x before 15.1.2.1 14.1.x before 14.1.4 13.1.x before 13.1.3.6 12.1.x before 12.1.5.3 and 11.6.x before 11.6.5.3 a malicious HTTP response to an Advanced WAF/BIG-IP ASM virtual server with Login Page configured in its policy may trigger a buffer overflow resulting in a DoS attack. In certain situations it may allow remote code execution (RCE) leading to complete system compromise. Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.

remote code execution
buffer overflow
dos


On BIG-IP versions 16.0.x before 16.0.1.1 15.1.x before 15.1.2.1 14.1.x before 14.1.4 13.1.x before 13.1.3.6 and 12.1.x before 12.1.5.3 undisclosed requests to a virtual server may be incorrectly handled by the Traffic Management Microkernel (TMM) URI normalization which may trigger a buffer overflow resulting in a DoS attack. In certain situations it may theoretically allow bypass of URL based access control or remote code execution (RCE). Note: Software versions which have reached End of Software Development (EoSD) are not evaluated.


In TightVNC 1.3.10 there is an integer signedness error and resultant heap-based buffer overflow in InitialiseRFBConnection in rfbproto.c (for the vncviewer component). There is no check on the size given to malloc e.g. -1 is accepted. This allocates a chunk of size zero which will give a heap pointer. However one can send 0xffffffff bytes of data which can have a DoS impact or lead to remote code execution.


Huawei DP300 V500R002C00 have a buffer overflow vulnerability due to the lack of validation. An authenticated local attacker can craft specific XML files to the affected products and parse this file which result in DoS attacks or remote code execution on the device.


Core FTP LE version 2.2 Build 1921 is prone to a buffer overflow vulnerability that may result in a DoS or remote code execution via a PASV response.


A stack-based buffer overflow in the LAN UPnP service running on UDP port 1900 of Swisscom Internet-Box (2 Standard and Plus) prior to v09.04.00 and Internet-Box light prior to v08.05.02 allows remote code execution. No authentication is required to exploit this vulnerability. Sending a simple UDP packet to port 1900 allows an attacker to execute code on a remote device. However this is only possible if the attacker is inside the LAN. Because of ASLR the success rate is not 100% and leads instead to a DoS of the UPnP service. The remaining functionality of the Internet Box is not affected. A reboot of the Internet Box is necessary to attempt the exploit again.


In Emerson Ovation OCR400 Controller 3.3.1 and earlier a stack-based buffer overflow vulnerability in the embedded third-party FTP server involves improper handling of a long file name from the LIST command to the FTP service which may cause the service to overwrite buffers leading to remote code execution and escalation of privileges.

remote code execution
buffer overflow
escalated privilege


Addressed multiple stack buffer overflow vulnerabilities that could allow an attacker to carry out escalation of privileges through unauthorized remote code execution in Western Digital My Cloud devices before 5.04.114.


In Emerson Ovation OCR400 Controller 3.3.1 and earlier a heap-based buffer overflow vulnerability in the embedded third-party FTP server involves improper handling of a long command to the FTP service which may cause memory corruption that halts the controller or leads to remote code execution and escalation of privileges.

remote code execution
buffer overflow
escalated privilege
memory corruption


A heap-based buffer overflow vulnerability exists in the OTA Update u-download functionality of Sealevel Systems Inc. SeaConnect 370W v1.3.34. A series of specially-crafted MQTT payloads can lead to remote code execution. An attacker must perform a man-in-the-middle attack in order to trigger this vulnerability.

remote code execution
buffer overflow
man in the middle


FreeRDP prior to version 2.0.0-rc4 contains an Integer Truncation that leads to a Heap-Based Buffer Overflow in function update_read_bitmap_update() and results in a memory corruption and probably even a remote code execution.

remote code execution
buffer overflow
memory corruption


FreeRDP prior to version 2.0.0-rc4 contains a Heap-Based Buffer Overflow in function zgfx_decompress() that results in a memory corruption and probably even a remote code execution.


FreeRDP prior to version 2.0.0-rc4 contains a Heap-Based Buffer Overflow in function zgfx_decompress_segment() that results in a memory corruption and probably even a remote code execution.


An exploitable heap-based buffer overflow vulnerability exists in the read_legacy_biff function of FreeXL 1.0.3. A specially crafted XLS file can cause a memory corruption resulting in remote code execution. An attacker can send malicious XLS file to trigger this vulnerability.


An exploitable stack based buffer overflow vulnerability exists in the xls_getfcell function of libxls 1.3.4. A specially crafted XLS file can cause a memory corruption resulting in remote code execution. An attacker can send malicious XLS file to trigger this vulnerability


An exploitable heap based buffer overflow vulnerability exists in the 'read_biff_next_record function' of FreeXL 1.0.3. A specially crafted XLS file can cause a memory corruption resulting in remote code execution. An attacker can send malicious XLS file to trigger this vulnerability.


** DISPUTED ** Vivotek FD8136 devices allow remote memory corruption and remote code execution because of a stack-based buffer overflow related to sprintf vlocal_buff_4326 and set_getparam.cgi. NOTE: The vendor has disputed this as a vulnerability and states that the issue does not cause a web server crash or have any other affect on it's performance.


A stack-based Buffer Overflow Vulnerability exists in the web server in Pulse Secure Pulse Connect Secure (PCS) before 8.3R4 and Pulse Policy Secure (PPS) before 5.4R4 leading to memory corruption and possibly remote code execution.


KMPlayer 4.2.2.15 and earlier have a Heap Based Buffer Overflow Vulnerability. It could be exploited with a crafted FLV format file. The problem is that more frame data is copied to heap memory than the size specified in the frame header. This results in a memory corruption and remote code execution.


Valve's Game Networking Sockets prior to version v1.2.0 improperly handles long unreliable segments in function SNP_ReceiveUnreliableSegment() when configured to support plain-text messages leading to a Heap-Based Buffer Overflow and resulting in a memory corruption and possibly even a remote code execution.


Valve's Game Networking Sockets prior to version v1.2.0 improperly handles long encrypted messages in function AES_GCM_DecryptContext::Decrypt() when compiled using libsodium leading to a Stack-Based Buffer Overflow and resulting in a memory corruption and possibly even a remote code execution.


A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (V1.81.01 - V1.81.03) LOGO! 8 BM (incl. SIPLUS variants) (V1.82.01) LOGO! 8 BM (incl. SIPLUS variants) (V1.82.02). A buffer overflow vulnerability exists in the Web Server functionality of the device. A remote unauthenticated attacker could send a specially crafted HTTP request to cause a memory corruption potentially resulting in remote code execution.


rdesktop versions up to and including v1.8.3 contain a Heap-Based Buffer Overflow in function ui_clip_handle_data() that results in a memory corruption and probably even a remote code execution.


rdesktop versions up to and including v1.8.3 contain a Heap-Based Buffer Overflow in function cssp_read_tsrequest() that results in a memory corruption and probably even a remote code execution.


rdesktop versions up to and including v1.8.3 contain a Heap-Based Buffer Overflow in function process_plane() that results in a memory corruption and probably even a remote code execution.


rdesktop versions up to and including v1.8.3 contain an Integer Underflow that leads to a Heap-Based Buffer Overflow in the function seamless_process() and results in memory corruption and probably even a remote code execution.


rdesktop versions up to and including v1.8.3 contain an Integer Underflow that leads to a Heap-Based Buffer Overflow in the function rdpsnddbg_process() and results in memory corruption and probably even a remote code execution.


rdesktop versions up to and including v1.8.3 contain an Integer Underflow that leads to a Heap-Based Buffer Overflow in the function lspci_process() and results in memory corruption and probably even a remote code execution.


rdesktop versions up to and including v1.8.3 contain a Buffer Overflow over the global variables in the function seamless_process_line() that results in memory corruption and probably even a remote code execution.


Entes EMG12 versions 2.57 and prior The application uses a web interface where it is possible for an attacker to bypass authentication with a specially crafted URL. This could allow for remote code execution.

remote code execution
bypass authentication


Multiple SQL injection vulnerabilities in Sourcecodester Pisay Online E-Learning System 1.0 allow remote unauthenticated attackers to bypass authentication and achieve Remote Code Execution (RCE) via the user_email user_pass and id parameters on the admin login-portal and the edit-lessons webpages.


PlaySMS 1.4 allows remote code execution because PHP code in the name of an uploaded .php file is executed. sendfromfile.php has a combination of Unrestricted File Upload and Code Injection.


Code injection vulnerability in blamer 1.0.0 and earlier may result in remote code execution when the input can be controlled by an attacker.


A code injection exists in node-df v0.1.4 that can allow an attacker to remote code execution by unsanitized input.


A Code Injection exists in tree-kill on Windows which allows a remote code execution when an attacker is able to control the input into the command.


A Code Injection exists in treekill on Windows which allows a remote code execution when an attacker is able to control the input into the command.


Groovy Code Injection & SpEL Injection which lead to Remote Code Execution. This issue affected Apache ShenYu 2.4.0 and 2.4.1.


CarrierWave is an open-source RubyGem which provides a simple and flexible way to upload files from Ruby applications. In CarrierWave before versions 1.3.2 and 2.1.1 there is a code injection vulnerability. The \#manipulate!\ method inappropriately evals the content of mutation option(:read/:write) allowing attackers to craft a string that can be executed as a Ruby code. If an application developer supplies untrusted inputs to the option it will lead to remote code execution(RCE). This is fixed in versions 1.3.2 and 2.1.1.


Ballcat Codegen provides the function of online editing code to generate templates. In versions prior to 1.0.0.beta.2 attackers can implement remote code execution through malicious code injection of the template engine. This happens because Velocity and freemarker templates are introduced but input verification is not done. The fault is rectified in version 1.0.0.beta.2.


A Code Injection issue was discovered in CyberVision Kaa IoT Platform Version 0.7.4. An insufficient-encapsulation vulnerability has been identified which may allow remote code execution.


It

was

found

that

the

JAXP

implementation

used

in

JBoss

EAP

for

XSLT

processing

is

vulnerable

to

code

injection.

An

attacker

could

use

this

flaw

to

cause

remote

code

execution

if

they

are

able

to

provide

XSLT

content

for

parsing.

Doing

a

transform

in

JAXP

requires

the

use

of

a

'javax.xml.transform.TransformerFactory'.

If

the

feature

is

set

to

'true'

it

mitigates

this

vulnerability.


A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly aka \.NET Framework Remote Code Injection Vulnerability.\ This affects Microsoft .NET Framework 2.0 Microsoft .NET Framework 3.0 Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 4.5.2 Microsoft .NET Framework 4.6 Microsoft .NET Framework 4.7/4.7.1/4.7.2 Microsoft .NET Framework 4.7.1/4.7.2 Microsoft .NET Framework 3.5 Microsoft .NET Framework 3.5.1 Microsoft .NET Framework 4.6/4.6.1/4.6.2 Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.1/4.7.2 Microsoft .NET Framework 4.7.2.


A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly aka \.NET Framework Remote Code Injection Vulnerability.\ This affects Microsoft .NET Framework 4.6 Microsoft .NET Framework 3.5 Microsoft .NET Framework 4.7/4.7.1/4.7.2 Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.1/4.7.2 Microsoft .NET Framework 3.5.1 Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 4.5.2 Microsoft .NET Framework 4.7.1/4.7.2 Microsoft .NET Framework 4.7.2 Microsoft .NET Framework 4.6.2.


Grouptime Teamwire Desktop Client 1.5.1 prior to 1.9.0 on Windows allows code injection via a template leading to remote code execution. All backend versions prior to prod-2018-11-13-15-00-42 are affected.


A Code Injection vulnerability exists in EVLink Parking v3.2.0-12_v1 and earlier which could enable access with maximum privileges when a remote code execution is performed.


** UNSUPPORTED WHEN ASSIGNED ** Sruu.pl in Batflat 1.3.6 allows an authenticated user to perform code injection (and consequently Remote Code Execution) via the input fields of the Users tab. To exploit this one must login to the administration panel and edit an arbitrary user's data (username displayed name etc.). NOTE: This vulnerability only affects products that are no longer supported by the maintainer.


OpenSolution Quick.CMS < 6.7 and Quick.Cart < 6.7 allow an authenticated user to perform code injection (and consequently Remote Code Execution) via the input fields of the Language tab.


A Remote Code Execution vulnerability exists in the SAP NetWeaver (ABAP Server up to release 7.40) and ABAP Platform (> release 7.40).Because of this an attacker can exploit these products via Code Injection and potentially enabling to take complete control of the products including viewing changing or deleting data by injecting code into the working memory which is subsequently executed by the application. It can also be used to cause a general fault in the product causing the products to terminate.


SuperWebMailer 7.21.0.01526 is susceptible to a remote code execution vulnerability in the Language parameter of mailingupgrade.php. An unauthenticated remote attacker can exploit this behavior to execute arbitrary PHP code via Code Injection.


VMware Cloud Director 10.0.x before 10.0.0.2 9.7.0.x before 9.7.0.5 9.5.0.x before 9.5.0.6 and 9.1.0.x before 9.1.0.4 do not properly handle input leading to a code injection vulnerability. An authenticated actor may be able to send malicious traffic to VMware Cloud Director which may lead to arbitrary remote code execution. This vulnerability can be exploited through the HTML5- and Flex-based UIs the API Explorer interface and API access.


Code42 environments with on-premises server versions 7.0.4 and earlier allow for possible remote code execution. When an administrator creates a local (non-SSO) user via a Code42-generated email the administrator has the option to modify content for the email invitation. If the administrator entered template language code in the subject line that code could be interpreted by the email generation services potentially resulting in server-side code injection.


Advantech WebAccess/SCADA Versions 8.3.5 and prior. Multiple command injection vulnerabilities caused by a lack of proper validation of user-supplied data may allow remote code execution.


Command Injection vulnerability in EmailWebPage API which can lead to a Remote Code Execution (RCE) from the Alerts Settings page.


In JetBrains TeamCity before 2020.2.4 OS command injection leading to remote code execution was possible.


Trend Micro Apex One could be exploited by an attacker utilizing a command injection vulnerability to extract files from an arbitrary zip file to a specific folder on the Apex One server which could potentially lead to remote code execution (RCE). The remote process execution is bound to the IUSR account which has restricted permission and is unable to make major system changes. An attempted attack requires user authentication.


TP-Link WDR Series devices through firmware v3 (such as TL-WDR5620 V3.0) are affected by command injection (after login) leading to remote code execution because shell metacharacters can be included in the weather get_weather_observe citycode field.


In WebAccess versions 8.4.1 and prior multiple command injection vulnerabilities are caused by a lack of proper validation of user-supplied data and may allow arbitrary file deletion and remote code execution.


Voice

Builder

Prior

to

commit

and

is

affected

by:

Improper

Neutralization

of

Special

Elements

used

in

an

OS

Command

('OS

Command

Injection').

The

impact

is:

Remote

code

execution

with

the

same

privileges

as

the

servers.

The

component

is:

Two

web

servers

in

the

projects

expose

three

vulnerable

endpoints

that

can

be

accessed

remotely.

The

endpoints

are

defined

at:

/tts:

/alignment:

/tts:

The

attack

vector

is:

Attacker

sends

a

GET

request

to

the

vulnerable

endpoint

with

a

specially

formatted

query

parameter.

The

fixed

version

is:

After

commit


An issue was discovered in Motorola CX2 1.01 and M2 1.01. There is a command injection in the function downloadFirmware in hnap which leads to remote code execution via shell metacharacters in a JSON value.


app/operator_panel/exec.php in the Operator Panel module in FusionPBX 4.4.3 suffers from a command injection vulnerability due to a lack of input validation that allows authenticated non-administrative attackers to execute commands on the host. This can further lead to remote code execution when combined with an XSS vulnerability also present in the FusionPBX Operator Panel module.


An issue was discovered in Motorola CX2 1.01 and M2 1.01. There is a command injection in the function startRmtAssist in hnap which leads to remote code execution via shell metacharacters in a JSON value.


XSS in app/operator_panel/index_inc.php in the Operator Panel module in FusionPBX 4.4.3 allows remote unauthenticated attackers to inject arbitrary JavaScript characters by placing a phone call using a specially crafted caller ID number. This can further lead to remote code execution by chaining this vulnerability with a command injection vulnerability also present in FusionPBX.


MantisBT before 1.3.20 and 2.22.1 allows Post Authentication Command Injection leading to Remote Code Execution.


An issue was discovered on various devices via the Linkplay firmware. There is WAN remote code execution without user interaction. An attacker could retrieve the AWS key from the firmware and obtain full control over Linkplay's AWS estate including S3 buckets containing device firmware. When combined with an OS command injection vulnerability within the XML Parsing logic of the firmware update process an attacker would be able to gain code execution on any device that attempted to update. Note that by default all devices tested had automatic updates enabled.


There is an OS Command Injection in Nexus Repository Manager <= 2.14.14 (bypass CVE-2019-5475) that could allow an attacker a Remote Code Execution (RCE). All instances using CommandLineExecutor.java with user-supplied data is vulnerable such as the Yum Configuration Capability.


An issue was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5. An attacker can exploit OS Command Injection in the filename parameter for remote code execution as root. This occurs in the Mainproc executable file which can be run from the HTTPD web server.


Unauthenticated remote code execution occurs in D-Link products such as DIR-655C DIR-866L DIR-652 and DHP-1565. The issue occurs when the attacker sends an arbitrary input to a \PingTest\ device common gateway interface that could lead to common injection. An attacker who successfully triggers the command injection could achieve full system compromise. Later it was independently found that these are also affected: DIR-855L DAP-1533 DIR-862L DIR-615 DIR-835 and DIR-825.


A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10 Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with system data manipulation privileges can execute aribitrary code through arbitrary file deletion and OS command injection.


A Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm 2.x prior to 2.2.1 and Apache Storm 1.x prior to 1.2.4. A specially crafted thrift request to the Nimbus server allows Remote Code Execution (RCE) prior to authentication.


A server side remote code execution vulnerability was found in Foreman project. A authenticated attacker could use Sendmail configuration options to overwrite the defaults and perform command injection. The highest threat from this vulnerability is to confidentiality integrity and availability of system. Fixed releases are 2.4.1 2.5.1 3.0.0.


Go before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to Command Injection and remote code execution when using the \go get\ command to fetch modules that make use of cgo (for example cgo can execute a gcc program from an untrusted download).


In Citrix XenMobile Server through 10.12 RP9 there is an Authenticated Command Injection vulnerability leading to remote code execution with root privileges.


A CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause remote code execution when performed over the network. Affected Product: StruxureWare Data Center Expert (V7.8.1 and prior)


Nagios XI Switch Wizard before version 2.5.7 is vulnerable to remote code execution through improper neutralisation of special elements used in an OS Command (OS Command injection).


Nagios XI WatchGuard Wizard before version 1.4.8 is vulnerable to remote code execution through Improper neutralisation of special elements used in an OS Command (OS Command injection).


Magento versions 2.4.1 (and earlier) 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to OS command injection via the WebAPI. Successful exploitation could lead to remote code execution by an authenticated attacker. Access to the admin console is required for successful exploitation.


vSphere Replication 8.3.x prior to 8.3.1.2 8.2.x prior to 8.2.1.1 8.1.x prior to 8.1.2.3 and 6.5.x prior to 6.5.1.5 contain a post-authentication command injection vulnerability which may allow an authenticated admin user to perform a remote code execution.


The @diez/generation npm package is a client for Diez. The locateFont method of @diez/generation has a command injection vulnerability. Clients of the @diez/generation library are unlikely to be aware of this so they might unwittingly write code that contains a vulnerability. This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. All versions of this package are vulnerable as of the writing of this CVE.


GLPI is an open source IT Asset Management issue tracking system and service desk system. The GLPI addressing plugin in versions < 2.9.1 suffers from authenticated Remote Code Execution vulnerability allowing access to the server's underlying operating system using command injection abuse of functionality. There is no workaround for this issue and users are advised to upgrade or to disable the addressing plugin.


The unprivileged user portal part of CentOS Web Panel is affected by a Command Injection vulnerability leading to root Remote Code Execution.


OS Command Injection vulnerability when changing date settings or hostname using web GUI of Nozomi Networks Guardian and CMC allows authenticated administrators to perform remote code execution. This issue affects: Nozomi Networks Guardian 20.0.7.3 version 20.0.7.3 and prior versions. Nozomi Networks CMC 20.0.7.3 version 20.0.7.3 and prior versions.


An OS command injection vulnerability exists in the console infactory_port functionality of InHand Networks InRouter302 V3.5.37. A specially-crafted series of network requests can lead to remote code execution. An attacker can send a sequence of requests to trigger this vulnerability.


An OS command injection vulnerability exists in the console infactory_net functionality of InHand Networks InRouter302 V3.5.37. A specially-crafted series of network requests can lead to remote code execution. An attacker can send a sequence of requests to trigger this vulnerability.


An OS command injection vulnerability exists in the console infactory_wlan functionality of InHand Networks InRouter302 V3.5.37. A specially-crafted series of network requests can lead to remote code execution. An attacker can send a sequence of requests to trigger this vulnerability.


VMware Carbon Black App Control (8.5.x prior to 8.5.14 8.6.x prior to 8.6.6 8.7.x prior to 8.7.4 and 8.8.x prior to 8.8.2) contains an OS command injection vulnerability. An authenticated high privileged malicious actor with network access to the VMware App Control administration interface may be able to execute commands on the server due to improper input validation leading to remote code execution.


A command injection remote code execution vulnerability was discovered on Western Digital My Cloud Devices that could allow an attacker to execute arbitrary system commands on the device. The vulnerability was addressed by escaping individual arguments to shell functions coming from user input.


An exploitable code execution vulnerability exists in the trapper command functionality of Zabbix Server 2.4.X. A specially crafted set of packets can cause a command injection resulting in remote code execution. An attacker can make requests from an active Zabbix Proxy to trigger this vulnerability.


The Lenovo Service Framework Android application executes some system commands without proper sanitization of external input. In certain cases this could lead to command injection which in turn could lead to remote code execution.


In EMC VNX2 versions prior to OE for File 8.1.9.211 and VNX1 versions prior to OE for File 7.1.80.8 an unauthenticated remote attacker may be able to elevate their permissions to root through a command injection. This may potentially be exploited by an attacker to run arbitrary code with root-level privileges on the targeted VNX Control Station system aka remote code execution.


ROOT xrootd version 4.6.0 and below is vulnerable to an unauthenticated shell command injection resulting in remote code execution


Foxit PDF ActiveX before 5.5.1 allows remote code execution via command injection because of the lack of a security permission control.


A command injection can occur for specially crafted PDF files in Foxit Reader SDK (ActiveX) Professional 5.4.0.1031 when the JavaScript API app.launchURL is used. An attacker can leverage this to gain remote code execution.


A command injection can occur for specially crafted PDF files in Foxit Reader SDK (ActiveX) Professional 5.4.0.1031 when using the Open File action on a Field. An attacker can leverage this to gain remote code execution.


A command injection can occur for specially crafted PDF files in Foxit Reader SDK (ActiveX) 5.4.0.1031 when parsing a launch action. An attacker can leverage this to gain remote code execution.