Multiple

vulnerabilities

in

Oracle

Java

before

Update

allow

remote

attackers

to

execute

arbitrary

code

by

using

the

public

getMBeanInstantiator

method

in

the

JmxMBeanServer

class

to

obtain

a

reference

to

a

private

MBeanInstantiator

object

then

retrieving

arbitrary

Class

references

using

the

findClass

method

and

using

the

Reflection

API

with

recursion

in

a

way

that

bypasses

a

security

check

by

the

java.lang.invoke.MethodHandles.Lookup.checkSecurityManager

method

due

to

the

inability

of

the

sun.reflect.Reflection.getCallerClass

method

to

skip

frames

related

to

the

new

reflection

API

as

exploited

in

the

wild

in

January

as

demonstrated

by

Blackhole

and

Nuclear

Pack

and

a

different

vulnerability

than

and

NOTE:

some

parties

have

mapped

the

recursive

Reflection

API

issue

to

but

is

for

a

different

vulnerability

whose

details

are

not

public

as

of

covers

both

the

JMX/MBean

and

Reflection

API

issues.

NOTE:

it

was

originally

reported

that

Java

was

also

vulnerable

but

the

reporter

has

retracted

this

claim

stating

that

Java

is

not

exploitable

because

the

relevant

code

is

called

in

a

way

that

does

not

bypass

security

checks.

NOTE:

as

of

a

reliable

third

party

has

claimed

that

the

findClass/MBeanInstantiator

vector

was

not

fixed

in

Oracle

Java

Update

If

there

is

still

a

vulnerable

condition

then

a

separate

CVE

identifier

might

be

created

for

the

unfixed

issue.


Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object aka \Internet Explorer CMarkupBehaviorContext Use After Free Vulnerability.\


Use-after-free vulnerability in the obj_toSource function in Mozilla Firefox before 18.0 Firefox ESR 17.x before 17.0.2 Thunderbird before 17.0.2 Thunderbird ESR 17.x before 17.0.2 and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code via a crafted web page referencing JavaScript Proxy objects that are not properly handled during garbage collection.


Use-after-free vulnerability in Adobe Flash Player before 10.3.183.68 and 11.x before 11.6.602.180 on Windows and Mac OS X before 10.3.183.68 and 11.x before 11.2.202.275 on Linux before 11.1.111.44 on Android 2.x and 3.x and before 11.1.115.48 on Android 4.x; Adobe AIR before 3.6.0.6090; Adobe AIR SDK before 3.6.0.6090; and Adobe AIR SDK & Compiler before 3.6.0.6090 allows attackers to execute arbitrary code via unspecified vectors.


Microsoft Silverlight 5 and 5 Developer Runtime before 5.1.20125.0 does not properly validate pointers during HTML object rendering which allows remote attackers to execute arbitrary code via a crafted Silverlight application aka \Silverlight Double Dereference Vulnerability.\


An ActiveX control in HscRemoteDeploy.dll in Honeywell Enterprise Buildings Integrator (EBI) R310 R400.2 R410.1 and R410.2; SymmetrE R310 R410.1 and R410.2; ComfortPoint Open Manager (aka CPO-M) Station R100; and HMIWeb Browser client packages allows remote attackers to execute arbitrary code via a crafted HTML document.


Unrestricted file upload vulnerability in the Live CSS module 6.x-2.x before 6.x-2.1 and 7.x-2.x before 7.x-2.7 for Drupal allows remote authenticated users with the \administer CSS\ permissions to execute arbitrary code by uploading a file with an executable extension then accessing it via a direct request to the file in an unspecified directory.


Use-after-free vulnerability in Adobe Flash Player before 10.3.183.63 and 11.x before 11.6.602.168 on Windows before 10.3.183.61 and 11.x before 11.6.602.167 on Mac OS X before 10.3.183.61 and 11.x before 11.2.202.270 on Linux before 11.1.111.43 on Android 2.x and 3.x and before 11.1.115.47 on Android 4.x; Adobe AIR before 3.6.0.597; and Adobe AIR SDK before 3.6.0.599 allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2013-0649 and CVE-2013-1374.


Integer signedness error in the pixman_fill_sse2 function in pixman-sse2.c in Pixman as distributed with Cairo and used in Mozilla Firefox before 20.0 Firefox ESR 17.x before 17.0.5 Thunderbird before 17.0.5 Thunderbird ESR 17.x before 17.0.5 SeaMonkey before 2.17 and other products allows remote attackers to execute arbitrary code via crafted values that trigger attempted use of a (1) negative box boundary or (2) negative box size leading to an out-of-bounds write operation.


The debugging feature on the Siemens CP 1604 and CP 1616 interface cards with firmware before 2.5.2 allows remote attackers to execute arbitrary code via a crafted packet to UDP port 17185.


Use-after-free vulnerability in the nsEditor::IsPreformatted function in editor/libeditor/base/nsEditor.cpp in Mozilla Firefox before 19.0.2 Firefox ESR 17.x before 17.0.4 Thunderbird before 17.0.4 Thunderbird ESR 17.x before 17.0.4 and SeaMonkey before 2.16.1 allows remote attackers to execute arbitrary code via vectors involving an execCommand call.


Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox before 18.0 Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2 Thunderbird before 17.0.2 Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.2 and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code via crafted web content.


The FactoryCast service on the Schneider Electric Quantum 140NOE77111 and 140NWM10000 M340 BMXNOE0110x and Premium TSXETY5103 PLC modules allows remote authenticated users to send Modbus messages and consequently execute arbitrary code by embedding these messages in SOAP HTTP POST requests.


Use-after-free vulnerability in Adobe Flash Player before 10.3.183.63 and 11.x before 11.6.602.168 on Windows before 10.3.183.61 and 11.x before 11.6.602.167 on Mac OS X before 10.3.183.61 and 11.x before 11.2.202.270 on Linux before 11.1.111.43 on Android 2.x and 3.x and before 11.1.115.47 on Android 4.x; Adobe AIR before 3.6.0.597; and Adobe AIR SDK before 3.6.0.599 allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2013-0644 and CVE-2013-1374.


The TFTP server on the Emerson Process Management ROC800 RTU with software 3.50 and earlier DL8000 RTU with software 2.30 and earlier and ROC800L RTU with software 1.20 and earlier allows remote attackers to upload files and consequently execute arbitrary code via unspecified vectors.


Microsoft Visio Viewer 2010 SP1 allows remote attackers to execute arbitrary code via a crafted Visio file that triggers incorrect memory allocation aka \Visio Viewer Tree Object Type Confusion Vulnerability.\


Quartz.dll in DirectShow in Microsoft Windows XP SP2 and SP3 Server 2003 SP2 Vista SP2 and Server 2008 SP2 allows remote attackers to execute arbitrary code via crafted media content in (1) a media file (2) a media stream or (3) a Microsoft Office document aka \Media Decompression Vulnerability.\


Adobe Reader and Acrobat 9.x before 9.5.3 10.x before 10.1.5 and 11.x before 11.0.1 allow attackers to execute arbitrary code via unspecified vectors related to a \logic error \ a different vulnerability than CVE-2013-0607 CVE-2013-0608 CVE-2013-0611 and CVE-2013-0618.


Google Chrome before 25.0.1364.97 on Windows and Linux and before 25.0.1364.99 on Mac OS X does not properly enforce a user gesture requirement before proceeding with a file download which might make it easier for remote attackers to execute arbitrary code via a crafted file.


Foreman before 1.1 allows remote attackers to execute arbitrary code via a crafted YAML object to the (1) fact or (2) report import API.


EMC Smarts Network Configuration Manager (NCM) before 9.2 does not require authentication for all Java RMI method calls which allows remote attackers to execute arbitrary code via unspecified vectors.


Rack::Session::Cookie in Rack 1.5.x before 1.5.2 1.4.x before 1.4.5 1.3.x before 1.3.10 1.2.x before 1.2.8 and 1.1.x before 1.1.6 allows remote attackers to guess the session cookie gain privileges and execute arbitrary code via a timing attack involving an HMAC comparison function that does not run in constant time.


The Windows Forms (aka WinForms) component in Microsoft .NET Framework 2.0 SP2 3.5 3.5.1 4 and 4.5 does not properly restrict the privileges of a callback function during object creation which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (XBAP) or (2) a crafted .NET Framework application aka \WinForms Callback Elevation Vulnerability.\


The AutoWrapperChanger class in Mozilla Firefox before 18.0 Firefox ESR 17.x before 17.0.2 Thunderbird before 17.0.2 Thunderbird ESR 17.x before 17.0.2 and SeaMonkey before 2.15 does not properly interact with garbage collection which allows remote attackers to execute arbitrary code via a crafted HTML document referencing JavaScript objects.


Adobe Reader and Acrobat 9.x before 9.5.3 10.x before 10.1.5 and 11.x before 11.0.1 allow attackers to execute arbitrary code via unspecified vectors related to a \logic error \ a different vulnerability than CVE-2013-0607 CVE-2013-0611 CVE-2013-0614 and CVE-2013-0618.


The Firefox sandbox in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X and before 10.3.183.67 and 11.x before 11.2.202.273 on Linux does not properly restrict privileges which makes it easier for remote attackers to execute arbitrary code via crafted SWF content as exploited in the wild in February 2013.


Untrusted search path vulnerability in Corel PaintShop Pro X5 and X6 16.0.0.113 15.2.0.2 and earlier allows local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse dwmapi.dll that is located in the same folder as a .jpg file.


Use-after-free vulnerability in Microsoft Internet Explorer 7 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object aka \Internet Explorer COmWindowProxy Use After Free Vulnerability.\


The nsSOCKSSocketInfo::ConnectToProxy function in Mozilla Firefox before 18.0 Firefox ESR 17.x before 17.0.2 Thunderbird before 17.0.2 Thunderbird ESR 17.x before 17.0.2 and SeaMonkey before 2.15 does not ensure thread safety for SSL sessions which allows remote attackers to execute arbitrary code via crafted data as demonstrated by e-mail message data.


Use-after-free vulnerability in the mozVibrate implementation in the Vibrate library in Mozilla Firefox before 18.0 Firefox ESR 17.x before 17.0.2 Thunderbird before 17.0.2 Thunderbird ESR 17.x before 17.0.2 and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code via vectors related to the domDoc pointer.


Adobe Reader and Acrobat 9.x before 9.5.3 10.x before 10.1.5 and 11.x before 11.0.1 allow attackers to execute arbitrary code via unspecified vectors related to a \logic error \ a different vulnerability than CVE-2013-0607 CVE-2013-0608 CVE-2013-0611 and CVE-2013-0614.


Microsoft .NET Framework 1.0 SP3 1.1 SP1 2.0 SP2 3.0 SP2 3.5 3.5.1 4 and 4.5 does not properly validate the permissions of objects in memory which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (XBAP) or (2) a crafted .NET Framework application aka \Double Construction Vulnerability.\


Use-after-free vulnerability in the ListenerManager implementation in Mozilla Firefox before 18.0 Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2 Thunderbird before 17.0.2 Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.2 and SeaMonkey before 2.15 allows remote attackers to execute arbitrary code via vectors involving the triggering of garbage collection after memory allocation for listener objects.


The kernel in ENEA OSE on the Emerson Process Management ROC800 RTU with software 3.50 and earlier DL8000 RTU with software 2.30 and earlier and ROC800L RTU with software 1.20 and earlier allows remote attackers to execute arbitrary code by connecting to the debug service.


A Command Execution Vulnerability exists in IBM Sterling External Authentication Server 2.2.0 2.3.01 2.4.0 and 2.4.1 via an unspecified OS command which could let a local malicious user execute arbitrary code.


Unspecified vulnerability in JustSystems Ichitaro 2006 and 2007 Ichitaro Government 2006 and 2007 Ichitaro Portable with oreplug Hanako 2006 through 2013 Hanako Police Hanako Police 3 and Hanako Police 2010 allows remote attackers to execute arbitrary code via a crafted file.


A PHP File Upload Vulnerability exists in PolarBear CMS 2.5 via upload.php which could let a malicious user execute arbitrary code.


Use-after-free vulnerability in the nsImageLoadingContent::OnStopContainer function in Mozilla Firefox before 19.0 Firefox ESR 17.x before 17.0.3 Thunderbird before 17.0.3 Thunderbird ESR 17.x before 17.0.3 and SeaMonkey before 2.16 allows remote attackers to execute arbitrary code via crafted web script.


Adobe Reader and Acrobat 9.x before 9.5.3 10.x before 10.1.5 and 11.x before 11.0.1 allow attackers to execute arbitrary code via unspecified vectors related to a \logic error \ a different vulnerability than CVE-2013-0607 CVE-2013-0608 CVE-2013-0614 and CVE-2013-0618.


The

Java

Runtime

Environment

(JRE)

component

in

Oracle

Java

SE

Update

and

earlier

Update

and

earlier

and

Update

and

earlier;

and

OpenJDK

and

allows

remote

attackers

to

execute

arbitrary

code

via

vectors

related

to

AWT

as

demonstrated

by

Ben

Murphy

during

a

competition

at

CanSecWest

NOTE:

the

previous

information

is

from

the

April

CPU.

Oracle

has

not

commented

on

claims

from

another

vendor

that

this

issue

is

related

to

invocation

of

the

system

class

loader

by

the

sun.awt.datatransfer.ClassLoaderObjectInputStream

class

which

allows

remote

attackers

to

bypass

Java

sandbox

restrictions.


Unspecified vulnerability on the HP ProCurve JC###A JC###B JD###A JD###B JE###A JF###A JF###B JF###C JG###A 658250-B21 and 658247-B21; HP 3COM routers and switches; and HP H3C routers and switches allows remote authenticated users to execute arbitrary code or obtain sensitive information via unknown vectors.


The cpansign verify functionality in the Module::Signature module before 0.72 for Perl allows attackers to bypass the signature check and execute arbitrary code via a SIGNATURE file with a \special unknown cipher\ that references an untrusted module in Digest/.


Movable Type before 5.2.6 does not properly use the Storable::thaw function which allows remote attackers to execute arbitrary code via the comment_state parameter.


The universal protocol implementation in Sixnet UDR before 2.0 and RTU firmware before 4.8 allows remote attackers to execute arbitrary code; read modify or create files; or obtain file metadata via function opcodes.


Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2013 aka \Internet Explorer Use After Free Vulnerability \ a different vulnerability than CVE-2013-1308 and CVE-2013-1309.


ResourceBuilderImpl.java in the RichFaces 3.x through 5.x implementation in Red Hat JBoss Web Framework Kit before 2.3.0 Red Hat JBoss Web Platform through 5.2.0 Red Hat JBoss Enterprise Application Platform through 4.3.0 CP10 and 5.x through 5.2.0 Red Hat JBoss BRMS through 5.3.1 Red Hat JBoss SOA Platform through 4.3.0 CP05 and 5.x through 5.3.1 Red Hat JBoss Portal through 4.3 CP07 and 5.x through 5.2.2 and Red Hat JBoss Operations Network through 2.4.2 and 3.x through 3.1.2 does not restrict the classes for which deserialization methods can be called which allows remote attackers to execute arbitrary code via crafted serialized data.


Unspecified vulnerability on the HP ProCurve JC###A JC###B JD###A JD###B JE###A JF###A JF###B JF###C JG###A 658250-B21 and 658247-B21; HP 3COM routers and switches; and HP H3C routers and switches allows remote attackers to execute arbitrary code or obtain sensitive information via unknown vectors.


Multiple array index errors in the MyHeritage SEQueryObject ActiveX control (SearchEngineQuery.dll) 1.0.2.0 allow remote attackers to execute arbitrary code via the (1) seTokensArray or (2) seTokensValuesArray parameter to the AddTokens method; (3) seLastNameTokensArray parameter to the AddLastNameTokens method; (4) seFrameIdArray (5) seSourceIdArray (6) seHasBreakdownArray (7) seIsIndexedArray (8) seAllConcatArray (9) seRefererURLArray or (10) seMandatoryFieldsArray parameter to the AddMultipleSearches method; (11) seSourceIdArray (12) seIsIndexedArray (13) seAllConcatArray (14) seRefererURLArray (15) seQATestsArray (16) seAllSourceIDsArray (17) seAllSourceTitlesArray (18) seMandatoryFieldsArray or (19) seAllSourceRootURLArray parameter to the TestYourself method.


Cisco Linksys E4200 1.0.05 Build 7 routers contain a Local File Include Vulnerability which could allow remote attackers to obtain sensitive information or execute arbitrary code by sending a crafted URL request to the apply.cgi script using the submit_type parameter.


Unspecified vulnerability on HP Integrated Lights-Out 3 (aka iLO3) cards with firmware before 1.57 and 4 (aka iLO4) cards with firmware before 1.22 when Single-Sign-On (SSO) is used allows remote attackers to execute arbitrary code via unknown vectors.


Puppet 2.6.x before 2.6.18 and Puppet Enterprise 1.2.x before 1.2.7 allows remote authenticated users to execute arbitrary code on the puppet master or an agent with puppet kick enabled via a crafted request for a report.


DirectShow in Microsoft Windows XP SP2 and SP3 Windows Server 2003 SP2 Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8 and Windows Server 2012 allows remote attackers to execute arbitrary code via a crafted GIF file aka \DirectShow Arbitrary Memory Overwrite Vulnerability.\


The USB drivers in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3 Windows Server 2003 SP2 Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8 Windows Server 2012 and Windows RT allow physically proximate attackers to execute arbitrary code by connecting a crafted USB device aka \Windows USB Descriptor Vulnerability.\


The kernel-mode drivers in Microsoft Windows XP SP2 and SP3 Windows Server 2003 SP2 Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8 Windows Server 2012 and Windows RT allow remote attackers to execute arbitrary code via a crafted CMAP table in a TrueType font (TTF) file aka \TrueType Font CMAP Table Vulnerability.\


Unrestricted file upload vulnerability in admin/uploadImage.html in SearchBlox before 7.5 build 1 allows remote attackers to execute arbitrary code by uploading an executable file with the image/jpeg content type and then accessing this file via unspecified vectors as demonstrated by access to a JSP file.


phpMyAdmin 3.5.x before 3.5.8 and 4.x before 4.0.0-rc3 when a SaveDir directory is configured allows remote authenticated users to execute arbitrary code by using a double extension in the filename of an export file leading to interpretation of this file as an executable file by the Apache HTTP Server as demonstrated by a .php.sql filename.


Microsoft .NET Framework 2.0 SP2 3.5 3.5.1 4 and 4.5 does not properly check the permissions of objects that use reflection which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (XBAP) or (2) a crafted .NET Framework application aka \Anonymous Method Injection Vulnerability.\


The web service framework in Cisco WAAS Software 4.x and 5.x before 5.0.3e 5.1.x before 5.1.1c and 5.2.x before 5.2.1 in a Central Manager (CM) configuration allows remote attackers to execute arbitrary code via a crafted POST request aka Bug ID CSCuh26626.


phpMyAdmin 3.5.x before 3.5.8 and 4.x before 4.0.0-rc3 allows remote authenticated users to execute arbitrary code via a /e\\x00 sequence which is not properly handled before making a preg_replace function call within the \Replace table prefix\ feature.


Microsoft .NET Framework 1.0 SP3 1.1 SP1 2.0 SP2 3.5 3.5.1 4 and 4.5 does not properly check the permissions of objects that use reflection which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (XBAP) or (2) a crafted .NET Framework application aka \Delegate Reflection Bypass Vulnerability.\


Microsoft Windows XP SP2 and SP3 Windows Server 2003 SP2 Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8 Windows Server 2012 and Windows RT allow remote attackers to execute arbitrary code via a malformed asynchronous RPC request aka \Remote Procedure Call Vulnerability.\


The WinVerifyTrust function in Microsoft Windows XP SP2 and SP3 Windows Server 2003 SP2 Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8 Windows 8.1 Windows Server 2012 Gold and R2 and Windows RT Gold and 8.1 does not properly validate PE file digests during Authenticode signature verification which allows remote attackers to execute arbitrary code via a crafted PE file aka \WinVerifyTrust Signature Validation Vulnerability.\


Microsoft Internet Explorer 9 and 10 when script debugging is enabled does not properly handle objects in memory during the processing of script which allows remote attackers to execute arbitrary code via a crafted web site aka \Internet Explorer Script Debug Vulnerability.\


The serialization functionality in Microsoft .NET Framework 2.0 SP2 3.5 3.5 SP1 3.5.1 4 and 4.5 does not properly check the permissions of delegate objects which allows remote attackers to execute arbitrary code via (1) a crafted XAML browser application (XBAP) or (2) a crafted .NET Framework application that leverages a partial-trust relationship aka \Delegate Serialization Vulnerability.\


The Common Language Runtime (CLR) in Microsoft .NET Framework 2.0 SP2 3.5 3.5.1 4 and 4.5 on 64-bit platforms does not properly allocate arrays of structures which allows remote attackers to execute arbitrary code via a crafted .NET Framework application that changes array data aka \Array Allocation Vulnerability.\


Trimble SketchUp (formerly Google SketchUp) before 2013 (13.0.3689) allows remote attackers to execute arbitrary code via a crafted color palette table in a MAC Pict texture which triggers an out-of-bounds stack write. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-3662. NOTE: this issue was SPLIT due to different affected products and codebases (ADT1); CVE-2013-7388 has been assigned to the paintlib issue.


The kernel-mode drivers in Microsoft Windows XP SP2 and SP3 Windows Server 2003 SP2 Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8 Windows Server 2012 and Windows RT and .NET Framework 3.0 SP2 3.5 3.5.1 4 and 4.5 allow remote attackers to execute arbitrary code via a crafted OpenType font (OTF) file aka \OpenType Font Parsing Vulnerability.\


The MrSID plugin (MrSID.dll) before 4.37 for IrfanView allows remote attackers to execute arbitrary code via a nband tag.


GDI+ in Microsoft Windows Vista SP2 and Server 2008 SP2; Office 2003 SP3 2007 SP3 and 2010 SP1 and SP2; Office Compatibility Pack SP3; and Lync 2010 2010 Attendee 2013 and Basic 2013 allows remote attackers to execute arbitrary code via a crafted TIFF image as demonstrated by an image in a Word document and exploited in the wild in October and November 2013.


Use-after-free vulnerability in the SetMouseCapture implementation in mshtml.dll in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code via crafted JavaScript strings as demonstrated by use of an ms-help: URL that triggers loading of hxds.dll.


Nitro Pro 7.5.0.22 and earlier and Nitro Reader 2.5.0.36 and earlier allow remote attackers to execute arbitrary code via a crafted PDF file.


Puppet 2.7.x before 2.7.22 and 3.2.x before 3.2.2 and Puppet Enterprise before 2.8.2 deserializes untrusted YAML which allows remote attackers to instantiate arbitrary Ruby classes and execute arbitrary code via a crafted REST API call.


Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allow remote attackers to execute arbitrary code via a crafted OLE object in a file aka \OLE Property Vulnerability.\


Unspecified vulnerability in JustSystems Ichitaro 2006 through 2013; Ichitaro Pro through 2; Ichitaro Government 6 7 and 2006 through 2010; Ichitaro Portable with oreplug; Ichitaro Viewer; and Ichitaro JUST School through 2010 allows remote attackers to execute arbitrary code via a crafted document.


A File Inclusion vulnerability exists in Zabbix 2.0.6 due to inadequate sanitization of request strings in CGI scripts which could let a remote malicious user execute arbitrary code.


A Code Execution Vulnerability exists in UMPlayer 0.98 in wintab32.dll due to insufficient path restrictions when loading external libraries. which could let a malicious user execute arbitrary code.


Nitro Pro 7.5.0.29 and earlier and Nitro Reader 2.5.0.45 and earlier allow remote attackers to execute arbitrary code via a crafted PDF file.


VMware vCenter Chargeback Manager (aka CBM) before 2.5.1 does not proper handle uploads which allows remote attackers to execute arbitrary code via unspecified vectors.


Unspecified vulnerability in Autodesk AutoCAD through 2014 AutoCAD LT through 2014 and DWG TrueView through 2014 allows remote attackers to execute arbitrary code via a crafted DWG file.


Microsoft

.NET

Framework

and

Silverlight

before

in

the

kernel-mode

drivers

and

GDI+

DirectWrite

and

Journal

in

Windows

XP

and

Windows

Server

Windows

Vista

Windows

Server

and

Windows

Windows

Windows

Server

and

Windows

RT;

GDI+

in

Office

and

GDI+

in

Visual

Studio

.NET

and

GDI+

in

Lync

Attendee

and

Basic

allow

remote

attackers

to

execute

arbitrary

code

via

a

crafted

TrueType

Font

(TTF)

file

aka

\TrueType

Font

Parsing

Vulnerability.\


Lexmark Markvision Enterprise before 1.8 provides a diagnostic interface on TCP port 9789 which allows remote attackers to execute arbitrary code change the configuration or obtain sensitive fleet-management information via unspecified vectors.


Microsoft .NET Framework 2.0 SP2 3.5 3.5.1 4 and 4.5 and Silverlight 5 before 5.1.20513.0 does not properly prevent changes to data in multidimensional arrays of structures which allows remote attackers to execute arbitrary code via (1) a crafted .NET Framework application or (2) a crafted Silverlight application aka \Array Access Violation Vulnerability.\


EMC Avamar Server and Avamar Virtual Edition before 7.0 on Data Store Gen3 Gen4 and Gen4s platforms do not properly determine authorization for calls to Java RMI methods which allows remote authenticated users to execute arbitrary code via unspecified vectors.


A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.


Certain

Korenix

JetWave

devices

allow

authenticated

users

to

execute

arbitrary

code

as

root

via

/syscmd.asp.

This

affects

before

before

before

before

before

and

through


XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. No user is affected who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default since it cannot be secured for general purpose.


The management tool in MyLittleBackup up to and including 1.7 allows remote attackers to execute arbitrary code because machineKey is hardcoded (the same for all customers' installations) in web.config and can be used to send serialized ASP code.


XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. A user is only affected if using the version out of the box with JDK 1.7u21 or below. However this scenario can be adjusted easily to an external Xalan that works regardless of the version of the Java runtime. No user is affected who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default since it cannot be secured for general purpose.


XStream is a simple library to serialize objects to XML and back again. In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream if using the version out of the box with Java runtime version 14 to 8 or with JavaFX installed. No user is affected who followed the recommendation to setup XStream's security framework with a whitelist limited to the minimal required types. XStream 1.4.18 uses no longer a blacklist by default since it cannot be secured for general purpose.


Acrobat Reader DC versions 2021.005.20060 (and earlier) 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by a Type Confusion vulnerability. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.


23andMe Yamale before 3.0.8 allows remote attackers to execute arbitrary code via a crafted schema file. The schema parser uses eval as part of its processing and tries to protect from malicious expressions by limiting the builtins that are passed to the eval. When processing the schema each line is run through Python's eval function to make the validator available. A well-constructed string within the schema rules can execute system commands; thus by exploiting the vulnerability an attacker can run arbitrary code on the image that invokes Yamale.


OCI OpenDDS versions prior to 3.18.1 do not handle a length parameter consistent with the actual length of the associated data which may allow an attacker to remotely execute arbitrary code.


S-Cart v6.4.1 and below was discovered to contain an arbitrary file upload vulnerability in the Editor module on the Admin panel. This vulnerability allows attackers to execute arbitrary code via a crafted IMG file.


An issue was discovered in the better-macro crate through 2021-07-22 for Rust. It intentionally demonstrates that remote attackers can execute arbitrary code via proc-macros and otherwise has no legitimate purpose.


FATEK Automation WinProladder versions 3.30 and prior lacks proper validation of user-supplied data when parsing project files which could result in an out-of-bounds write. An attacker could leverage this vulnerability to execute arbitrary code.


A Blind SQL injection vulnerability exists in the /DataHandler/HandlerAlarmGroup.ashx endpoint of Delta Electronics DIAEnergie Version 1.7.5 and prior. The application does not properly validate the user-controlled value supplied through the parameter agid before using it as part of an SQL query. A remote unauthenticated attacker can exploit this issue to execute arbitrary code in the context of NT SERVICE\\MSSQLSERVER.


FATEK Automation WinProladder versions 3.30 and prior lacks proper validation of user-supplied data when parsing project files which could result in a memory-corruption condition. An attacker could leverage this vulnerability to execute arbitrary code in the context of the current process.


A Blind SQL injection vulnerability exists in the /DataHandler/AM/AM_Handler.ashx endpoint of Delta Electronics DIAEnergie Version 1.7.5 and prior. The application does not properly validate the user-controlled value supplied through the parameter type before using it as part of an SQL query. A remote unauthenticated attacker can exploit this issue to execute arbitrary code in the context of NT SERVICE\\MSSQLSERVER.


FATEK Automation WinProladder versions 3.30 and prior lacks proper validation of user-supplied data when parsing project files which could result in an unexpected sign extension. An attacker could leverage this vulnerability to execute arbitrary code.


A Blind SQL injection vulnerability exists in the /DataHandler/HandlerEnergyType.ashx endpoint of Delta Electronics DIAEnergie Version 1.7.5 and prior. The application does not properly validate the user-controlled value supplied through the parameter egyid before using it as part of an SQL query. A remote unauthenticated attacker can exploit this issue to execute arbitrary code in the context of NT SERVICE\\MSSQLSERVER.


The unofficial Swift Development Environment extension before 2.12.1 for Visual Studio Code allows remote attackers to execute arbitrary code by constructing a malicious workspace with a crafted sourcekit-lsp.serverPath swift.languageServerPath swift.path.sourcekite swift.path.sourcekiteDockerMode swift.path.swift_driver_bin or swift.path.shell configuration value that triggers execution upon opening the workspace.


The unofficial SwiftFormat extension before 1.3.7 for Visual Studio Code allows remote attackers to execute arbitrary code by constructing a malicious workspace with a crafted swiftformat.path configuration value that triggers execution upon opening the workspace.


The unofficial apple/swift-format extension before 1.1.2 for Visual Studio Code allows remote attackers to execute arbitrary code by constructing a malicious workspace with a crafted apple-swift-format.path configuration value that triggers execution upon opening the workspace.


VSCodeVim before 1.19.0 allows attackers to execute arbitrary code via a crafted workspace configuration.


The unofficial MATLAB extension before 2.0.1 for Visual Studio Code allows attackers to execute arbitrary code via a crafted workspace because of lint configuration settings.


The unofficial SwiftLint extension before 1.4.5 for Visual Studio Code allows remote attackers to execute arbitrary code by constructing a malicious workspace with a crafted swiftlint.path configuration value that triggers execution upon opening the workspace.


IBM Spectrum Scale 5.0.0 through 5.0.5.6 and 5.1.0 through 5.1.0.3 system core component is affected by a format string security vulnerability. An attacker could execute arbitrary code in the context of process memory potentially escalating their system privileges and taking control over the entire system with root access. IBM X-Force ID: 201474.


In FreeBSD 13.0-STABLE before n246938-0729ba2f49c9 12.2-STABLE before r370383 11.4-STABLE before r370381 13.0-RELEASE before p4 12.2-RELEASE before p10 and 11.4-RELEASE before p13 the ggatec daemon does not validate the size of a response before writing it to a fixed-sized buffer allowing a malicious attacker in a privileged network position to overwrite the stack of ggatec and potentially execute arbitrary code.


A local privilege escalation vulnerability was discovered in Erlang/OTP prior to version 23.2.3. By adding files to an existing installation's directory a local attacker could hijack accounts of other users running Erlang programs or possibly coerce a service running with \erlsrv.exe\ to execute arbitrary code as Local System. This can occur only under specific conditions on Windows with unsafe filesystem permissions.


BPF JIT compilers in the Linux kernel through 5.11.12 have incorrect computation of branch displacements allowing them to execute arbitrary code within the kernel context. This affects arch/x86/net/bpf_jit_comp.c and arch/x86/net/bpf_jit_comp32.c.


Unrestricted upload of file with dangerous type vulnerability in file management component in Synology Photo Station before 6.8.14-3500 allows remote authenticated users to execute arbitrary code via unspecified vectors.


IBM Partner Engagement Manager 2.0 could allow a remote attacker to execute arbitrary code on the system caused by an unsafe deserialization flaw. By sending specially-crafted data an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 203091.


Genexis

PLATINUM

devices

allow

remote

attackers

to

execute

arbitrary

code

via

shell

metacharacters

to

as

demonstrated

by

the

sys_config_valid.xgi?exeshell=%60telnetd%20%26%60

URI.


Pear Admin Think through 2.1.2 has an arbitrary file upload vulnerability that allows attackers to execute arbitrary code remotely. A .php file can be uploaded via admin.php/index/upload because app/common/service/UploadService.php mishandles fileExt.


Hitachi JP1/IT Desktop Management 2 Agent 9 through 12 calls the SendMessageTimeoutW API with arbitrary arguments via a local pipe leading to a local privilege escalation vulnerability. An attacker who exploits this issue could execute arbitrary code on the local system.


The unofficial Svelte extension before 104.8.0 for Visual Studio Code allows attackers to execute arbitrary code via a crafted workspace configuration.


Directus 8 before 8.8.2 allows remote authenticated users to execute arbitrary code because file-upload permissions include the ability to upload a .php file to the main upload directory and/or upload a .php file and a .htaccess file to a subdirectory. Exploitation succeeds only for certain installations with the Apache HTTP Server and the local-storage driver (e.g. when the product was obtained from hub.docker.com).


IBM OpenPages with Watson 8.1 and 8.2 could allow an authenticated user to upload a file that could execute arbitrary code on the system. IBM X-Force ID: 207633.


Bitcoin Core before 0.19.0 might allow remote attackers to execute arbitrary code when another application unsafely passes the -platformpluginpath argument to the bitcoin-qt program as demonstrated by an x-scheme-handler/bitcoin handler for a .desktop file or a web browser. NOTE: the discoverer states \I believe that this vulnerability cannot actually be exploited.\


E-Learning System 1.0 suffers from an unauthenticated SQL injection vulnerability which allows remote attackers to execute arbitrary code on the hosting web server and gain a reverse shell.


Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in the UpdateServer component of Bitdefender GravityZone allows an attacker to execute arbitrary code on vulnerable instances. This issue affects: Bitdefender GravityZone versions prior to 3.3.8.249.


Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in the UpdateServer component of Bitdefender GravityZone allows an attacker to execute arbitrary code on vulnerable instances. This issue affects Bitdefender GravityZone versions prior to 3.3.8.272


Ignition before 2.5.2 as used in Laravel and other products allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel before 8.4.2.


A potential vulnerability in the SMI callback function that saves and restore boot script tables used for resuming from sleep state in some ThinkCentre and ThinkStation models may allow an attacker with local access and elevated privileges to execute arbitrary code.


A vulnerability in one of the diagnostic test CLI commands of Cisco IOS XE Software could allow an authenticated local attacker to execute arbitrary code on an affected device. To exploit this vulnerability the attacker would need to have valid user credentials at privilege level 15. This vulnerability exists because the affected software permits modification of the run-time memory of an affected device under specific circumstances. An attacker could exploit this vulnerability by authenticating to the affected device and issuing a specific diagnostic test command at the CLI. A successful exploit could trigger a logic error in the code that was designed to restrict run-time memory modifications. The attacker could take advantage of this logic error to overwrite system memory locations and execute arbitrary code on the underlying Linux operating system (OS) of the affected device.


A vulnerability in Cisco Webex Network Recording Player for Windows and MacOS and Cisco Webex Player for Windows and MacOS could allow an attacker to execute arbitrary code on an affected system. The vulnerability is due to insufficient validation of values within Webex recording files formatted as either Advanced Recording Format (ARF) or Webex Recording Format (WRF). An attacker could exploit the vulnerability by sending a user a malicious ARF or WRF file through a link or email attachment and persuading the user to open the file. A successful exploit could allow the attacker to execute arbitrary code on the affected system with the privileges of the targeted user.


Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV160 RV160W RV260 RV260P and RV260W VPN Routers could allow an unauthenticated remote attacker to execute arbitrary code as the root user on an affected device. These vulnerabilities exist because HTTP requests are not properly validated. An attacker could exploit these vulnerabilities by sending a crafted HTTP request to the web-based management interface of an affected device. A successful exploit could allow the attacker to remotely execute arbitrary code on the device.


Multiple vulnerabilities in the install uninstall and upgrade processes of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated local attacker to hijack DLL or executable files that are used by the application. A successful exploit could allow the attacker to execute arbitrary code on an affected device with SYSTEM privileges. To exploit these vulnerabilities the attacker must have valid credentials on the Windows system. For more information about these vulnerabilities see the Details section of this advisory.


Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated remote attacker to execute arbitrary code or gain access to sensitive information or allow an authenticated local attacker to gain escalated privileges or gain unauthorized access to the application. For more information about these vulnerabilities see the Details section of this advisory.


Multiple vulnerabilities in the web-based management interface of Cisco RV340 RV340W RV345 and RV345P Dual WAN Gigabit VPN Routers could allow an authenticated remote attacker to execute arbitrary code with elevated privileges equivalent to the web service process on an affected device. These vulnerabilities exist because HTTP requests are not properly validated. An attacker could exploit these vulnerabilities by sending a crafted HTTP request to the web-based management interface of an affected device. A successful exploit could allow the attacker to remotely execute arbitrary code on the device.


A malicious application may be able to execute arbitrary code with kernel privileges. This issue is fixed in macOS Big Sur 11.3 Security Update 2021-002 Catalina. An out-of-bounds write issue was addressed with improved bounds checking.


A vulnerability in the boot logic of Cisco IOS XE Software could allow an authenticated local attacker with level 15 privileges or an unauthenticated attacker with physical access to execute arbitrary code on the underlying Linux operating system of an affected device. This vulnerability is due to incorrect validations of specific function arguments that are passed to the boot script. An attacker could exploit this vulnerability by tampering with a specific file which an affected device would process during the initial boot process. On systems that are protected by the Unified Extensible Firmware Interface (UEFI) secure boot feature a successful exploit could allow the attacker to execute unsigned code at boot time and bypass the image verification check in the secure boot process of the affected device.


A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated remote attacker to execute arbitrary code with root privileges on the underlying operating system of an affected device. The vulnerability exists because the affected software improperly sanitizes values that are parsed from a specific configuration file. An attacker could exploit this vulnerability by tampering with a specific configuration file and then sending an API call. A successful exploit could allow the attacker to inject arbitrary code that would be executed on the underlying operating system of the affected device. To exploit this vulnerability the attacker would need to have a privileged set of credentials to the device.


Multiple vulnerabilities in the fast reload feature of Cisco IOS XE Software running on Cisco Catalyst 3850 Cisco Catalyst 9300 and Cisco Catalyst 9300L Series Switches could allow an authenticated local attacker to either execute arbitrary code on the underlying operating system install and boot a malicious software image or execute unsigned binaries on an affected device. These vulnerabilities are due to improper checks performed by system boot routines. To exploit these vulnerabilities the attacker would need privileged access to the CLI of the device. A successful exploit could allow the attacker to either execute arbitrary code on the underlying operating system or execute unsigned code and bypass the image verification check part of the secure boot process. For more information about these vulnerabilities see the Details section of this advisory.


A logic error in kext loading was addressed with improved state handling. This issue is fixed in macOS Big Sur 11.2 Security Update 2021-001 Catalina Security Update 2021-001 Mojave. An application may be able to execute arbitrary code with system privileges.


Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated remote attacker to execute arbitrary code or allow an authenticated local attacker to gain escalated privileges on an affected system. For more information about these vulnerabilities see the Details section of this advisory.


A vulnerability in Cisco Webex Player for Windows and MacOS could allow an attacker to execute arbitrary code on an affected system. This vulnerability is due to insufficient validation of values in Webex recording files that are in Webex Recording Format (WRF). An attacker could exploit this vulnerability by sending a user a malicious WRF file through a link or email attachment and persuading the user to open the file with the affected software on the local system. A successful exploit could allow the attacker to execute arbitrary code on the affected system with the privileges of the targeted user.


A vulnerability in Cisco Webex Network Recording Player for Windows and MacOS and Cisco Webex Player for Windows and MacOS could allow an attacker to execute arbitrary code on an affected system. This vulnerability is due to insufficient validation of values in Webex recording files that are in either Advanced Recording Format (ARF) or Webex Recording Format (WRF). An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file through a link or email attachment and persuading the user to open the file with the affected software on the local system. A successful exploit could allow the attacker to execute arbitrary code on the affected system with the privileges of the targeted user.


A vulnerability in Cisco Webex Meetings Desktop App for Windows Cisco Webex Meetings Server Cisco Webex Network Recording Player for Windows and Cisco Webex Teams for Windows could allow an authenticated local attacker to perform a DLL injection attack on an affected device. To exploit this vulnerability the attacker must have valid credentials on the Windows system. This vulnerability is due to incorrect handling of directory paths at run time. An attacker could exploit this vulnerability by inserting a configuration file in a specific path in the system which can cause a malicious DLL file to be loaded when the application starts. A successful exploit could allow the attacker to execute arbitrary code on the affected system with the privileges of another user account.


A vulnerability in the configuration dashboard of Cisco Common Services Platform Collector (CSPC) could allow an authenticated remote attacker to execute arbitrary code. This vulnerability is due to insufficient sanitization of configuration entries. An attacker could exploit this vulnerability by logging in as a super admin and entering crafted input to configuration options on the CSPC configuration dashboard. A successful exploit could allow the attacker to execute remote code as root.


A vulnerability in the Network Access Manager and Web Security Agent components of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated local attacker to perform a DLL injection attack. To exploit this vulnerability the attacker would need to have valid credentials on the Windows system. The vulnerability is due to insufficient validation of resources that are loaded by the application at run time. An attacker could exploit this vulnerability by inserting a configuration file in a specific path in the system which in turn causes a malicious DLL file to be loaded when the application starts. A successful exploit could allow the attacker to execute arbitrary code on the affected machine with SYSTEM privileges.


A vulnerability in the SOAP API endpoint of Cisco Unified Communications Manager Cisco Unified Communications Manager Session Management Edition Cisco Unified Communications Manager IM & Presence Service Cisco Unity Connection and Cisco Prime License Manager could allow an authenticated remote attacker to execute arbitrary code on an affected device. This vulnerability is due to improper sanitization of user-supplied input. An attacker could exploit this vulnerability by sending a SOAP API request with crafted parameters to an affected device. A successful exploit could allow the attacker to execute arbitrary code with root privileges on the underlying Linux operating system of the affected device.


An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Big Sur 11.3 Security Update 2021-002 Catalina Security Update 2021-003 Mojave. A malicious application may be able to execute arbitrary code with kernel privileges.


An out-of-bounds write was addressed with improved input validation. This issue is fixed in macOS Big Sur 11.2.1 macOS Catalina 10.15.7 Supplemental Update macOS Mojave 10.14.6 Security Update 2021-002. An application may be able to execute arbitrary code with kernel privileges.


Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV160 RV160W RV260 RV260P and RV260W VPN Routers could allow an unauthenticated remote attacker to execute arbitrary code as the root user on an affected device. These vulnerabilities exist because HTTP requests are not properly validated. An attacker could exploit these vulnerabilities by sending a crafted HTTP request to the web-based management interface of an affected device. A successful exploit could allow the attacker to remotely execute arbitrary code on the device.


A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated local attacker to perform a DLL hijacking attack on an affected device if the VPN Posture (HostScan) Module is installed on the AnyConnect client. This vulnerability is due to insufficient validation of resources that are loaded by the application at run time. An attacker could exploit this vulnerability by sending a crafted IPC message to the AnyConnect process. A successful exploit could allow the attacker to execute arbitrary code on the affected machine with SYSTEM privileges. To exploit this vulnerability the attacker needs valid credentials on the Windows system.


Multiple vulnerabilities in Cisco SD-WAN vManage Software could allow an unauthenticated remote attacker to execute arbitrary code or gain access to sensitive information or allow an authenticated local attacker to gain escalated privileges or gain unauthorized access to the application. For more information about these vulnerabilities see the Details section of this advisory.


A vulnerability in the REST API of Cisco Firepower Device Manager (FDM) On-Box Software could allow an authenticated remote attacker to execute arbitrary code on the underlying operating system of an affected device. This vulnerability is due to insufficient sanitization of user input on specific REST API commands. An attacker could exploit this vulnerability by sending a crafted HTTP request to the API subsystem of an affected device. A successful exploit could allow the attacker to execute arbitrary code on the underlying operating system. To exploit this vulnerability an attacker would need valid low-privileged user credentials.


A vulnerability in Cisco Packet Tracer for Windows could allow an authenticated local attacker to perform a DLL injection attack on an affected device. To exploit this vulnerability the attacker must have valid credentials on the Windows system. This vulnerability is due to incorrect handling of directory paths at run time. An attacker could exploit this vulnerability by inserting a configuration file in a specific path on the system which can cause a malicious DLL file to be loaded when the application starts. A successful exploit could allow an attacker with normal user privileges to execute arbitrary code on the affected system with the privileges of another user’s account.


Multiple vulnerabilities in the install uninstall and upgrade processes of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated local attacker to hijack DLL or executable files that are used by the application. A successful exploit could allow the attacker to execute arbitrary code on an affected device with SYSTEM privileges. To exploit these vulnerabilities the attacker must have valid credentials on the Windows system. For more information about these vulnerabilities see the Details section of this advisory.


A vulnerability in the dynamic link library (DLL) loading mechanism in Cisco Advanced Malware Protection (AMP) for Endpoints Windows Connector ClamAV for Windows and Immunet could allow an authenticated local attacker to perform a DLL hijacking attack on an affected Windows system. To exploit this vulnerability the attacker would need valid credentials on the system. The vulnerability is due to insufficient validation of directory search paths at run time. An attacker could exploit this vulnerability by placing a malicious DLL file on an affected system. A successful exploit could allow the attacker to execute arbitrary code with SYSTEM privileges.


A vulnerability in the loading process of specific DLLs in Cisco Proximity Desktop for Windows could allow an authenticated local attacker to load a malicious library. To exploit this vulnerability the attacker must have valid credentials on the Windows system. This vulnerability is due to incorrect handling of directory paths at run time. An attacker could exploit this vulnerability by placing a malicious DLL file in a specific location on the targeted system. This file will execute when the vulnerable application launches. A successful exploit could allow the attacker to execute arbitrary code on the targeted system with the privileges of another user’s account.


A vulnerability in the loading mechanism of specific DLLs of Cisco Advanced Malware Protection (AMP) for Endpoints for Windows and Immunet for Windows could allow an authenticated local attacker to perform a DLL hijacking attack. To exploit this vulnerability the attacker would need valid credentials on the Windows system. This vulnerability is due to incorrect handling of directory search paths at run time. An attacker could exploit this vulnerability by placing a malicious DLL file on the targeted system. This file will execute when the vulnerable application launches. A successful exploit could allow the attacker to execute arbitrary code on the targeted system with SYSTEM privileges.


The Junos Space Network Management Platform has been found to store shared secrets in a recoverable format that can be exposed through the UI. An attacker who is able to execute arbitrary code in the victim browser (for example via XSS) or access cached contents may be able to obtain a copy of credentials managed by Junos Space. The impact of a successful attack includes but is not limited to obtaining access to other servers connected to the Junos Space Management Platform. This issue affects Juniper Networks Junos Space versions prior to 20.3R1.


This affects the package juce-framework/JUCE before 6.1.5. This vulnerability is triggered when a malicious archive is crafted with an entry containing a symbolic link. When extracted the symbolic link is followed outside of the target dir allowing writing arbitrary files on the target host. In some cases this can allow an attacker to execute arbitrary code. The vulnerable code is in the ZipFile::uncompressEntry function in juce_ZipFile.cpp and is executed when the archive is extracted upon calling uncompressTo() on a ZipFile object.


Unquoted service path vulnerability in the Gallagher Controller Service allows an unprivileged user to execute arbitrary code as the account that runs the Controller Service. This issue affects: Gallagher Command Centre 8.50 versions prior to 8.50.2048 (MR3) ;


Unquoted service path vulnerability in McAfee Endpoint Product Removal (EPR) Tool prior to 21.2 allows local administrators to execute arbitrary code with higher-level privileges via execution from a compromised folder. The tool did not enforce and protect the execution path. Local admin privileges are required to place the files in the required location.


Arbitrary Process Execution vulnerability in McAfee Total Protection (MTP) prior to 16.0.30 allows a local user to gain elevated privileges and execute arbitrary code bypassing MTP self-defense.


An arbitrary code execution vulnerability was found in the F-Secure Support Tool. A standard user can craft a special configuration file which when run by administrator can execute any commands.


Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2 2.12.3 and 2.3.1) JNDI features used in configuration log messages and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0 this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2 2.12.3 and 2.3.1) this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net log4cxx or other Apache Logging Services projects.


Wondershare Dr. Fone Latest version as of 2021-12-06 is vulnerable to Incorrect Access Control. A normal user can send manually crafted packets to the ElevationService.exe and execute arbitrary code without any validation with SYSTEM privileges.


When running Apache Cassandra with the following configuration: enable_user_defined_functions: true enable_scripted_user_defined_functions: true enable_user_defined_functions_threads: false it is possible for an attacker to execute arbitrary code on the host. The attacker would need to have enough permissions to create user defined functions in the cluster to be able to exploit this. Note that this configuration is documented as unsafe and will continue to be considered unsafe after this CVE.


The Samba vfs_fruit module uses extended file attributes (EA xattr) to provide \...enhanced compatibility with Apple SMB clients and interoperability with a Netatalk 3 AFP fileserver.\ Samba versions prior to 4.13.17 4.14.12 and 4.15.5 with vfs_fruit configured allow out-of-bounds heap read and write via specially crafted extended file attributes. A remote attacker with write access to extended file attributes can execute arbitrary code with the privileges of smbd typically root.


WordPress before 5.8 lacks support for the Update URI plugin header. This makes it easier for remote attackers to execute arbitrary code via a supply-chain attack against WordPress installations that use any plugin for which the slug satisfies the naming constraints of the WordPress.org Plugin Directory but is not yet present in that directory.


An issue was discovered in split_region in uc.c in Unicorn Engine before 2.0.0-rc5. It allows local attackers to escape the sandbox. An attacker must first obtain the ability to execute crafted code in the target sandbox in order to exploit this vulnerability. The specific flaw exists within the virtual memory manager. The issue results from the faulty comparison of GVA and GPA while calling uc_mem_map_ptr to free part of a claimed memory block. An attacker can leverage this vulnerability to escape the sandbox and execute arbitrary code on the host machine.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of SKP files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-14737.


This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DWG files. The issue results from the lack of proper validation of user-supplied data which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-14894.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Annotation objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-14020.


This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley ContextCapture 10.18.0.232. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of OBJ files. The issue results from the lack of proper validation of user-supplied data which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-14785.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JT files. Crafted data in a JT file can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-14905.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Annotation objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-14025.


This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of J2K files. The issue results from the lack of proper validation of user-supplied data which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-14836.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JT files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15054.


Improper privilege management vulnerability in cgi component in Synology Download Station before 3.8.16-3566 allows remote authenticated users to execute arbitrary code via unspecified vectors.


A vulnerability exists in XINJE XD/E Series PLC Program Tool in versions up to v3.5.1 that can allow an authenticated local attacker to load a malicious DLL. Local access is required to successfully exploit this vulnerability. This means the potential attacker must have access to the system and sufficient file-write privileges. If exploited the attacker could place a malicious DLL file on the system that when running XINJE XD/E Series PLC Program Tool will allow the attacker to execute arbitrary code with the privileges of another user's account.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JT files. Crafted data in a JT file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-14901.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Annotation objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-14270.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JT files. Crafted data in a JT file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-14828.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JT files. Crafted data in a JT file can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-14885.


This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of user-supplied data which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-14840.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JT files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15040.


This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1330 1.13B01 BETA routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the HNAP_AUTH HTTP header. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-12065.


This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2020 1.01rc001 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the var:menu parameter provided to the webproc endpoint. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-13270.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of J2K files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-14879.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JT files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-14915.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Annotation objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-14013.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11.22.22. Although authentication is required to exploit this vulnerability the existing authentication mechanism can be bypassed. The specific flaw exists within the DownloadCenterUploadHandler class. The issue results from the lack of proper validation of user-supplied data which can allow the upload of arbitrary files. An attacker can leverage this vulnerability to execute code in the context of NETWORK SERVICE. Was ZDI-CAN-13756.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 10.1.4.37651. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Document objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-13741.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of BMP files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-14846.


Multiple vulnerabilities in image verification checks of Cisco Network Convergence System (NCS) 540 Series Routers only when running Cisco IOS XR NCS540L software images and Cisco IOS XR Software for Cisco 8000 Series Routers could allow an authenticated local attacker to execute arbitrary code on the underlying operating system. For more information about these vulnerabilities see the Details section of this advisory.


This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6260 1.1.0.78_1.0.1 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the setupwizard.cgi page. A crafted SOAP request can trigger an overflow of a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-13511.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JT files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-14911.


This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3 (49160). An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the Toolgate component. The issue results from the lack of proper validation of user-supplied data which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the hypervisor. Was ZDI-CAN-13601.


This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6400v2 1.0.4.106_10.0.80 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the UPnP service which listens on TCP port 5000 by default. When parsing the uuid request header the process does not properly validate the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-14110.


This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel 5.14-rc3. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of eBPF programs. The issue results from the lack of proper validation of user-supplied eBPF programs which can result in a type confusion condition. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the kernel. Was ZDI-CAN-14689.


This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DWG files. The issue results from the lack of proper validation of user-supplied data which can result in a read past the end of an allocated object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-14875.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Annotation objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-14015.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DGN files. Crafted data in a DGN file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-14864.


This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2020 1.01rc001 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the var:page parameter provided to the webproc endpoint. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-13271.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of BMP files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-14880.


This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1330 1.13B01 BETA routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the SOAPAction HTTP header. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-12066.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JT files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-14914.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Annotation objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-13929.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11.22.22. Although authentication is required to exploit this vulnerability the existing authentication mechanism can be bypassed. The specific flaw exists within the DataProvider class. The issue results from the lack of proper validation of a user-supplied string before executing it as JavaScript code. An attacker can leverage this vulnerability to escape the JavaScript sandbox and execute Java code in the context of NETWORK SERVICE. Was ZDI-CAN-13755.


This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1330 1.13B01 BETA routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the Cookie HTTP header. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-12028.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JT files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-14845.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JT files. Crafted data in a JT file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-14910.


This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6260 1.1.0.78_1.0.1 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of SOAP requests. When parsing the SOAPAction header the process does not properly validate the length of user-supplied data prior to copying it to a fixed-length buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-13512.


A vulnerability in the Cisco IOS XE SD-WAN Software CLI could allow an authenticated local attacker to elevate privileges and execute arbitrary code on the underlying operating system as the root user. An attacker must be authenticated on an affected device as a PRIV15 user. This vulnerability is due to insufficient file system protection and the presence of a sensitive file in the bootflash directory on an affected device. An attacker could exploit this vulnerability by overwriting an installer file stored in the bootflash directory with arbitrary commands that can be executed with root-level privileges. A successful exploit could allow the attacker to read and write changes to the configuration database on the affected device.


This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 16.1.3-49160. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the Toolgate component. The issue results from the lack of proper validation of user-supplied data which can result in an uncontrolled memory allocation. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the hypervisor. Was ZDI-CAN-13672.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of BMP files. Crafted data in a BMP file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-14876.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Annotation objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-14014.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of BMP files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-14863.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Annotation objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-14019.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. Crafted data in a PDF file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-14696.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of J2K files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-14895.


This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley ContextCapture 10.18.0.232. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of OBJ files. The issue results from the lack of proper validation of user-supplied data which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-14784.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JT files. Crafted data in a JT file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-14904.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Annotation objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-14024.


This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JP2 files. The issue results from the lack of proper validation of user-supplied data which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-14835.


This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JT files. The issue results from the lack of proper validation of user-supplied data which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-15052.


This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6260 1.1.0.78_1.0.1 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the setupwizard.cgi page. When parsing the SOAP_LOGIN_TOKEN environment variable the process does not properly validate the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-14107.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JT files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-14900.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Annotation objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-14120.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JT files. Crafted data in a JT file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-14829.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JT files. Crafted data in a JT file can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-14831.


This vulnerability allows local attackers to escalate privileges on affected installations of Panda Security Free Antivirus 20.2.0.0. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the use of named pipes. The issue results from allowing an untrusted process to impersonate the client of a pipe. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-14208.


This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of FBX files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-14839.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JT files. Crafted data in a JT file can trigger a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15039.


This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-2020 1.01rc001 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the webproc endpoint which listens on TCP port 80 by default. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-12104.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of DGN files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-14878.


This vulnerability allows remote attackers to disclose sensitive information on affected installations of Bentley View 10.15.0.75. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JT files. The issue results from the lack of proper validation of user-supplied data which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the current process. Was ZDI-CAN-14841.