When

using

Apache

Tomcat

versions

to

to

to

and

to

if

a)

an

attacker

is

able

to

control

the

contents

and

name

of

a

file

on

the

server;

and

b)

the

server

is

configured

to

use

the

PersistenceManager

with

a

FileStore;

and

c)

the

PersistenceManager

is

configured

with

sessionAttributeValueClassNameFilter=\null\

(the

default

unless

a

SecurityManager

is

used)

or

a

sufficiently

lax

filter

to

allow

the

attacker

provided

object

to

be

deserialized;

and

d)

the

attacker

knows

the

relative

file

path

from

the

storage

location

used

by

FileStore

to

the

file

the

attacker

has

control

over;

then

using

a

specifically

crafted

request

the

attacker

will

be

able

to

trigger

remote

code

execution

via

deserialization

of

the

file

under

their

control.

Note

that

all

of

conditions

a)

to

d)

must

be

true

for

the

attack

to

succeed.


The

Appointment

Booking

Calendar

plugin

before

for

WordPress

allows

user

input

(in

fields

such

as

Description

or

Name)

in

any

booking

form

to

be

any

formula

which

then

could

be

exported

via

the

Bookings

list

tab

in

/wp-admin/admin.php?page=cpabc_appointments.php.

The

attacker

could

achieve

remote

code

execution

via

CSV

injection.


The Popup Builder plugin 2.2.8 through 2.6.7.6 for WordPress is vulnerable to SQL injection (in the sgImportPopups function in sg_popup_ajax.php) via PHP Deserialization on attacker-controlled data with the attachmentUrl POST variable. This allows creation of an arbitrary WordPress Administrator account leading to possible Remote Code Execution because Administrators can run PHP code on Wordpress instances. (This issue has been fixed in the 3.x branch of popup-builder.)


Umbraco Cloud 8.5.3 allows an authenticated file upload (and consequently Remote Code Execution) via the Install Packages functionality.


The S. Siedle & Soehne SG 150-0 Smart Gateway before 1.2.4 allows remote code execution via the backup functionality in the web frontend. By using an exploit chain an attacker with access to the network can get root access on the gateway.


Wuzhi CMS v4.1.0 contains a remote code execution (RCE) vulnerability in \\attachment\\admin\\index.php.


A accessmgrservlet classname deserialization of untrusted data remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).


A legend expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).


An issue was discovered in picoTCP through 1.7.0. The DNS domain name record decompression functionality in pico_dns_decompress_name() in pico_dns_common.c does not validate the compression pointer offset values with respect to the actual data present in a DNS response packet causing out-of-bounds writes that lead to Denial-of-Service and Remote Code Execution.


A syslogtempletselectwin expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).


Insecure File Permissions and Arbitrary File Upload in the upload pic function in updatesubcategory.php in Projects World Travel Management System v1.0 allows remote unauthenticated attackers to gain remote code execution.


Nagios XI 5.7.2 is affected by a remote code execution (RCE) vulnerability. An authenticated user can inject additional commands into normal webapp query.


Tenda

Router

through

and

through

CN

devices

could

cause

a

remote

code

execution

due

to

incorrect

authentication

handling

of

vulnerable

logincheck()

function

in

file

if

the

administrator

UI

Interface

is

set

to

\radius\.


A10 Networks ACOS and aGalaxy management Graphical User Interfaces (GUIs) have an unauthenticated Remote Code Execution (RCE) vulnerability that could be used to compromise affected ACOS systems. ACOS versions 3.2.x (including and after 3.2.2) 4.x and 5.1.x are affected. aGalaxy versions 3.0.x 3.2.x and 5.0.x are affected.


A remote code execution vulnerability is identified in FruityWifi through 2.4. Due to improperly escaped shell metacharacters obtained from the POST request at the page_config_adv.php page it is possible to perform remote code execution by an authenticated attacker. This is similar to CVE-2018-17317.


A remote code execution (RCE) vulnerability was discovered in the htmlformentry (aka HTML Form Entry) module before 3.11.0 for OpenMRS. By leveraging path traversal a malicious Velocity Template Language file could be written to a directory. This file could then be accessed and executed.


A addvsiinterfaceinfo expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).


An issue was discovered in the DNS implementation in Ethernut in Nut/OS 5.1. The number of DNS queries/responses (set in a DNS header) is not checked against the data present. This may lead to successful Denial-of-Service and possibly Remote Code Execution.


JetBrains ToolBox before version 1.18 is vulnerable to Remote Code Execution via a browser protocol handler.


An issue was discovered in the IPv6 stack in Contiki through 3.0. There is an insufficient check for the IPv6 header length. This leads to Denial-of-Service and potential Remote Code Execution via a crafted ICMPv6 echo packet.


Seat Reservation System version 1.0 suffers from an Unauthenticated File Upload Vulnerability allowing Remote Attackers to gain Remote Code Execution (RCE) on the Hosting Webserver via uploading PHP files.


Remote Code Execution can occur via the external news feed in ILIAS 6.4 because of incorrect parameter sanitization for Magpie RSS data.


An issue was discovered in the DNS implementation in Ethernut in Nut/OS 5.1. The DNS response data length is not checked (it can be set to an arbitrary value from a packet). This may lead to successful Denial-of-Service and possibly Remote Code Execution.


An issue was discovered in the DNS implementation in Ethernut in Nut/OS 5.1. The length byte of a domain name in a DNS query/response is not checked and is used for internal memory operations. This may lead to successful Denial-of-Service and possibly Remote Code Execution.


An issue was discovered in the IPv6 stack in Contiki through 3.0. There are inconsistent checks for IPv6 header extension lengths. This leads to Denial-of-Service and potential Remote Code Execution via a crafted ICMPv6 echo packet.


An issue was discovered in the DNS implementation in Ethernut in Nut/OS 5.1. There is no check on whether a domain name has '\\0' termination. This may lead to successful Denial-of-Service and possibly Remote Code Execution.


An Arbitrary File Upload in the Upload Image component in SourceCodester Car Rental Management System 1.0 allows the user to conduct remote code execution via admin/index.php?page=manage_car because .php files can be uploaded to admin/assets/uploads/ (under the web root).


Garmin Forerunner 235 before 8.20 is affected by: Array index error. The component is: ConnectIQ TVM. The attack vector is: To exploit the vulnerability the attacker must upload a malicious ConnectIQ application to the ConnectIQ store. The ConnectIQ program interpreter trusts the offset provided for the stack value duplication instruction DUP. The offset is unchecked and memory prior to the start of the execution stack can be read and treated as a TVM object. A successful exploit could use the vulnerability to leak runtime information such as the heap handle or pointer for a number of TVM context variables. Some reachable values may be controlled enough to forge a TVM object on the stack leading to possible remote code execution.


Git LFS 2.12.0 allows Remote Code Execution.


Veritas APTARE versions prior to 10.5 did not perform adequate authorization checks. This vulnerability could allow for remote code execution by an unauthenticated user.


Marital - Online Matrimonial Project In PHP version 1.0 suffers from an authenticated file upload vulnerability allowing remote attackers to gain remote code execution (RCE) on the Hosting web server via uploading a maliciously crafted PHP file.


Mutation XSS exists in Mark Text through 0.16.2 that leads to Remote Code Execution. NOTE: this might be considered a duplicate of CVE-2020-26870; however it can also be considered an issue in the design of the \source code mode\ feature which parses HTML even though HTML support is not one of the primary advertised roles of the product.


cPanel before 88.0.3 mishandles the Exim filter path leading to remote code execution (SEC-485).


An issue was discovered in Foxit Reader and PhantomPDF before 10.1. When there is a multiple interpretation error for /V (in the Additional Action and Field dictionaries) a use-after-free can occur with resultant remote code execution (or an information leak).


XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XStream's Security Framework allowlist is not affected. The linked advisory provides code workarounds for users who cannot upgrade. The issue is fixed in version 1.4.14.


Airleader Master <= 6.21 devices have default credentials that can be used to access the exposed Tomcat Manager for deployment of a new .war file with resultant remote code execution.


Dependabot is a set of packages for automated dependency management for Ruby JavaScript Python PHP Elixir Rust Java .NET Elm and Go. In Dependabot-Core from version 0.119.0.beta1 before version 0.125.1 there is a remote code execution vulnerability in dependabot-common and dependabot-go_modules when a source branch name contains malicious injectable bash code. For example if Dependabot is configured to use the following source branch name: \/$({curl 127.0.0.1})\ Dependabot will make a HTTP request to the following URL: 127.0.0.1 when cloning the source repository. The fix was applied to version 0.125.1. As a workaround one can escape the branch name prior to passing it to the Dependabot::Source class.


OpenMage is a community-driven alternative to Magento CE. In OpenMage before versions 19.4.10 and 20.0.5 there is a vulnerability which enables remote code execution. In affected versions an administrator with permission to import/export data and to create widget instances was able to inject an executable file on the server. The latest OpenMage Versions up from 19.4.9 and 20.0.5 have this Issue solved


Leanote Desktop through 2.6.2 allows XSS because a note's title is mishandled during syncing. This leads to remote code execution because of Node integration.


An issue was discovered in Hoosk CmS v1.8.0. There is an Remote Code Execution vulnerability in install/index.php


Leanote Desktop through 2.6.2 allows XSS because a note's title is mishandled when the batch feature is triggered. This leads to remote code execution because of Node integration.


Inspur NF5266M5 through 3.21.2 and other server M5 devices allow remote code execution via administrator privileges. The Baseboard Management Controller (BMC) program of INSPUR server is weak in checking the firmware and lacks the signature verification mechanism the attacker who obtains the administrator's rights can control the BMC by inserting malicious code into the firmware program and bypassing the current verification mechanism to upgrade the BMC.


OpenMage is a community-driven alternative to Magento CE. In OpenMage before versions 19.4.10 and 20.0.6 there is a vulnerability which enables remote code execution. In affected versions an administrator with permission to update product data to be able to store an executable file on the server and load it via layout xml. The latest OpenMage Versions up from 19.4.10 and 20.0.6 have this issue solved.


Cron-utils is a Java library to parse validate migrate crons as well as get human readable descriptions for them. In cron-utils before version 9.1.3 a template Injection vulnerability is present. This enables attackers to inject arbitrary Java EL expressions leading to unauthenticated Remote Code Execution (RCE) vulnerability. Only projects using the @Cron annotation to validate untrusted Cron expressions are affected. This issue was patched in version 9.1.3.


BrowserUp Proxy allows you to manipulate HTTP requests and responses capture HTTP content and export performance data as a HAR file. BrowserUp Proxy works well as a standalone proxy server but it is especially useful when embedded in Selenium tests. A Server-Side Template Injection was identified in BrowserUp Proxy enabling attackers to inject arbitrary Java EL expressions leading to unauthenticated Remote Code Execution (RCE) vulnerability. This has been patched in version 2.1.2.


An exploitable out-of-bounds write vulnerability exists in the store_data_buffer function of the igcore19d.dll library of Accusoft ImageGear 19.5.0. A specially crafted PNG file can cause an out-of-bounds write resulting in a remote code execution. An attacker needs to provide a malformed file to the victim to trigger the vulnerability.


An exploitable out-of-bounds write vulnerability exists in the igcore19d.dll JPEG jpegread precision parser of the Accusoft ImageGear 19.5.0 library. A specially crafted JPEG file can cause an out-of-bounds write resulting in a remote code execution. An attacker needs to provide a malformed file to the victim to trigger the vulnerability.


An exploitable code execution vulnerability exists in the TIFF fillinraster function of the igcore19d.dll library of Accusoft ImageGear 19.4 19.5 and 19.6. A specially crafted TIFF file can cause an out-of-bounds write resulting in remote code execution. An attacker can provide a malicious file to trigger this vulnerability.


The Eaton's easySoft software v7.xx prior to v7.22 are susceptible to Out-of-bounds remote code execution vulnerability. A malicious entity can execute a malicious code or make the application crash by tricking user to upload the malformed .E70 file in the application. The vulnerability arises due to improper validation and parsing of the E70 file content by the application.


An exploitable out-of-bounds write vulnerability exists in the bmp_parsing function of the igcore19d.dll library of Accusoft ImageGear version 19.5.0. A specially crafted BMP file can cause an out-of-bounds write resulting in a remote code execution. An attacker needs to provide a malformed file to the victim to trigger the vulnerability.


An exploitable code execution vulnerability exists in the Web-Based Management (WBM) functionality of WAGO PFC 200 03.03.10(15). A specially crafted series of HTTP requests can cause code execution resulting in remote code execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.


The following versions of MAXPRO VMS and NVR MAXPRO VMS:HNMSWVMS prior to Version VMS560 Build 595 T2-Patch HNMSWVMSLT prior to Version VMS560 Build 595 T2-Patch MAXPRO NVR: MAXPRO NVR XE prior to Version NVR 5.6 Build 595 T2-Patch MAXPRO NVR SE prior to Version NVR 5.6 Build 595 T2-Patch MAXPRO NVR PE prior to Version NVR 5.6 Build 595 T2-Patch and MPNVRSWXX prior to Version NVR 5.6 Build 595 T2-Patch are vulnerable to an unsafe deserialization of untrusted data. An attacker may be able to remotely modify deserialized data without authentication using a specially crafted web request resulting in remote code execution.


An exploitable out-of-bounds write vulnerability exists in the uncompress_scan_line function of the igcore19d.dll library of Accusoft ImageGear version 19.5.0. A specially crafted PCX file can cause an out-of-bounds write resulting in a remote code execution. An attacker needs to provide a malformed file to the victim to trigger the vulnerability.


A remote code execution vulnerability exists in the install functionality of OS4Ed openSIS 7.4. The password variable which is set at line 122 in install/Step5.php allows for injection of PHP code into the Data.php file that it writes. An attacker can send an HTTP request to trigger this vulnerability.


An exploitable code execution vulnerability exists in the PDF parser of Nitro Pro 13.9.1.155. A specially crafted PDF document can cause a use-after-free which can lead to remote code execution. An attacker can provide a malicious file to trigger this vulnerability.


An exploitable out-of-bounds write vulnerability exists in the igcore19d.dll PNG pngread parser of the Accusoft ImageGear 19.5.0 library. A specially crafted PNG file can cause an out-of-bounds write resulting in a remote code execution. An attacker needs to provide a malformed file to the victim to trigger the vulnerability.


An exploitable code execution vulnerability exists in the PLC_Task functionality of 3S-Smart Software Solutions GmbH CODESYS Runtime 3.5.14.30. A specially crafted network request can cause remote code execution. An attacker can send a malicious packet to trigger this vulnerability.


Eaton's easySoft software v7.xx prior to v7.22 are susceptible to file parsing type confusion remote code execution vulnerability. A malicious entity can execute a malicious code or make the application crash by tricking user upload a malformed .E70 file in the application. The vulnerability arises due to improper validation of user data supplied through E70 file which is causing Type Confusion.


An exploitable out-of-bounds write vulnerability exists in the igcore19d.dll JPEG SOFx parser of the Accusoft ImageGear 19.5.0 library. A specially crafted JPEG file can cause an out-of-bounds write resulting in a remote code execution. An attacker needs to provide a malformed file to the victim to trigger the vulnerability.


In Honeywell WIN-PAK 4.7.2 Web and prior versions the header injection vulnerability has been identified which may allow remote code execution.


A heap overflow vulnerability exists in the Pixar OpenUSD 20.05 while parsing compressed value rep arrays in binary USD files. A specially crafted malformed file can trigger a heap overflow which can result in remote code execution. To trigger this vulnerability the victim needs to access an attacker-provided malformed file.


SAP Business Objects Business Intelligence Platform (Crystal Reports) versions- 4.1 4.2 allows an attacker with basic authorization to inject code that can be executed by the application and thus allowing the attacker to control the behaviour of the application leading to Remote Code Execution. Although the mode of attack is only Local multiple applications can be impacted as a result of the vulnerability.


An exploitable out-of-bounds write vulnerability exists in the igcore19d.dll ICO icoread parser of the Accusoft ImageGear 19.5.0 library. A specially crafted ICO file can cause an out-of-bounds write resulting in a remote code execution. An attacker needs to provide a malformed file to the victim to trigger the vulnerability.


LifterLMS Wordpress plugin version below 3.37.15 is vulnerable to arbitrary file write leading to remote code execution


In ApexPro Telemetry Server Versions 4.2 and prior CARESCAPE Telemetry Server v4.2 & prior Clinical Information Center (CIC) Versions 4.X and 5.X CARESCAPE Central Station (CSCS) Versions 1.X the affected products utilize a weak encryption scheme for remote desktop control which may allow an attacker to obtain remote code execution of devices on the network.


An exploitable out-of-bounds write vulnerability exists in the ico_read function of the igcore19d.dll library of Accusoft ImageGear 19.6.0. A specially crafted ICO file can cause an out-of-bounds write resulting in a remote code execution. An attacker needs to provide a malformed file to the victim to trigger the vulnerability.


A remote code execution vulnerability exists in the install functionality of OS4Ed openSIS 7.4. The username variable which is set at line 121 in install/Step5.php allows for injection of PHP code into the Data.php file that it writes. An attacker can send an HTTP request to trigger this vulnerability.


In ApexPro Telemetry Server Versions 4.2 and prior CARESCAPE Telemetry Server v4.2 & prior Clinical Information Center (CIC) Versions 4.X and 5.X CARESCAPE Telemetry Server Version 4.3 CARESCAPE Central Station (CSCS) Versions 1.X CARESCAPE Central Station (CSCS) Versions 2.X B450 Version 2.X B650 Version 1.X B650 Version 2.X B850 Version 1.X B850 Version 2.X an input validation vulnerability exists in the web-based system configuration utility that could allow an attacker to obtain arbitrary remote code execution.


An exploitable signed comparison vulnerability exists in the ARMv7 memcpy() implementation of GNU glibc 2.30.9000. Calling memcpy() (on ARMv7 targets that utilize the GNU glibc implementation) with a negative value for the 'num' parameter results in a signed comparison vulnerability. If an attacker underflows the 'num' parameter to memcpy() this vulnerability could lead to undefined behavior such as writing to out-of-bounds memory and potentially remote code execution. Furthermore this memcpy() implementation allows for program execution to continue in scenarios where a segmentation fault or crash should have occurred. The dangers occur in that subsequent execution and iterations of this code will be executed with this corrupted data.


An exploitable out-of-bounds write vulnerability exists in the igcore19d.dll TIFF tifread parser of the Accusoft ImageGear 19.5.0 library. A specially crafted TIFF file can cause an out-of-bounds write resulting in a remote code execution. An attacker needs to provide a malformed file to the victim to trigger the vulnerability.


An exploitable out-of-bounds write vulnerability exists in the uncompress_scan_line function of the igcore19d.dll library of Accusoft ImageGear version 19.5.0. A specially crafted PCX file can cause an out-of-bounds write resulting in a remote code execution. An attacker needs to provide a malformed file to the victim to trigger the vulnerability.


AV1 Video Extension Remote Code Execution Vulnerability


Microsoft SharePoint Remote Code Execution Vulnerability


A remote code execution vulnerability exists when the Base3D rendering engine improperly handles memory.An attacker who successfully exploited the vulnerability would gain execution on a victim system.The security update addresses the vulnerability by correcting how the Base3D rendering engine handles memory. aka 'Base3D Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-16918.


Visual Studio Remote Code Execution Vulnerability


HEIF Image Extensions Remote Code Execution Vulnerability


Microsoft Dynamics 365 for Finance and Operations (on-premises) Remote Code Execution Vulnerability This CVE ID is unique from CVE-2020-17158.


Microsoft PowerPoint Remote Code Execution Vulnerability


Microsoft Exchange Remote Code Execution Vulnerability This CVE ID is unique from CVE-2020-17117 CVE-2020-17132 CVE-2020-17141 CVE-2020-17144.


USVN (aka User-friendly SVN) before 1.0.9 allows remote code execution via shell metacharacters in the number_start or number_end parameter to LastHundredRequest (aka lasthundredrequestAction) in the Timeline module. NOTE: this may overlap CVE-2020-25069.


Windows GDI+ Remote Code Execution Vulnerability


Microsoft SharePoint Remote Code Execution Vulnerability This CVE ID is unique from CVE-2020-17118.


Visual Studio Code JSHint Extension Remote Code Execution Vulnerability


Microsoft Teams Remote Code Execution Vulnerability


Hyper-V Remote Code Execution Vulnerability


Microsoft SharePoint Remote Code Execution Vulnerability This CVE ID is unique from CVE-2020-17121.


Visual Studio Code Java Extension Pack Remote Code Execution Vulnerability


SEOWON INTECH SLC-130 And SLR-120S devices allow Remote Code Execution via the ipAddr parameter to the system_log.cgi page.


Microsoft Exchange Remote Code Execution Vulnerability This CVE ID is unique from CVE-2020-17117 CVE-2020-17132 CVE-2020-17142 CVE-2020-17144.


Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability


Microsoft Exchange Remote Code Execution Vulnerability This CVE ID is unique from CVE-2020-17117 CVE-2020-17141 CVE-2020-17142 CVE-2020-17144.


Windows NTFS Remote Code Execution Vulnerability


Windows Print Spooler Remote Code Execution Vulnerability


Microsoft Exchange Remote Code Execution Vulnerability This CVE ID is unique from CVE-2020-17132 CVE-2020-17141 CVE-2020-17142 CVE-2020-17144.


Microsoft Exchange Remote Code Execution Vulnerability This CVE ID is unique from CVE-2020-17117 CVE-2020-17132 CVE-2020-17141 CVE-2020-17142.


Microsoft Dynamics 365 for Finance and Operations (on-premises) Remote Code Execution Vulnerability This CVE ID is unique from CVE-2020-17152.


A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory aka 'Microsoft Excel Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-16929 CVE-2020-16931 CVE-2020-16932.


Advantech WebAccess HMI Designer Versions 2.1.9.31 and prior. Processing specially crafted project files lacking proper validation of user supplied data may cause a type confusion condition which may allow remote code execution disclosure/modification of information or cause the application to crash.


A remote code execution vulnerability exists in Microsoft Exchange server due to improper validation of cmdlet arguments.An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the System user aka 'Microsoft Exchange Server Remote Code Execution Vulnerability'.


Type confusion in Gallagher Command Centre Server allows a remote attacker to crash the server or possibly cause remote code execution. This issue affects: Gallagher Command Centre 8.30 versions prior to 8.30.1236(MR1); 8.20 versions prior to 8.20.1166(MR3); 8.10 versions prior to 8.10.1211(MR5); version 8.00 and prior versions.


A remote code execution vulnerability exists in Microsoft Dynamics 365 (on-premises) when the server fails to properly sanitize web requests to an affected Dynamics server aka 'Microsoft Dynamics 365 (on-premises) Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-16862.


A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory aka 'Microsoft Excel Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-16929 CVE-2020-16930 CVE-2020-16932.


A remote code execution vulnerability exists when the Base3D rendering engine improperly handles memory.An attacker who successfully exploited the vulnerability would gain execution on a victim system.The security update addresses the vulnerability by correcting how the Base3D rendering engine handles memory. aka 'Base3D Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-17003.


A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory aka 'Microsoft Excel Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-16930 CVE-2020-16931 CVE-2020-16932.


Advantech WebAccess HMI Designer Versions 2.1.9.31 and prior. A double free vulnerability caused by processing specially crafted project files may allow remote code execution disclosure/modification of information or cause the application to crash.


Advantech WebAccess HMI Designer Versions 2.1.9.31 and prior. Processing specially crafted project files lacking proper validation of user supplied data may cause the system to write outside the intended buffer area which may allow remote code execution disclosure/modification of information or cause the application to crash.


A remote code execution vulnerability exists in Microsoft Dynamics 365 (on-premises) when the server fails to properly sanitize web requests to an affected Dynamics server aka 'Microsoft Dynamics 365 (on-premises) Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-16860.


The Kommbox component in Rangee GmbH RangeeOS 8.0.4 is vulnerable to Remote Code Execution due to untrusted user supplied input being passed to the command line without sanitization.


A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory aka 'Microsoft Excel Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-16929 CVE-2020-16930 CVE-2020-16931.


A reportpage index expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).


A CWE-787 Out-of-bounds Write vulnerability exists in IGSS Definition (Def.exe) version 14.0.0.20247 that could cause Remote Code Execution when malicious CGF (Configuration Group File) file is imported to IGSS Definition.


A deployselectbootrom expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).


A viewtaskresultdetailfact expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).


In FreeBSD 12.1-STABLE before r365010 11.4-STABLE before r365011 12.1-RELEASE before p9 11.4-RELEASE before p3 and 11.3-RELEASE before p13 dhclient(8) fails to handle certain malformed input related to handling of DHCP option 119 resulting a heap overflow. The heap overflow could in principle be exploited to achieve remote code execution. The affected process runs with reduced privileges in a Capsicum sandbox limiting the immediate impact of an exploit.


A forwardredirect expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).


A CWE-787: Out-of-bounds Write vulnerability exists in IGSS Definition (Def.exe) version 14.0.0.20247 that could cause Remote Code Execution when malicious CGF (Configuration Group File) file is imported to IGSS Definition.


A templateselect expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).


Cacti 1.2.8 allows Remote Code Execution (by privileged users) via shell metacharacters in the Performance Boost Debug Log field of poller_automation.php. OS commands are executed when a new poller cycle begins. The attacker must be authenticated and must have access to modify the Performance Settings of the product.


A faultdevparasset expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).


A selviewnavcontent expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).


A operatorgrouptreeselectcontent expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).


A ictexpertcsvdownload expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).


A operatorgroupselectcontent expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).


A iccselectdevtype expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).


A faultinfo_content expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).


The ipTIME NAS product allows an arbitrary file upload vulnerability in the Manage Bulletins/Upload feature which can be leveraged to gain remote code execution. This issue affects: pTIME NAS 1.4.36.


A quicktemplateselect expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).


A devicethresholdconfig expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).


Comtech Stampede FX-1010 7.4.3 devices allow remote authenticated administrators to achieve remote code execution by navigating to the Poll Routes page and entering shell metacharacters in the Router IP Address field. (In some cases authentication can be achieved with the comtech password for the comtech account.)


A navigationto expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).


A faultparasset expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).


A powershellconfigcontent expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).


A devgroupselect expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).


A wmiconfigcontent expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).


** DISPUTED ** data_input.php in Cacti 1.2.8 allows remote code execution via a crafted Input String to Data Collection -> Data Input Methods -> Unix -> Ping Host. NOTE: the vendor has stated \This is a false alarm.\


A sshconfig expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).


A CWE-787 Out-of-bounds Write vulnerability exists in IGSS Definition (Def.exe) version 14.0.0.20247 that could cause Remote Code Execution when malicious CGF (Configuration Group File) file is imported to IGSS Definition.


A server side injection vulnerability exists which could allow an authenticated administrative user to achieve Remote Code Execution in ClearPass. Resolution: Fixed in 6.7.13 6.8.4 6.9.0 and higher.


Potential remote code execution security vulnerabilities have been identified with HPE Nimble Storage systems that could be exploited by an attacker to gain elevated privileges on the array. The following NimbleOS versions and all subsequent releases contain a software fix for this vulnerability: 3.9.3.0 4.5.6.0 5.0.9.0 5.1.4.100


A actionselectcontent expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).


A eventinfo_content expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).


Comtech Stampede FX-1010 7.4.3 devices allow remote authenticated administrators to achieve remote code execution by navigating to the Diagnostics Trace Route page and entering shell metacharacters in the Target IP address field. (In some cases authentication can be achieved with the comtech password for the comtech account.)


LinuxKI v6.0-1 and earlier is vulnerable to an remote code execution which is resolved in release 6.0-2.


A perfaddormoddevicemonitor expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).


A ifviewselectpage expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).


A iccselectcommand expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).


An authorization bypass and PHP local-file-include vulnerability in the installation component of SugarCRM before 8.0 8.0 before 8.0.7 9.0 before 9.0.4 and 10.0 before 10.0.0 allows for unauthenticated remote code execution against a configured SugarCRM instance via crafted HTTP requests. (This is exploitable even after installation is completed.).


A deviceselect expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).


A thirdpartyperfselecttask expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).


A deployselectsoftware expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).


A remote code execution (RCE) vulnerability exists in qdPM 9.1 and earlier. An attacker can upload a malicious PHP code file via the profile photo functionality by leveraging a path traversal vulnerability in the users'photop_preview' delete photo feature allowing bypass of .htaccess protection. NOTE: this issue exists because of an incomplete fix for CVE-2015-3884.


A reporttaskselect expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).


A userselectpagingcontent expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).


A faultstatchoosefaulttype expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).


Tobesoft Xplatform 9.2.2.250 and earlier version have an arbitrary code execution vulnerability by using method supported by Xplatform ActiveX Control. It allows attacker to cause remote code execution.


A CWE-787 Out-of-bounds Write vulnerability exists in IGSS Definition (Def.exe) version 14.0.0.20247 that could cause Remote Code Execution when malicious CGF (Configuration Group File) file is imported to IGSS Definition.


A viewbatchtaskresultdetailfact expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).


A comparefilesresult expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).


A iccselectdymicparam expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).


In JFrog Artifactory 5.x and 6.x insecure FreeMarker template processing leads to remote code execution e.g. by modifying a .ssh/authorized_keys file. Patches are available for various versions between 5.11.8 and 6.16.0. The issue exists because use of the DefaultObjectWrapper class makes certain Java functions accessible to a template.


A CWE-787: Out-of-bounds Write vulnerability exists in IGSS Definition (Def.exe) version 14.0.0.20247 that could cause Remote Code Execution when malicious CGF (Configuration Group File) file is imported to IGSS Definition.


A ictexpertcsvdownload expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).


A ictexpertdownload expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).


A perfselecttask expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).


A guidatadetail expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).


A CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists in IGSS Definition (Def.exe) version 14.0.0.20247 that could cause Remote Code Execution when malicious CGF (Configuration Group File) file is imported to IGSS Definition.


A tvxlanlegend expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).


A chooseperfview expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).


A soapconfigcontent expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).


A selectusergroup expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).


A CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists in IGSS Definition (Def.exe) version 14.0.0.20247 and prior that could cause Remote Code Execution when malicious CGF (Configuration Group File) file is imported to IGSS Definition.


A smsrulesdownload expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).


A customtemplateselect expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).


A select expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).


A adddevicetoview expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).


Comtech Stampede FX-1010 7.4.3 devices allow remote authenticated administrators to achieve remote code execution by navigating to the Fetch URL page and entering shell metacharacters in the URL field. (In some cases authentication can be achieved with the comtech password for the comtech account.)


A iccselectrules expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).


A operationselect expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).


A devsoftsel expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).


A mediaforaction expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).


A ictexpertcsvdownload expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).


A CWE-787 Out-of-bounds Write vulnerability exists in IGSS Definition (Def.exe) version 14.0.0.20247 that could cause Remote Code Execution when malicious CGF (Configuration Group File) file is imported to IGSS Definition.


A iccselectdeviceseries expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).


A faultflasheventselectfact expression language injectionremote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).


A CWE-434 Unrestricted Upload of File with Dangerous Type vulnerability exists in EcoStruxure Building Operation WebReports V1.9 - V3.1 that could cause an authenticated remote user being able to upload arbitrary files due to incorrect verification of user supplied files and achieve remote code execution.


A faulttrapgroupselect expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PLAT 7.3 (E0705P07).


** PRODUCT NOT SUPPORTED WHEN ASSIGNED ** A Server-Side Request Forgery (SSRF) vulnerability was found in Codiad v1.7.8 and later. A user with admin privileges could use the plugin install feature to make the server request any URL via components/market/class.market.php. This could potentially result in remote code execution. NOTE: the vendor states \Codiad is no longer under active maintenance by core contributors.\


In Xiaomi router R3600 ROM version<1.0.20 the connection service can be injected through the web interface resulting in stack overflow or remote code execution.


In Xiaomi router R3600 ROM version<1.0.66 filters in the set_WAN6 interface can be bypassed causing remote code execution. The router administrator can gain root access from this vulnerability.


In Xiaomi router R3600 ROM version<1.0.20 a connect service suffers from an injection vulnerability through the web interface leading to a stack overflow or remote code execution.


This issue exists to document that a security improvement in the way that Jira Server and Data Center use velocity templates has been implemented. The way in which velocity templates were used in Atlassian Jira Server and Data Center in affected versions allowed remote attackers to achieve remote code execution via insecure deserialization if they were able to exploit a server side template injection vulnerability. The affected versions are before version 7.13.0 from version 8.0.0 before 8.5.0 and from version 8.6.0 before version 8.8.1.


Monsta FTP 2.10.1 or below allows external control of paths used in filesystem operations. This allows attackers to read and write arbitrary local files allowing an attacker to gain remote code execution in common deployments.


Delta Industrial Automation DOPSoft Version 4.00.08.15 and prior. Opening a specially crafted project file may overflow the heap which may allow remote code execution disclosure/modification of information or cause the application to crash.


MIT Lifelong Kindergarten Scratch scratch-vm before 0.2.0-prerelease.20200714185213 loads extension URLs from untrusted project.json files with certain _ characters resulting in remote code execution because the URL's content is treated as a script and is executed as a worker. The responsible code is getExtensionIdForOpcode in serialization/sb3.js. The use of _ is incompatible with a protection mechanism in older versions in which URLs were split and consequently deserialization attacks were prevented. NOTE: the scratch.mit.edu hosted service is not affected because of the lack of worker scripts.


** PRODUCT NOT SUPPORTED WHEN ASSIGNED ** A Cross Side Request Forgery (CSRF) vulnerability was found in Codiad v1.7.8 and later. The request to download a plugin from the marketplace is only available to admin users and it isn't CSRF protected in components/market/controller.php. This might cause admins to make a vulnerable request without them knowing and result in remote code execution. NOTE: the vendor states \Codiad is no longer under active maintenance by core contributors.\


Angular

Expressions

before

version

has

a

remote

code

execution

vulnerability

if

you

call

where

userControlledInput

is

text

that

comes

from

user

input.

If

running

angular-expressions

in

the

browser

an

attacker

could

run

any

browser

script

when

the

application

code

calls

expressions.compile(userControlledInput).

If

running

angular-expressions

on

the

server

an

attacker

could

run

any

Javascript

expression

thus

gaining

Remote

Code

Execution.


Cybozu Desktop for Windows 2.0.23 to 2.2.40 allows remote code execution via unspecified vectors.


SonicWall Global VPN client version 4.10.4.0314 and earlier have an insecure library loading (DLL hijacking) vulnerability. Successful exploitation could lead to remote code execution in the target system.


PHPGurukul Car Rental Project v1.0 allows Remote Code Execution via an executable file in an upload of a new profile image.


Unraid through 6.8.0 allows Remote Code Execution.


VMware GemFire versions prior to 9.10.0 9.9.2 9.8.7 and 9.7.6 and VMware Tanzu GemFire for VMs versions prior to 1.11.1 and 1.10.2 when deployed without a SecurityManager contain a JMX service available which contains an insecure default configuration. This allows a malicious user to create an MLet mbean leading to remote code execution.


In BIG-IP versions 15.0.0-15.1.0.3 14.1.0-14.1.2.5 13.1.0-13.1.3.3 12.1.0-12.1.5.1 and 11.6.1-11.6.5.1 the Traffic Management User Interface (TMUI) also referred to as the Configuration utility has a Remote Code Execution (RCE) vulnerability in undisclosed pages.


Parallels Remote Application Server (RAS) 17.1.1 has a Business Logic Error causing remote code execution. It allows an authenticated user to execute any application in the backend operating system through the web application despite the affected application not being published. In addition it was discovered that it is possible to access any host in the internal domain even if it has no published applications or the mentioned host is no longer associated with that server farm.


fexsrv in F*EX (aka Frams' Fast File EXchange) before fex-20160919_2 allows eval injection (for unauthenticated remote code execution).


In TYPO3 installations with the \mediace\ extension from version 7.6.2 and before version 7.6.5 it has been discovered that an internal verification mechanism can be used to generate arbitrary checksums. The allows to inject arbitrary data having a valid cryptographic message authentication code and can lead to remote code execution. To successfully exploit this vulnerability an attacker must have access to at least one `Extbase` plugin or module action in a TYPO3 installation. This is fixed in version 7.6.5 of the \mediace\ extension for TYPO3.


In Ortus TestBox 2.4.0 through 4.1.0 unvalidated query string parameters passed to system/runners/HTMLRunner.cfm allow an attacker to write an arbitrary CFM file (within the application's context) containing attacker-defined CFML tags leading to Remote Code Execution.


Yii 2 (yiisoft/yii2) before version 2.0.38 is vulnerable to remote code execution if the application calls `unserialize()` on arbitrary user input. This is fixed in version 2.0.38. A possible workaround without upgrading is available in the linked advisory.


baserCMS before version 4.4.1 is affected by Remote Code Execution (RCE). Code may be executed by logging in as a system administrator and uploading an executable script file such as a PHP file. The Edit template component is vulnerable. The issue is fixed in version 4.4.1.


There is a vulnerability in Paginator (Elixir/Hex package) which makes it susceptible to Remote Code Execution (RCE) attacks via input parameters to the paginate() function. This will potentially affect all current users of Paginator prior to version 1.0.0. The vulnerability has been patched in version 1.0.0 and all users should upgrade to this version immediately. Note that this patched version uses a dependency that requires an Elixir version >=1.5.


SOY CMS 3.0.2.327 and earlier is affected by Unauthenticated Remote Code Execution (RCE). The allows remote attackers to execute any arbitrary code when the inquiry form feature is enabled by the service. The vulnerability is caused by unserializing the form without any restrictions. This was fixed in 3.0.2.328.


The WebControl in RaspberryTortoise through 2012-10-28 is vulnerable to remote code execution via shell metacharacters in a URI. The file nodejs/raspberryTortoise.js has no validation on the parameter incomingString before passing it to the child_process.exec function.


The UI in DevSpace 4.13.0 allows web sites to execute actions on pods (on behalf of a victim) because of a lack of authentication for the WebSocket protocol. This leads to remote code execution.


baserCMS 4.3.6 and earlier is affected by Cross Site Scripting (XSS) and Remote Code Execution (RCE). This may be executed by logging in as a system administrator and uploading an executable script file such as a PHP file.The affected components are ThemeFilesController.php and UploaderFilesController.php. This is fixed in version 4.3.7.


The administrative interface of Cohesive Networks vns3:vpn appliances before version 4.11.1 is vulnerable to authenticated remote code execution leading to server compromise.


A Remote Code Execution vulnerability in Stimulsoft (aka Stimulsoft Reports) 2013.1.1600.0 allows an attacker to encode C# scripts as base-64 in the report XML file so that they will be compiled and executed on the server that processes this file. This can be used to fully compromise the server.


Rocket.Chat through 3.4.2 allows XSS where an attacker can send a specially crafted message to a channel or in a direct message to the client which results in remote code execution on the client side.


The turn extension through 0.3.2 for TYPO3 allows Remote Code Execution.


ad-ldap-connector's admin panel before version 5.0.13 does not provide csrf protection which when exploited may result in remote code execution or confidential data loss. CSRF exploits may occur if the user visits a malicious page containing CSRF payload on the same machine that has access to the ad-ldap-connector admin console via a browser. You may be affected if you use the admin console included with ad-ldap-connector versions <=5.0.12. If you do not have ad-ldap-connector admin console enabled or do not visit any other public URL while on the machine it is installed on you are not affected. The issue is fixed in version 5.0.13.


In SyliusResourceBundle before versions 1.3.14 1.4.7 1.5.2 and 1.6.4 rrequest parameters injected inside an expression evaluated by `symfony/expression-language` package haven't been sanitized properly. This allows the attacker to access any public service by manipulating that request parameter allowing for Remote Code Execution. This issue has been patched for versions 1.3.14 1.4.7 1.5.2 and 1.6.4. Versions prior to 1.3 were not patched.


The Act module for Red Discord Bot before commit 6b9f3b86 is vulnerable to Remote Code Execution. With this exploit Discord users can use specially crafted messages to perform destructive actions and/or access sensitive information. Unloading the Act module with `unload act` can render this exploit inaccessible.


An issue was discovered in the Maven Extension plugin before 1.6 for Gradle Enterprise. The extension uses a socket connection to send serialized Java objects. Deserialization is not restricted to an allow-list thus allowing an attacker to achieve code execution via a malicious deserialization gadget chain. The socket is not bound exclusively to localhost. The port this socket is assigned to is randomly selected and is not intentionally exposed to the public (either by design or documentation). This could potentially be used to achieve remote code execution and local privilege escalation.


In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.20 and greater than or equal to 10.0.0 and less than 10.4.6 in a case where an attacker manages to generate a valid cryptographic message authentication code (HMAC-SHA1) - either by using a different existing vulnerability or in case the internal encryptionKey was exposed - it is possible to retrieve arbitrary files of a TYPO3 installation. This includes the possibility to fetch typo3conf/LocalConfiguration.php which again contains the encryptionKey as well as credentials of the database management system being used. In case a database server is directly accessible either via internet or in a shared hosting network this allows the ability to completely retrieve manipulate or delete database contents. This includes creating an administration user account - which can be used to trigger remote code execution by injecting custom extensions. This has been patched in versions 9.5.20 and 10.4.6.


Red Discord Bot before versions 3.3.12 and 3.4 has a Remote Code Execution vulnerability in the Streams module. This exploit allows Discord users with specifically crafted \going live\ messages to inject code into the Streams module's going live message. By abusing this exploit it's possible to perform destructive actions and/or access sensitive information. As a workaround unloading the Trivia module with `unload streams` can render this exploit not accessible. It is highly recommended updating to 3.3.12 or 3.4 to completely patch this issue.


The git hook feature in Gogs 0.5.5 through 0.12.2 allows for authenticated remote code execution. There can be a privilege escalation if access to this hook feature is granted to a user who does not have administrative privileges. NOTE: because this is mentioned in the documentation but not in the UI it could be considered a \Product UI does not Warn User of Unsafe Actions\ issue.


In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.20 and greater than or equal to 10.0.0 and less than 10.4.6 it has been discovered that an internal verification mechanism can be used to generate arbitrary checksums. This allows to inject arbitrary data having a valid cryptographic message authentication code (HMAC-SHA1) and can lead to various attack chains including potential privilege escalation insecure deserialization & remote code execution. The overall severity of this vulnerability is high based on mentioned attack chains and the requirement of having a valid backend user session (authenticated). This has been patched in versions 9.5.20 and 10.4.6.


An issue was discovered on Wavlink WL-WN530HG4 M30HG4.V5030.191116 devices. Multiple shell metacharacter injection vulnerabilities exist in CGI scripts leading to remote code execution with root privileges.


In SyliusResourceBundle before versions 1.3.14 1.4.7 1.5.2 and 1.6.4 request parameters injected inside an expression evaluated by `symfony/expression-language` package haven't been sanitized properly. This allows the attacker to access any public service by manipulating that request parameter allowing for Remote Code Execution. This issue has been patched for versions 1.3.14 1.4.7 1.5.2 and 1.6.4. Versions prior to 1.3 were not patched.


In Symfony before versions 4.4.13 and 5.1.5 the CachingHttpClient class from the HttpClient Symfony component relies on the HttpCache class to handle requests. HttpCache uses internal headers like X-Body-Eval and X-Body-File to control the restoration of cached responses. The class was initially written with surrogate caching and ESI support in mind (all HTTP calls come from a trusted backend in that scenario). But when used by CachingHttpClient and if an attacker can control the response for a request being made by the CachingHttpClient remote code execution is possible. This has been fixed in versions 4.4.13 and 5.1.5.


An untrusted search path remote code execution (RCE) vulnerability in the Trend Micro Secuity 2020 (v16.0.0.1146 and below) consumer family of products could allow an attacker to run arbitrary code on a vulnerable system. As the Trend Micro installer tries to load DLL files from its current directory an arbitrary DLL could also be loaded with the same privileges as the installer if run as Administrator. User interaction is required to exploit the vulnerbaility in that the target must open a malicious directory or device.


Missing checks on Content-Type headers in geckodriver before 0.27.0 could lead to a CSRF vulnerability that might when paired with a specifically prepared request lead to remote code execution.


In hpack_dht_insert in hpack-tbl.c in the HPACK decoder in HAProxy 1.8 through 2.x before 2.1.4 a remote attacker can write arbitrary bytes around a certain location on the heap via a crafted HTTP/2 request possibly causing remote code execution.


u'Out of bound memory access while processing GATT data received due to lack of check of pdu data length and leads to remote code execution' in Snapdragon Auto Snapdragon Compute Snapdragon Connectivity Snapdragon Consumer Electronics Connectivity Snapdragon Consumer IOT Snapdragon Industrial IOT Snapdragon Mobile in APQ8053 QCA6390 QCA9379 QCN7605 SC8180X SDX55


dropwizard-validation before versions 2.0.3 and 1.3.21 has a remote code execution vulnerability. A server-side template injection was identified in the self-validating feature enabling attackers to inject arbitrary Java EL expressions leading to Remote Code Execution (RCE) vulnerability. If you are using a self-validating bean an upgrade to Dropwizard 1.3.21/2.0.3 or later is strongly recommended. The changes introduced in Dropwizard 1.3.19 and 2.0.2 for CVE-2020-5245 unfortunately did not fix the underlying issue completely. The issue has been fixed in dropwizard-validation 1.3.21 and 2.0.3 or later. We strongly recommend upgrading to one of these versions.


The Gravity updater in Pi-hole through 4.4 allows an authenticated adversary to upload arbitrary files. This can be abused for Remote Code Execution by writing to a PHP file in the web directory. (Also it can be used in conjunction with the sudo rule for the www-data user to escalate privileges to root.) The code error is in gravity_DownloadBlocklistFromUrl in gravity.sh.


An issue was discovered in Squid before 5.0.2. A remote attacker can replay a sniffed Digest Authentication nonce to gain access to resources that are otherwise forbidden. This occurs because the attacker can overflow the nonce reference counter (a short integer). Remote code execution may occur if the pooled token credentials are freed (instead of replayed as valid credentials).


node-dns-sync (npm module dns-sync) through 0.2.0 allows execution of arbitrary commands . This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. This has been fixed in 0.2.1.


An issue was discovered on NETGEAR Orbi Tri-Band Business WiFi Add-on Satellite (SRS60) AC3000 V2.5.1.106 Outdoor Satellite (RBS50Y) V2.5.1.106 and Pro Tri-Band Business WiFi Router (SRR60) AC3000 V2.5.1.106. The root account has the same password as the Web-admin component. Thus by exploiting CVE-2020-11551 it is possible to achieve remote code execution with root privileges on the embedded Linux system.


u'In the lbd service an external user can issue a specially crafted debug command to overwrite arbitrary files with arbitrary content resulting in remote code execution.' in Snapdragon Connectivity Snapdragon Consumer IOT Snapdragon Wired Infrastructure and Networking in IPQ4019 IPQ6018 IPQ8064 IPQ8074 QCA4531 QCA9531 QCA9980


JsLink in Webswing before 2.6.12 LTS and 2.7.x and 20.x before 20.1 allows remote code execution.


In TYPO3 CMS 9.0.0 through 9.5.16 and 10.0.0 through 10.4.1 it has been discovered that backend user settings (in $BE_USER->uc) are vulnerable to insecure deserialization. In combination with vulnerabilities of third party components this can lead to remote code execution. A valid backend user account is needed to exploit this vulnerability. This has been fixed in 9.5.17 and 10.4.2.


Pandora FMS 7.0 NG <= 746 suffers from Multiple XSS vulnerabilities in different browser views. A network administrator scanning a SNMP device can trigger a Cross Site Scripting (XSS) which can run arbitrary code to allow Remote Code Execution as root or apache2.


An issue was discovered in EJBCA before 6.15.2.6 and 7.x before 7.3.1.2. An error state can be generated in the CA UI by a malicious user. This in turn allows exploitation of other bugs. This follow-on exploitation can lead to privilege escalation and remote code execution. (This is exploitable only when at least one accessible port lacks a requirement for client certificate authentication. These ports are 8442 or 8080 in a standard installation.)


NVIDIA DGX servers all DGX-1 with BMC firmware versions prior to 3.38.30 contain a vulnerability in the AMI BMC firmware in which software allows an attacker to upload or transfer files that can be automatically processed within the product's environment which may lead to remote code execution.


An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor if an attack can connect to the broker (Redis RabbitMQ) directly it was possible to insert a malicious payload directly to the broker which could lead to a deserialization attack (and thus remote code execution) on the Worker.


The Search Meter plugin through 2.13.2 for WordPress allows user input introduced in the search bar to be any formula. The attacker could achieve remote code execution via CSV injection if a wp-admin/index.php?page=search-meter Export is performed.


An

issue

was

discovered

in

Deskpro

before

This

product

enables

administrators

to

modify

the

helpdesk

interface

by

editing

theme

templates

and

uses

TWIG

as

its

template

engine.

While

direct

access

to

self

and

variables

was

not

permitted

one

could

abuse

the

accessible

variables

in

one's

context

to

reach

a

native

unserialize

function

via

the

code

parameter.

There

on

could

pass

a

crafted

payload

to

trigger

a

set

of

POP

gadgets

in

order

to

achieve

remote

code

execution.


In the media-library-assistant plugin before 2.82 for WordPress Remote Code Execution can occur via the tax_query meta_query or date_query parameter in mla_gallery via an admin.


A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory aka 'Microsoft Word Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0850 CVE-2020-0851 CVE-2020-0855 CVE-2020-0892.


A remote code execution vulnerability exists in Microsoft Windows that could allow remote code execution if a .LNK file is processed.An attacker who successfully exploited this vulnerability could gain the same user rights as the local user aka 'LNK Remote Code Execution Vulnerability'.


A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory aka 'Microsoft Word Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0850 CVE-2020-0851 CVE-2020-0852 CVE-2020-0855.


A remoted code execution vulnerability exists in the way that Microsoft Windows Codecs Library handles objects in memory aka 'Microsoft Windows Codecs Library Remote Code Execution Vulnerability'.


A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0920 CVE-2020-0929 CVE-2020-0931 CVE-2020-0971 CVE-2020-0974.


In rw_t2t_update_lock_attributes of rw_t2t_ndef.cc there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution over NFC with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-148159613


In the mp3 extractor there is a possible out of bounds write due to uninitialized data. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-155171907


In parseChunk of MPEG4Extractor.cpp there is a possible out of bounds write due to incompletely initialized data. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-151159638


In ih264d_init_decoder of ih264d_api.c there is a possible out of bounds write due to a use after free. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation Product: Android Versions: Android-8.0 Android-8.1 Android-9 and Android-10 Android ID: A-142602711


A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0920 CVE-2020-0929 CVE-2020-0931 CVE-2020-0932 CVE-2020-0974.


A remote code execution vulnerability exists in ASP.NET Core software when the software fails to handle objects in memory.An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user aka 'ASP.NET Core Remote Code Execution Vulnerability'.


A remote code execution vulnerability exists in Application Inspector version v1.0.23 or earlier when the tool reflects example code snippets from third-party source files into its HTML output aka 'Remote Code Execution Vulnerability in Application Inspector'.


In RW_T4tPresenceCheck of rw_t4t.cc there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-141331405


A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0920 CVE-2020-0929 CVE-2020-0931 CVE-2020-0932 CVE-2020-0971.


A remote code execution vulnerability exists in .NET software when the software fails to check the source markup of a file.An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user aka '.NET Framework Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0605.


In get_element_attr_rsp of btif_rc.cc there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution if bluetoothtbd were used which it isn't in typical Android platforms with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-142878416


A remote code execution vulnerability exists when the Windows Imaging Library improperly handles memory.To exploit this vulnerability an attacker would first have to coerce a victim to open a specially crafted file.The security update addresses the vulnerability by correcting how the Windows Imaging Library handles memory. aka 'Windows Imaging Library Remote Code Execution Vulnerability'.


In Parse_data of eas_mdls.c there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution in the media extractor with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-151096540


In reassemble_and_dispatch of packet_fragmenter.cc there is possible out of bounds write due to an incorrect bounds calculation. This could lead to remote code execution over Bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-143894715


In rw_t2t_extract_default_locks_info of rw_t2t_ndef.cc there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution over NFC with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-147310721


In FastKeyAccumulator::GetKeysSlow of keys.cc there is a possible out of bounds write due to type confusion. This could lead to remote code execution when processing a proxy configuration with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-147664838


In allocExcessBits of bitalloc.c there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-146398979


A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory aka 'Microsoft Word Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0850 CVE-2020-0852 CVE-2020-0855 CVE-2020-0892.


In the Media extractor there is a possible use after free due to improper locking. This could lead to remote code execution in the media extractor with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-148223229


In Bluetooth there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-143604331


A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory aka 'Microsoft Word Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0850 CVE-2020-0851 CVE-2020-0852 CVE-2020-0892.


A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0920 CVE-2020-0929 CVE-2020-0932 CVE-2020-0971 CVE-2020-0974.


A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0920 CVE-2020-0931 CVE-2020-0932 CVE-2020-0971 CVE-2020-0974.


A remote code execution vulnerability exists in Windows Remote Desktop Gateway (RD Gateway) when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests aka 'Windows Remote Desktop Gateway (RD Gateway) Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0609.


In rw_t2t_handle_tlv_detect_rsp of rw_t2t_ndef.cc there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution over NFC with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-147309942


A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory aka 'Microsoft Word Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0851 CVE-2020-0852 CVE-2020-0855 CVE-2020-0892.


In UrlQuerySanitizer there is a possible improper input validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-73822755


In impeg2_fmt_conv_yuv420p_to_yuv420sp_uv of impeg2_format_conv.c there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-137798382


A remote code execution vulnerability exists in Windows Remote Desktop Gateway (RD Gateway) when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests aka 'Windows Remote Desktop Gateway (RD Gateway) Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0610.


In rw_t2t_handle_tlv_detect_rsp of rw_t2t_ndef.cc there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution over NFC with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-147310271


In a2dp_vendor_ldac_decoder_decode_packet of a2dp_vendor_ldac_decoder.cc there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-142546668


A remote code execution vulnerability exists in .NET software when the software fails to check the source markup of a file.An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user aka '.NET Framework Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0606.


A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0929 CVE-2020-0931 CVE-2020-0932 CVE-2020-0971 CVE-2020-0974.


A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles a specially-crafted multi-master font - Adobe Type 1 PostScript format.For all systems except Windows 10 an attacker who successfully exploited the vulnerability could execute code remotely aka 'Adobe Font Manager Library Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1020.


A file upload restriction bypass vulnerability in Pluck CMS before 4.7.13 allows an admin privileged user to gain access in the host through the \manage files\ functionality which may result in remote code execution.


Exim 4 before 4.94.2 has Improper Neutralization of Line Delimiters. An authenticated remote SMTP client can insert newline characters into a spool file (which indirectly leads to remote code execution as root) via AUTH= in a MAIL FROM command.


Zoho ManageEngine OpManager Stable build before 125203 (and Released build before 125233) allows Remote Code Execution via the Smart Update Manager (SUM) servlet.


An Arbitrary File Upload in the Upload Image component in SourceCodester Online Library Management System 1.0 allows the user to conduct remote code execution via admin/borrower/index.php?view=add because .php files can be uploaded to admin/borrower/photos (under the web root).


Askey Fiber Router RTF3505VW-N1 BR_SV_g000_R3505VWN1001_s32_7 devices allow Remote Code Execution and retrieval of admin credentials to log into the Dashboard or login via SSH leading to code execution as root.


Simple

College

Website

allows

a

user

to

conduct

remote

code

execution

via

/alumni/admin/ajax.php?action=save_settings

when

uploading

a

malicious

file

using

the

image

upload

functionality

which

is

stored

in


SuiteCRM before 7.11.17 is vulnerable to remote code execution via the system settings Log File Name setting. In certain circumstances involving admin account takeover logger_file_name can refer to an attacker-controlled .php file under the web root.


SourceCodester Alumni Management System 1.0 is affected by SQL injection causing arbitrary remote code execution from GET input in view_event.php via the 'id' parameter.


A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1023 CVE-2020-1102.


A remote code execution vulnerability exists in Visual Studio Code when the Python extension loads configuration files after opening a project aka 'Visual Studio Code Python Extension Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1192.


A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory aka 'Microsoft Excel Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1193 CVE-2020-1335 CVE-2020-1594.


A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory aka 'VBScript Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1213 CVE-2020-1214 CVE-2020-1215 CVE-2020-1216 CVE-2020-1260.


A remote code execution vulnerability exists in Microsoft SharePoint where APIs aren't properly protected from unsafe data input aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1200 CVE-2020-1210 CVE-2020-1452 CVE-2020-1453 CVE-2020-1576.


A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1200 CVE-2020-1210 CVE-2020-1452 CVE-2020-1576 CVE-2020-1595.


A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles a specially-crafted multi-master font - Adobe Type 1 PostScript format.For all systems except Windows 10 an attacker who successfully exploited the vulnerability could execute code remotely aka 'Adobe Font Manager Library Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0938.


A remote code execution vulnerability exists when Hyper-V RemoteFX vGPU on a host server fails to properly validate input from an authenticated user on a guest operating system aka 'Hyper-V RemoteFX vGPU Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1032 CVE-2020-1036 CVE-2020-1040 CVE-2020-1041 CVE-2020-1043.


A file inclusion vulnerability was found in the AJP connector enabled with a default AJP configuration port of 8009 in Undertow version 2.0.29.Final and before and was fixed in 2.0.30.Final. A remote unauthenticated attacker could exploit this vulnerability to read web application files from a vulnerable server. In instances where the vulnerable server allows file uploads an attacker could upload malicious JavaServer Pages (JSP) code within a variety of file types and trigger this vulnerability to gain remote code execution.


A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory aka 'VBScript Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1213 CVE-2020-1214 CVE-2020-1216 CVE-2020-1230 CVE-2020-1260.


A remote code execution vulnerability exists when the Windows Shell does not properly validate file paths.An attacker who successfully exploited this vulnerability could run arbitrary code in the context of the current user aka 'Windows Shell Remote Code Execution Vulnerability'.


A remoted code execution vulnerability exists in the way that Microsoft Windows Codecs Library handles objects in memory aka 'Microsoft Windows Codecs Library Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1457.


A remote code execution vulnerability exists in Microsoft Windows that could allow remote code execution if a .LNK file is processed.An attacker who successfully exploited this vulnerability could gain the same user rights as the local user aka 'LNK Remote Code Execution Vulnerability'.


A remote code execution vulnerability exists when Windows Address Book (WAB) improperly processes vcard files.To exploit the vulnerability an attacker could send a malicious vcard that a victim opens using Windows Address Book (WAB) aka 'Windows Address Book Remote Code Execution Vulnerability'.


A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory aka 'VBScript Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1213 CVE-2020-1215 CVE-2020-1216 CVE-2020-1230 CVE-2020-1260.


A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1023 CVE-2020-1024.


A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1200 CVE-2020-1452 CVE-2020-1453 CVE-2020-1576 CVE-2020-1595.


When using the Apache JServ Protocol (AJP) care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than for example a similar HTTP connection. If such connections are available to an attacker they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It was expected (and recommended in the security guide) that this Connector would be disabled if not required. This vulnerability report identified a mechanism that allowed: - returning arbitrary files from anywhere in the web application - processing any file in the web application as a JSP Further if the web application allowed file upload and stored those files within the web application (or the attacker was able to control the content of the web application by some other means) then this along with the ability to process a file as a JSP made remote code execution possible. It is important to note that mitigation is only required if an AJP port is accessible to untrusted users. Users wishing to take a defence-in-depth approach and block the vector that permits returning arbitrary files and execution as JSP may upgrade to Apache Tomcat 9.0.31 8.5.51 or 7.0.100 or later. A number of changes were made to the default AJP Connector configuration in 9.0.31 to harden the default configuration. It is likely that users upgrading to 9.0.31 8.5.51 or 7.0.100 or later will need to make small changes to their configurations.


A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory aka 'Microsoft Excel Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1494 CVE-2020-1495 CVE-2020-1498 CVE-2020-1504.


A remote code execution vulnerability exists when the Windows Font Driver Host improperly handles memory.An attacker who successfully exploited the vulnerability would gain execution on a victim system.The security update addresses the vulnerability by correcting how the Windows Font Driver Host handles memory. aka 'Windows Font Driver Host Remote Code Execution Vulnerability'.


A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory aka 'Microsoft Excel Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1193 CVE-2020-1332 CVE-2020-1335.


A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1210 CVE-2020-1452 CVE-2020-1453 CVE-2020-1576 CVE-2020-1595.


A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1200 CVE-2020-1210 CVE-2020-1453 CVE-2020-1576 CVE-2020-1595.


A remote code execution vulnerability exists when Hyper-V RemoteFX vGPU on a host server fails to properly validate input from an authenticated user on a guest operating system aka 'Hyper-V RemoteFX vGPU Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1032 CVE-2020-1036 CVE-2020-1040 CVE-2020-1041 CVE-2020-1042.


A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory aka 'VBScript Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1213 CVE-2020-1214 CVE-2020-1215 CVE-2020-1230 CVE-2020-1260.


A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory aka 'Microsoft Excel Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1332 CVE-2020-1335 CVE-2020-1594.


A remote code execution vulnerability exists when Microsoft Word for Android fails to properly handle certain files.To exploit the vulnerability an attacker would have to convince a user to open a specially crafted URL file.The update addresses the vulnerability by correcting how Microsoft Word for Android handles specially crafted URL files. aka 'Word for Android Remote Code Execution Vulnerability'.


A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory aka 'Microsoft Excel Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1494 CVE-2020-1495 CVE-2020-1496 CVE-2020-1504.


A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted fonts.For all systems except Windows 10 an attacker who successfully exploited the vulnerability could execute code remotely aka 'Windows Font Library Remote Code Execution Vulnerability'.


A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory aka 'Microsoft Excel Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1495 CVE-2020-1496 CVE-2020-1498 CVE-2020-1504.


A remote code execution vulnerability exists when Microsoft Windows fails to properly handle cabinet files.To exploit the vulnerability an attacker would have to convince a user to either open a specially crafted cabinet file or spoof a network printer and trick a user into installing a malicious cabinet file disguised as a printer driver.The update addresses the vulnerability by correcting how Windows handles cabinet files. aka 'Windows Remote Code Execution Vulnerability'.


A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1024 CVE-2020-1102.


A remote code execution vulnerability exists in .NET Framework Microsoft SharePoint and Visual Studio when the software fails to check the source markup of XML file input aka '.NET Framework SharePoint Server and Visual Studio Remote Code Execution Vulnerability'.


A remote code execution vulnerability exists when Hyper-V RemoteFX vGPU on a host server fails to properly validate input from an authenticated user on a guest operating system aka 'Hyper-V RemoteFX vGPU Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1032 CVE-2020-1036 CVE-2020-1040 CVE-2020-1042 CVE-2020-1043.


Vulnerability to Server-Side Template Injection on Mail templates for Apache Syncope 2.0.X releases prior to 2.0.15 2.1.X releases prior to 2.1.6 enabling attackers to inject arbitrary JEXL expressions leading to Remote Code Execution (RCE) was discovered.


A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory aka 'VBScript Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1213 CVE-2020-1214 CVE-2020-1215 CVE-2020-1216 CVE-2020-1230.


A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory aka 'Microsoft Excel Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1193 CVE-2020-1332 CVE-2020-1594.


It was noticed that Apache Heron 0.20.2-incubating Release 0.20.1-incubating and Release v-0.20.0-incubating does not configure its YAML parser to prevent the instantiation of arbitrary types resulting in a remote code execution vulnerabilities (CWE-502: Deserialization of Untrusted Data).


A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory aka 'Microsoft Excel Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1494 CVE-2020-1496 CVE-2020-1498 CVE-2020-1504.


A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory aka 'Microsoft Excel Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1494 CVE-2020-1495 CVE-2020-1496 CVE-2020-1498.


A flaw was found in Keycloak before version 11.0.0 where the code base contains usages of ObjectInputStream without type checks. This flaw allows an attacker to inject arbitrarily serialized Java Objects which would then get deserialized in a privileged context and potentially lead to remote code execution.


A remote code execution vulnerability exists when Hyper-V RemoteFX vGPU on a host server fails to properly validate input from an authenticated user on a guest operating system aka 'Hyper-V RemoteFX vGPU Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1032 CVE-2020-1036 CVE-2020-1041 CVE-2020-1042 CVE-2020-1043.


A remote code execution vulnerability exists when Hyper-V RemoteFX vGPU on a host server fails to properly validate input from an authenticated user on a guest operating system aka 'Hyper-V RemoteFX vGPU Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1032 CVE-2020-1040 CVE-2020-1041 CVE-2020-1042 CVE-2020-1043.


A remote code execution vulnerability exists in Visual Studio Code when the Python extension loads workspace settings from a notebook file aka 'Visual Studio Code Python Extension Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1171.


A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory aka 'VBScript Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1214 CVE-2020-1215 CVE-2020-1216 CVE-2020-1230 CVE-2020-1260.


A remote code execution vulnerability exists when Hyper-V RemoteFX vGPU on a host server fails to properly validate input from an authenticated user on a guest operating system aka 'Hyper-V RemoteFX vGPU Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1036 CVE-2020-1040 CVE-2020-1041 CVE-2020-1042 CVE-2020-1043.


A Server-Side Template Injection was identified in Apache Syncope prior to 2.1.6 enabling attackers to inject arbitrary Java EL expressions leading to an unauthenticated Remote Code Execution (RCE) vulnerability. Apache Syncope uses Java Bean Validation (JSR 380) custom constraint validators. When building custom constraint violation error messages they support different types of interpolation including Java EL expressions. Therefore if an attacker can inject arbitrary data in the error message template being passed they will be able to run arbitrary Java code.


A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1200 CVE-2020-1210 CVE-2020-1452 CVE-2020-1453 CVE-2020-1595.


An issue was discovered in the MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 software in all versions through 2.5.0. There is an authenticated remote code execution in the backup-scheduler.


cPanel before 84.0.20 allows a demo account to achieve remote code execution via a cpsrvd rsync shell (SEC-544).


Zulip Desktop before 5.0.0 improperly uses shell.openExternal and shell.openItem with untrusted content leading to remote code execution.


cPanel before 84.0.20 allows resellers to achieve remote code execution as root via a cpsrvd rsync shell (SEC-545).


A remote code execution vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. User-controlled configuration of the underlying parsers used by GitHub Pages were not sufficiently restricted and made it possible to execute commands on the GitHub Enterprise Server instance. To exploit this vulnerability an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise Server prior to 2.22 and was fixed in 2.21.6 2.20.15 and 2.19.21. The underlying issues contributing to this vulnerability were identified both internally and through the GitHub Security Bug Bounty program.


Emerson OpenEnterprise versions through 3.3.4 may allow an attacker to run an arbitrary commands with system privileges or perform remote code execution via a specific communication service.


A remote code execution vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. User-controlled configuration of the underlying parsers used by GitHub Pages were not sufficiently restricted and made it possible to execute commands on the GitHub Enterprise Server instance. To exploit this vulnerability an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise Server prior to 2.22.7 and was fixed in 2.22.7 2.21.15 and 2.20.24. The underlying issues contributing to this vulnerability were identified through the GitHub Security Bug Bounty program.