This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Studio Photo 3.6.6. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of EZI files. The issue results from the lack of proper validation of user-supplied data which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-7636.


PSI GridConnect GmbH Telecontrol Gateway and Smart Telecontrol Unit family IEC104 Security Proxy versions Telecontrol Gateway 3G Versions 4.2.21 5.0.27 5.1.19 6.0.16 and prior and Telecontrol Gateway XS-MU Versions 4.2.21 5.0.27 5.1.19 6.0.16 and prior and Telecontrol Gateway VM Versions 4.2.21 5.0.27 5.1.19 6.0.16 and prior and Smart Telecontrol Unit TCG Versions 5.0.27 5.1.19 6.0.16 and prior and IEC104 Security Proxy Version 2.2.10 and prior The web application browser interprets input as active HTML JavaScript or VBScript which could allow an attacker to execute arbitrary code.


This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Samsung Galaxy S9 prior to 1.4.20.2. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the GameServiceReceiver update mechanism. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-7477.


This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender SafePay 23.0.10.34. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of TIScript. When processing the launch method the application does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability execute code in the context of the current process. Was ZDI-CAN-7250.


A CWE-502: Deserialization of Untrusted Data vulnerability exists which could allow an attacker to execute arbitrary code on the targeted system with SYSTEM privileges when placing a malicious user to be authenticated for this vulnerability to be successfully exploited. Affected Product: Schneider Electric Software Update (SESU) SUT Service component (V2.1.1 to V2.3.0)


This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the popUpMenu method. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-7368.


This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.4.1.16828. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the ToggleFormsDesign method of the Foxit.FoxitReader.Ctl ActiveX object. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-7874.


This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.4.1.16828. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the removeField method when processing AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-8163.


A CWE-119: Buffer Errors vulnerability exists in ProClima (all versions prior to version 8.0.0) which allows an unauthenticated remote attacker to execute arbitrary code on the targeted system in all versions of ProClima prior to version 8.0.0.


This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.4.1.16828. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the removeField method when processing AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-8165.


A potential security vulnerability has been identified with certain versions of HP Touchpoint Analytics prior to version 4.1.4.2827. This vulnerability may allow a local attacker with administrative privileges to execute arbitrary code via an HP Touchpoint Analytics system service.


This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Samsung Galaxy S9 prior to January 2019 Security Update (SMR-JAN-2019 - SVE-2018-13467). User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the ASN.1 parser. When parsing ASN.1 strings the process does not properly validate the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-7472.


An unquoted search path vulnerability in Multiple Yokogawa products for Windows (Exaopc (R1.01.00 ? R3.77.00) Exaplog (R1.10.00 ? R3.40.00) Exaquantum (R1.10.00 ? R3.02.00 and R3.15.00) Exaquantum/Batch (R1.01.00 ? R2.50.40) Exasmoc (all revisions) Exarqe (all revisions) GA10 (R1.01.01 ? R3.05.01) and InsightSuiteAE (R1.01.00 ? R1.06.00)) allow local users to gain privileges via a Trojan horse executable file and execute arbitrary code with eleveted privileges.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.5.0.20723. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the exportValues method within a AcroForm. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-8491.


This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Studio Photo 3.6.6. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of EZI files. The issue results from the lack of proper validation of user-supplied data which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-7637.


** DISPUTED ** An issue was discovered in NumPy 1.16.0 and earlier. It uses the pickle Python module unsafely which allows remote attackers to execute arbitrary code via a crafted serialized object as demonstrated by a numpy.load call. NOTE: third parties dispute this issue because it is a behavior that might have legitimate applications in (for example) loading serialized Python object arrays from trusted and authenticated sources.


This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Studio Photo 3.6.6. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of EZI files. The issue results from the lack of proper validation of user-supplied data which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-7639.


This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.4.0.16811. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the XFA CXFA_FFDocView object. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-7777.


This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender SafePay 23.0.10.34. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of tiscript. When processing the System.Exec method the application does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-7234.


This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit PhantomPDF 9.4.1.16828. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the conversion of HTML files to PDF. The issue results from the lack of proper validation of user-supplied data which can result in a read past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-8170.


This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.3.10826. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the localFileStorage method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-7407.


This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Studio Photo 3.6.6. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of EZIX files. The issue results from the lack of proper validation of user-supplied data which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-7638.


This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Studio Photo 3.6.6.779. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of JPG files. The issue results from the lack of proper validation of user-supplied data which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-7632.


This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.4.16811. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within ConvertToPDF_x86.dll. The issue results from the lack of proper validation of user-supplied data which can result in a write past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-7694.


This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender SafePay 23.0.10.34. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of TIScript. The issue lies in the handling of the openFile method which allows for an arbitrary file write with attacker controlled data. An attacker can leverage this vulnerability execute code in the context of the current process. Was ZDI-CAN-7247.


This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.4.1.16828. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of XFA Template objects. The issue results from the lack of proper validation of user-supplied data which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-7972.


This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.3.10826. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within ConvertToPDF_x86.dll. The issue results from the lack of proper validation of user-supplied data which can result in a write past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-7613.


This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.3.10826. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within ConvertToPDF_x86.dll. The issue results from the lack of proper validation of user-supplied data which can result in a write past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-7614.


This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 9.4.1.16828. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the removeField method when processing AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-8164.


This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Samsung Galaxy S9 prior to January 2019 Security Update (SMR-JAN-2019 - SVE-2018-13467). User interaction is required to exploit this vulnerability in that the target must connect to a wireless network. The specific flaw exists within the captive portal. By manipulating HTML an attacker can force a page redirection. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-7476.


This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the XFA remerge method. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-7347.


Cscape 9.80 SP4 and prior. An improper input validation vulnerability may be exploited by processing specially crafted POC files. This may allow an attacker to read confidential information and remotely execute arbitrary code.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.4.1.16828. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the deleteItemAt method when processing AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-8295.


IBM Sterling B2B Integrator Standard Edition 5.2.0.0 through 5.2.6.5_2 6.0.0.0 through 6.0.3.2 and 6.1.0.0 could allow a remote attacker to execute arbitrary code on the system caused by the deserialization of untrusted data. By sending specially crafted request an attacker could exploit this vulnerability to execute arbitrary code with SYSTEM privileges. IBM X-Force ID: 172452.


IBM DB2 High Performance Unload load for LUW 6.1 and 6.5 could allow a local attacker to execute arbitrary code on the system caused by an untrusted search path vulnerability. By using a executable file an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 168298.


IBM Security Guardium 10.5 could allow a remote attacker to upload arbitrary files which could allow the attacker to execute arbitrary code on the vulnerable web server. IBM X-Force ID: 160698.


IBM Content Navigator 3.0CD is could allow an attacker to execute arbitrary code on a user's workstation. When editing an executable file in ICN with Edit service it will be executed on the user's workstation. IBM X-Force ID: 156000.


IBM DB2 for Linux UNIX and Windows (includes DB2 Connect Server) 9.7 10.1 10.5 and 11.1 could allow malicious user with access to the DB2 instance account to leverage a fenced execution process to execute arbitrary code as root. IBM X-Force ID: 156567.


IBM SDK Java Technology Edition Version 7.0.0.0 through 7.0.10.55 7.1.0.0 through 7.1.4.55 and 8.0.0.0 through 8.0.6.0 could allow a local authenticated attacker to execute arbitrary code on the system caused by DLL search order hijacking vulnerability in Microsoft Windows client. By placing a specially-crafted file in a compromised folder an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 172618.


IBM Security Identity Manager 6.0.0 could allow a remote attacker to execute arbitrary code on the system caused by the deserialization of untrusted data. By persuading a victim to visit a specially crafted Web site an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 166456.


Inappropriate memory management when caching in PDFium in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file.


Incorrect optimization assumptions in V8 in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.


HiSuite 9.1.0.300 versions and earlier contains a DLL hijacking vulnerability. This vulnerability exists due to some DLL file is loaded by HiSuite improperly. And it allows an attacker to load this DLL file of the attacker's choosing that could execute arbitrary code.


An incorrect JIT of GLSL shaders in SwiftShader in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to execute arbitrary code via a crafted HTML page.


Rapid7 Metasploit Framework suffers from an instance of CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in the Zip import function of Metasploit. Exploiting this vulnerability can allow an attacker to execute arbitrary code in Metasploit at the privilege level of the user running Metasploit. This issue affects: Rapid7 Metasploit Framework version 4.14.0 and prior versions.


Omission of the .desktop filetype from the Safe Browsing checklist in SafeBrowsing in Google Chrome on Linux prior to 72.0.3626.81 allowed an attacker who convinced a user to download a .desktop file to execute arbitrary code via a downloaded .desktop file.


An Unsafe Search Path vulnerability in FortiClient Online Installer (Windows version before 6.0.6) may allow an unauthenticated remote attacker with control over the directory in which FortiClientOnlineInstaller.exe resides to execute arbitrary code on the system via uploading malicious .dll files in that directory.


This vulnerability allows network adjacent attackers to execute arbitrary code on affected installations of Xiaomi Browser Prior to 10.4.0. User interaction is required to exploit this vulnerability in that the target must connect to a malicious access point. The specific flaw exists within the handling of HTTP responses to the Captive Portal. A crafted HTML response can cause the Captive Portal to to open a browser to a specified location without user interaction. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current process. Was ZDI-CAN-7467.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.909. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of EPS files. The issue results from the lack of proper validation of user-supplied data which can result in a read past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-8922.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.5. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of TIF files. The issue results from the lack of proper validation of user-supplied data which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-8695.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.5.0.20723. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of JPG files. The issue results from the lack of proper validation of user-supplied data which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-8838.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.5.0.20723. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of fields within Acroform objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-8913.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.5.0.20723. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of XFA forms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-8669.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.5.0.20723. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of JPG files. The issue results from the lack of proper validation of user-supplied data which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-8742.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.5.0.20723. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the conversion of DXF files to PDF. The issue results from the lack of proper validation of user-supplied data which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-8774.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.5.0.20723. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-8814.


This vulnerability allows remote atackers to execute arbitrary code on affected installations of Foxit Reader 9.5.0.20723. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the removeField method. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-8656.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.909. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of TIFF files. The issue results from the lack of proper validation of user-supplied data which can result in a read past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-8782.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.6.0.25114. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of templates in XFA forms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9149.


This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Xiaomi Browser Prior to 10.4.0. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the miui.share application. The issue results from the lack of proper validation of user-supplied data which can result in an arbitrary application download. An attacker can leverage this vulnerability to execute code in the context of the user. Was ZDI-CAN-7483.


In Horner Automation Cscape 9.90 and prior an improper input validation vulnerability has been identified that may be exploited by processing files lacking user input validation. This may allow an attacker to access information and remotely execute arbitrary code.


This vulnerability allows remote atackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.5.0.20723. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Calculate actions. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-8759.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.5.0.20723. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of fields within Acroform objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-8864.


An incorrect implementation of a local web server in eID client (Windows version before 3.1.2 Linux version before 3.0.3) allows remote attackers to execute arbitrary code (.cgi .pl or .php) or delete arbitrary files via a crafted HTML page. This is a product from the Ministry of Interior of the Slovak Republic.


An access vulnerability in CA Common Services DIA of CA Technologies Client Automation 14 and Workload Automation AE 11.3.5 11.3.6 allows a remote attacker to execute arbitrary code.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Studio Photo 3.6.6.909. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of TIF files. The issue results from the lack of proper validation of user-supplied data which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-8783.


Datalogic AV7000 Linear barcode scanner all versions prior to 4.6.0.0 is vulnerable to authentication bypass which may allow an attacker to remotely execute arbitrary code.


This vulnerability allows remote atackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.5.0.20723. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of Calculate actions. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-8757.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.5.0.20723. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of fields within Acroform objects. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-8888.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.5.0.20723. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the conversion of DXF files to PDF. The issue results from the lack of proper validation of user-supplied data which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-8773.


The MuleSoft Mule Community Edition runtime engine before 3.8 allows remote attackers to execute arbitrary code because of Java Deserialization related to Apache Commons Collections


ALTOOLS update service 18.1 and earlier versions contains a local privilege escalation vulnerability due to insecure permission. An attacker can overwrite an executable that is launched as a service to exploit this vulnerability and execute arbitrary code with system privileges.


An issue was discovered in ONAP SDC through Dublin. By accessing port 7000 of demo-sdc-sdc-wfd-fe pod an unauthenticated attacker (who already has access to pod-to-pod communication) may execute arbitrary code inside that pod. All ONAP Operations Manager (OOM) setups are affected.


An issue was discovered in ONAP VNFSDK through Dublin. By accessing port 8000 of demo-vnfsdk-vnfsdk an unauthenticated attacker (who already has access to pod-to-pod communication) may execute arbitrary code inside that pod. All ONAP Operations Manager (OOM) setups are affected.


A vulnerability in Cisco Jabber Client Framework (JCF) for Mac Software installed as part of the Cisco Jabber for Mac client could allow an authenticated local attacker to execute arbitrary code on an affected device The vulnerability is due to improper file level permissions on an affected device when it is running Cisco JCF for Mac Software. An attacker could exploit this vulnerability by authenticating to the affected device and executing arbitrary code or potentially modifying certain configuration files. A successful exploit could allow the attacker to execute arbitrary code or modify certain configuration files on the device using the privileges of the installed Cisco JCF for Mac Software.


An issue was discovered in ONAP SDC through Dublin. By accessing port 4000 of demo-sdc-sdc-be pod an unauthenticated attacker (who already has access to pod-to-pod communication) may execute arbitrary code inside that pod. All ONAP Operations Manager (OOM) setups are affected.


An issue was discovered in ONAP HOLMES before Dublin. By accessing port 9202 of dep-holmes-engine-mgmt pod an unauthenticated attacker (who already has access to pod-to-pod communication) may execute arbitrary code inside that pod. All ONAP Operations Manager (OOM) setups are affected.


In

PHP-Fusion

allows

remote

authenticated

users

to

execute

arbitrary

code

because

and

mishandle

executable

files

during

avatar

upload.


An issue was discovered in ONAP SDC through Dublin. By accessing port 7001 of demo-sdc-sdc-wfd-be pod an unauthenticated attacker (who already has access to pod-to-pod communication) may execute arbitrary code inside that pod. All ONAP Operations Manager (OOM) setups are affected.


A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v82 for macOS could allow an authenticated local attacker to run arbitrary code with elevated privileges. The macOS binary openvpn_launcher.64 is setuid root. This binary creates /tmp/pia_upscript.sh when executed. Because the file creation mask (umask) is not reset the umask value is inherited from the calling process. This value can be manipulated to cause the privileged binary to create files with world writable permissions. A local unprivileged user can modify /tmp/pia_upscript.sh during the connect process to execute arbitrary code as the root user.


An unspecified vulnerability in the application server in PaperCut MF and NG versions 18.3.8 and earlier and versions 19.0.3 and earlier allows remote attackers to execute arbitrary code via an unspecified vector.


An issue was discovered in ONAP SDC through Dublin. By accessing port 6000 of demo-sdc-sdc-fe pod an unauthenticated attacker (who already has access to pod-to-pod communication) may execute arbitrary code inside that pod. All ONAP Operations Manager (OOM) setups are affected.


A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v82 for Linux could allow an authenticated local attacker to run arbitrary code with elevated privileges. The root_runner.64 binary is setuid root. This binary executes /opt/pia/ruby/64/ruby which in turn attempts to load several libraries under /tmp/ruby-deploy.old/lib. A local unprivileged user can create a malicious library under this path to execute arbitrary code as the root user.


A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v1.0 for Windows could allow an authenticated local attacker to run arbitrary code with elevated privileges. The PIA client is vulnerable to a DLL injection vulnerability during the software update process. The updater loads several libraries from a folder that authenticated users have write access to. A low privileged user can leverage this vulnerability to execute arbitrary code as SYSTEM.


Modules.cpp in ZNC before 1.7.4-rc1 allows remote authenticated non-admin users to escalate privileges and execute arbitrary code by loading a module with a crafted name.


An issue was discovered in ONAP SDC through Dublin. By accessing port 4001 of demo-sdc-sdc-onboarding-be pod an unauthenticated attacker (who already has access to pod-to-pod communication) may execute arbitrary code inside that pod. All ONAP Operations Manager (OOM) setups are affected.


A vulnerability in the filesystem of Cisco IOS XE Software could allow an authenticated local attacker with physical access to an affected device to execute arbitrary code on the underlying operating system (OS) with root privileges. The vulnerability is due to insufficient file location validation. An attacker could exploit this vulnerability by placing code in a specific format on a USB device and inserting it into an affected Cisco device. A successful exploit could allow the attacker to execute the code with root privileges on the underlying OS of the affected device.


Grandstream GXV3611IR_HD before 1.0.3.23 devices allow remote authenticated users to execute arbitrary code via shell metacharacters in the /goform/systemlog?cmd=set logserver field.


An eval injection vulnerability in the Python web server routing on the Zyxel NAS 326 version 5.21 and below allows a remote authenticated attacker to execute arbitrary code via the tjp6jp6y4 simZysh and ck6fup6 APIs.


A vulnerability was found in postgresql versions 11.x prior to 11.3. The Windows installer for EnterpriseDB-supplied PostgreSQL does not lock down the ACL of the binary installation directory or the ACL of the data directory; it keeps the inherited ACL. In the default configuration this allows a local attacker to read arbitrary data directory files essentially bypassing database-imposed read access limitations. In plausible non-default configurations an attacker having both an unprivileged Windows account and an unprivileged PostgreSQL account can cause the PostgreSQL service account to execute arbitrary code.


Grandstream GXV3370 before 1.0.1.41 and WP820 before 1.0.3.6 devices allow remote authenticated users to execute arbitrary code via shell metacharacters in a /manager?action=getlogcat priority field.


Grandstream

before

devices

allow

remote

authenticated

users

to

execute

arbitrary

code

via

shell

metacharacters

in

the

filename

in

a

API

call.


A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions) SIMATIC PCS 7 V8.1 and newer (All versions) SIMATIC WinCC V7.2 and earlier (All versions) SIMATIC WinCC V7.3 and newer (All versions). An attacker with network access to affected installations which are configured without \Encrypted Communication\ can execute arbitrary code. The security vulnerability could be exploited by an unauthenticated attacker with network access to the affected installation. No user interaction is required to exploit this security vulnerability. The vulnerability impacts confidentiality integrity and availability of the device. At the time of advisory publication no public exploitation of this security vulnerability was known.


Jenkins Puppet Enterprise Pipeline 1.3.1 and earlier specifies unsafe values in its custom Script Security whitelist allowing attackers able to execute Script Security protected scripts to execute arbitrary code.


Arbitrary code execution (via backdoor code) was discovered in bootstrap-sass 3.2.0.3 when downloaded from rubygems.org. An unauthenticated attacker can craft the ___cfduid cookie value with base64 arbitrary code to be executed via eval() which can be leveraged to execute arbitrary code on the target system. Note that there are three underscore characters in the cookie name. This is unrelated to the __cfduid cookie that is legitimately used by Cloudflare.


A CSRF vulnerability in a logged-in user's profile edit form in the Ultimate Member plugin before 2.0.40 for WordPress allows attackers to become admin and subsequently extract sensitive information and execute arbitrary code. This occurs because the attacker can change the e-mail address in the administrator profile and then the attacker is able to reset the administrator password using the WordPress \password forget\ form.


A vulnerability was found in postgresql versions 11.x prior to 11.3. The Windows installer for BigSQL-supplied PostgreSQL does not lock down the ACL of the binary installation directory or the ACL of the data directory; it keeps the inherited ACL. In the default configuration an attacker having both an unprivileged Windows account and an unprivileged PostgreSQL account can cause the PostgreSQL service account to execute arbitrary code. An attacker having only the unprivileged Windows account can read arbitrary data directory files essentially bypassing database-imposed read access limitations. An attacker having only the unprivileged Windows account can also delete certain data directory files.


A flaw was found in the Keycloak admin console where the realm management interface permits a script to be set via the policy. This flaw allows an attacker with authenticated user and realm management permissions to configure a malicious script to trigger and execute arbitrary code with the permissions of the application user.


A vulnerability has been identified in TIA Portal V14 (All versions) TIA Portal V15 (All versions) TIA Portal V16 (All versions) TIA Portal V17 (All versions). Changing the contents of a configuration file could allow an attacker to execute arbitrary code with SYSTEM privileges. The security vulnerability could be exploited by an attacker with a valid account and limited access rights on the system. No user interaction is required. At the time of advisory publication no public exploitation of this security vulnerability was known.


SQL Injection in Advanced InfoData Systems (AIS) ESEL-Server 67 (which is the backend for the AIS logistics mobile app) allows an anonymous attacker to execute arbitrary code in the context of the user of the MSSQL database. The default user for the database is the 'sa' user.


A Reflected Cross Site Scripting vulnerability was found in all pki-core 10.x.x versions where the pki-ca module from the pki-core server. This flaw is caused by missing sanitization of the GET URL parameters. An attacker could abuse this flaw to trick an authenticated user into clicking a specially crafted link which can execute arbitrary code when viewed in a browser.


A path traversal flaw was found in spacewalk-proxy all versions through 2.9 in the way the proxy processes cached client tokens. A remote unauthenticated attacker could use this flaw to test the existence of arbitrary files if they have access to the proxy's filesystem or can execute arbitrary code in the context of the httpd process.


Grandstream GWN7000 before 1.0.6.32 devices allow remote authenticated users to execute arbitrary code via shell metacharacters in the filename in a /ubus/uci.apply update_nds_webroot_from_tmp API call.


A vulnerability has been identified in LOGO! Soft Comfort (All versions < V8.3). The vulnerability could allow an attacker to execute arbitrary code if the attacker tricks a legitimate user to open a manipulated project. In order to exploit the vulnerability a valid user must open a manipulated project file. No further privileges are required on the target system. The vulnerability could compromise the confidentiality integrity and availability of the engineering station. At the time of advisory publication no public exploitation of this security vulnerability was known.


Cross Site Request Forgery (CSRF) in the bolt/upload File Upload feature in Bolt CMS 3.6.6 allows remote attackers to execute arbitrary code by uploading a JavaScript file to include executable extensions in the file/edit/config/config.yml configuration file.


Grandstream UCM6204 before 1.0.19.20 devices allow remote authenticated users to execute arbitrary code via shell metacharacters in the backupUCMConfig file-backup parameter to the /cgi? URI.


Shell Metacharacter Injection in the package installer on Zyxel NAS 326 version 5.21 and below allows an authenticated attacker to execute arbitrary code via multiple different requests.


safer-eval before 1.3.2 are vulnerable to Arbitrary Code Execution. A payload using constructor properties can escape the sandbox and execute arbitrary code.


Jenkins Simple Travis Pipeline Runner Plugin 1.0 and earlier specifies unsafe values in its custom Script Security whitelist allowing attackers able to execute Script Security protected scripts to execute arbitrary code.


In WebAccess/SCADA Versions 8.3.5 and prior multiple untrusted pointer dereference vulnerabilities may allow a remote attacker to execute arbitrary code.


A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of property names in property expressions on the left-hand side of assignment expressions allowed attackers to execute arbitrary code in sandboxed scripts.


A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.62 and earlier related to the handling of subexpressions in increment and decrement expressions not involving actual assignment allowed attackers to execute arbitrary code in sandboxed scripts.


safer-eval before 1.3.4 are vulnerable to Arbitrary Code Execution. A payload using constructor properties can escape the sandbox and execute arbitrary code.


The CalDAV feature in httpd in Cyrus IMAP 2.5.x through 2.5.12 and 3.0.x through 3.0.9 allows remote attackers to execute arbitrary code via a crafted HTTP PUT operation for an event with a long iCalendar property name.


SPIP 3.1 before 3.1.10 and 3.2 before 3.2.4 allows authenticated visitors to execute arbitrary code on the host server because var_memotri is mishandled.


In Pulse Secure Pulse Connect Secure (PCS) before 8.1R15.1 8.2 before 8.2R12.1 8.3 before 8.3R7.1 and 9.0 before 9.0R3.4 and Pulse Policy Secure (PPS) before 5.1R15.1 5.2 before 5.2R12.1 5.3 before 5.3R15.1 5.4 before 5.4R7.1 and 9.0 before 9.0R3.2 an authenticated attacker (via the admin web interface) can exploit Incorrect Access Control to execute arbitrary code on the appliance.


An Unrestricted File Upload Vulnerability in the SupportCandy plugin through 2.0.0 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension.


Code42 Enterprise and Crashplan for Small Business Client version 6.7 before 6.7.5 6.8 before 6.8.8 and 6.9 before 6.9.4 allows eval injection. A proxy auto-configuration file crafted by a lesser privileged user may be used to execute arbitrary code at a higher privilege as the service user.


A issue was discovered in SiteServer CMS 6.9.0. It allows remote attackers to execute arbitrary code because an administrator can add the permitted file extension .aassp which is converted to .asp because the \as\ substring is deleted.


An attacker could have caused 4 bytes of HMAC output to be written past the end of a buffer stored on the stack. This could be used by an attacker to execute arbitrary code or more likely lead to a crash. This vulnerability affects Firefox < 70 Thunderbird < 68.2 and Firefox ESR < 68.2.


data/inc/files.php in Pluck 4.7.8 allows remote attackers to execute arbitrary code by uploading a .htaccess file that specifies SetHandler x-httpd-php for a .txt file because only certain PHP-related filename extensions are blocked.


Exim before 4.92.2 allows remote attackers to execute arbitrary code as root via a trailing backslash.


Multiple vulnerabilities in Cisco Webex Network Recording Player for Microsoft Windows and Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerabilities exist due to insufficient validation of certain elements with a Webex recording stored in either the Advanced Recording Format (ARF) or the Webex Recording Format (WRF). An attacker could exploit these vulnerabilities by sending a user a malicious ARF or WRF file through a link or email attachment and persuading the user to open the file with the affected software on the local system. A successful exploit could allow the attacker to execute arbitrary code on the affected system with the privileges of the targeted user.


Kaspersky Secure Connection Kaspersky Internet Security Kaspersky Total Security Kaspersky Security Cloud prior to version 2020 patch E have bug that allows a local user to execute arbitrary code via execution compromised file placed by an attacker with administrator rights. No privilege escalation. Possible whitelisting bypass some of the security products


In eslint-utils before 1.4.1 the getStaticValue function can execute arbitrary code.


An unrestricted file upload vulnerability in SITOS six Build v6.2.1 allows remote attackers to execute arbitrary code by uploading a SCORM file with an executable extension. This allows an unauthenticated attacker to upload a malicious file (containing PHP code to execute operating system commands) to the web root of the application.


A vulnerability in the implementation of the Lua interpreter integrated in Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated remote attacker to execute arbitrary code with root privileges on the underlying Linux operating system of an affected device. The vulnerability is due to insufficient restrictions on the allowed Lua function calls within the context of user-supplied Lua scripts. A successful exploit could allow the attacker to trigger a heap overflow condition and execute arbitrary code with root privileges on the underlying Linux operating system of an affected device.


Multiple file upload restriction bypass vulnerabilities in Sentrifugo 3.2 could allow authenticated users to execute arbitrary code via a webshell.


A

sandbox

bypass

vulnerability

exists

in

Jenkins

Job

DSL

Plugin

and

earlier

in

job-dsl-plugin/build.gradle

that

allows

attackers

with

control

over

Job

DSL

definitions

to

execute

arbitrary

code

on

the

Jenkins

master

JVM.


A

sandbox

bypass

vulnerability

exists

in

Jenkins

Pipeline:

Groovy

Plugin

and

earlier

in

pom.xml

that

allows

attackers

able

to

control

pipeline

scripts

to

execute

arbitrary

code

on

the

Jenkins

master

JVM.


A

sandbox

bypass

vulnerability

exists

in

Script

Security

Plugin

and

earlier

in

that

allows

attackers

with

the

ability

to

provide

sandboxed

scripts

to

execute

arbitrary

code

on

the

Jenkins

master

JVM.


A

sandbox

bypass

vulnerability

exists

in

Jenkins

Script

Security

Plugin

and

earlier

in

that

allows

attackers

with

Overall/Read

permission

to

execute

arbitrary

code

on

the

Jenkins

master

JVM.


A

sandbox

bypass

vulnerability

exists

in

Jenkins

Email

Extension

Plugin

and

earlier

in

pom.xml

that

allows

attackers

with

Job/Configure

permission

to

execute

arbitrary

code

on

the

Jenkins

master

JVM.


A flaw was discovered in jackson-databind in versions before 2.9.10 2.8.11.5 and 2.6.7.3 where it would permit polymorphic deserialization of a malicious object using commons-configuration 1 and 2 JNDI classes. An attacker could use this flaw to execute arbitrary code.


An

issue

was

discovered

in

in

TortoiseSVN

The

Tsvncmd:

URI

handler

allows

a

customised

diff

operation

on

Excel

workbooks

which

could

be

used

to

open

remote

workbooks

without

protection

from

macro

security

settings

to

execute

arbitrary

code.

A

tsvncmd:command:diff?path:file1?path2:file2

URI

will

execute

a

customised

diff

on

and

based

on

the

file

extension.

For

xls

files

it

will

execute

the

script

diff-xls.js

using

wscript

which

will

open

the

two

files

for

analysis

without

any

macro

security

warning.

An

attacker

can

exploit

this

by

putting

a

macro

virus

in

a

network

drive

and

force

the

victim

to

open

the

workbooks

and

execute

the

macro

inside.


A flaw was discovered in FasterXML jackson-databind in all versions before 2.9.10 and 2.10.0 where it would permit polymorphic deserialization of malicious objects using the xalan JNDI gadget when used in conjunction with polymorphic type handling methods such as `enableDefaultTyping()` or when @JsonTypeInfo is using `Id.CLASS` or `Id.MINIMAL_CLASS` or in any other way which ObjectMapper.readValue might instantiate objects from unsafe sources. An attacker could use this flaw to execute arbitrary code.


cPanel before 80.0.5 allows demo accounts to execute arbitrary code via ajax_maketext_syntax_util.pl (SEC-498).


Das Q before 2019-08-02 allows web sites to execute arbitrary code on client machines as demonstrated by a cross-origin /install request with an attacker-controlled releaseUrl which triggers download and execution of code within a ZIP archive.


The com.unity3d.kharma protocol handler in Unity Editor 2018.3 allows remote attackers to execute arbitrary code.


The web interface of the Vertiv Avocent UMG-4000 version 4.2.1.19 is vulnerable to reflected XSS in an HTTP POST parameter. The web application does not neutralize user-controllable input before displaying to users in a web page which could allow a remote attacker authenticated with a user account to execute arbitrary code.


An issue was discovered in baigo CMS 2.1.1. There is a vulnerability that allows remote attackers to execute arbitrary code. A BG_SITE_NAME parameter with malicious code can be written into the opt_base.inc.php file.


An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider (for example) file.jsp::$DATA to the admin/ueditor/uploadVideo URI.


Nagios IM (component of Nagios XI) before 2.2.7 allows authenticated users to execute arbitrary code via API key issues.


The PrinterLogic Print Management software versions up to and including 18.3.1.96 does not sanitize special characters allowing for remote unauthorized changes to configuration files. An unauthenticated attacker may be able to remotely execute arbitrary code with SYSTEM privileges.


An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider (for example) file.jsp::$DATA to the admin/ueditor/uploadFile URI.


Feng Office 3.7.0.5 allows remote attackers to execute arbitrary code via \<!--#exec cmd=\ in a .shtml file to ck_upload_handler.php.


An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider (for example) file.jsp::$DATA to the admin/comn/service/upload URI.


An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider (for example) file.jsp::$DATA to the admin/ueditor/uploadScrawl URI.


An issue was discovered in Pluck 4.7.9-dev1. It allows administrators to execute arbitrary code by using action=installmodule to upload a ZIP archive which is then extracted and executed.


The connection initiation process in March Networks Command Client before 2.7.2 allows remote attackers to execute arbitrary code via crafted XAML objects.


** DISPUTED ** An issue was discovered in Sitemagic CMS v4.4. In the index.php?SMExt=SMFiles URI the user can upload a .php file to execute arbitrary code as demonstrated by 404.php. This can only occur if the administrator neglects to set FileExtensionFilter and there are untrusted user accounts. NOTE: The maintainer states that this is not a vulnerability but a feature used in conjunction with External Modules.


An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider (for example) file.jsp::$DATA to the admin/ueditor/uploadImage URI.


Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 and Sitecore XP 7.5 to 8.2 allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.


Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in an HTTP POST parameter.


An issue was discovered in OFCMS before 1.1.3. Remote attackers can execute arbitrary code because blocking of .jsp and .jspx files does not consider (for example) file.jsp::$DATA to the admin/comn/service/editUploadImage URI.


The

Broadcom

brcmfmac

WiFi

driver

prior

to

commit

is

vulnerable

to

a

frame

validation

bypass.

If

the

brcmfmac

driver

receives

a

firmware

event

frame

from

a

remote

source

the

function

will

cause

this

frame

to

be

discarded

and

unprocessed.

If

the

driver

receives

the

firmware

event

frame

from

the

host

the

appropriate

handler

is

called.

This

frame

validation

can

be

bypassed

if

the

bus

used

is

USB

(for

instance

by

a

wifi

dongle).

This

can

allow

firmware

event

frames

from

a

remote

source

to

be

processed.

In

the

worst

case

scenario

by

sending

specially-crafted

WiFi

packets

a

remote

unauthenticated

attacker

may

be

able

to

execute

arbitrary

code

on

a

vulnerable

system.

More

typically

this

vulnerability

will

result

in

denial-of-service

conditions.


Reflected XSS in interface/forms/eye_mag/view.php in OpenEMR 5.x before 5.0.2.1 allows a remote attacker to execute arbitrary code in the context of a user's session via the pid parameter.


The network protocol of Blade Shadow though 2.13.3 allows remote attackers to take control of a Shadow instance and execute arbitrary code by only knowing the victim's IP address because packet data can be injected into the unencrypted UDP packet stream.


Code42 server through 7.0.2 for Windows has an Untrusted Search Path. In certain situations a non-administrative attacker on the local server could create or modify a dynamic-link library (DLL). The Code42 service could then load it at runtime and potentially execute arbitrary code at an elevated privilege on the local server.


A vulnerability in the loading mechanism of specific dynamic link libraries in Cisco Webex Teams for Windows could allow an authenticated local attacker to perform a DLL hijacking attack. To exploit this vulnerability the attacker would need to have valid credentials on the Windows system. The vulnerability is due to insufficient validation of the resources loaded by the application at run time. An attacker could exploit this vulnerability by crafting a malicious DLL file and placing it in a specific location on the targeted system. The malicious DLL file would execute when the vulnerable application is launched. A successful exploit could allow the attacker to execute arbitrary code on the target machine with the privileges of another user account.


Code42 app through version 7.0.2 for Windows has an Untrusted Search Path. In certain situations a non-administrative attacker on the local machine could create or modify a dynamic-link library (DLL). The Code42 service could then load it at runtime and potentially execute arbitrary code at an elevated privilege on the local machine.


Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.6.0.25114. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of script within a Calculate action of a text field. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9044.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.6.0.25114. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the conversion of DXF files to PDF. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9276.


Weak file permissions applied to the Aviatrix VPN Client through 2.2.10 installation directory on Windows and Linux allow a local attacker to execute arbitrary code by gaining elevated privileges through file modifications.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.6.0.25114. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the OnFocus event. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9091.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.6.0.25114. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the conversion of DWG files to PDF. The issue results from the lack of proper validation of user-supplied data which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9274.


An

untrusted

deserialization

was

found

in

the

org.apache.xmlrpc.parser.XmlRpcResponseParser:addResult

method

of

Apache

XML-RPC

(aka

ws-xmlrpc)

library.

A

malicious

XML-RPC

server

could

target

a

XML-RPC

client

causing

it

to

execute

arbitrary

code.

Apache

XML-RPC

is

no

longer

maintained

and

this

issue

will

not

be

fixed.


minPlayCommand.php in Centreon Web before 2.8.27 allows authenticated attackers to execute arbitrary code via the command_hostaddress parameter. NOTE: some sources have listed CVE-2019-17017 for this but that is incorrect.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.5.0.20723. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the conversion of DXF files to PDF. The issue results from the lack of proper validation of user-supplied data which can result in a read past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-8776.


parserIfLabel in inc/zzz_template.php in ZZZCMS zzzphp 1.7.3 allows remote attackers to execute arbitrary code because the danger_key function can be bypassed via manipulations such as strtr.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.6.0.25114. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of script within a Keystroke action of a listbox field. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9081.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of D-Link DCS-960L v1.07.102. Authentication is not required to exploit this vulnerability. The specific flaw exists within the HNAP service which listens on TCP port 80 by default. When parsing the SOAPAction request header the process does not properly validate the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the admin user. Was ZDI-CAN-8458.


An Untrusted Search Path vulnerability in bdserviceshost.exe as used in Bitdefender Total Security 2020 allows an attacker to execute arbitrary code. This issue does not affect: Bitdefender Total Security versions prior to 24.0.12.69.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.5.0.20723. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of Javascript in the HTML2PDF plugin. The issue results from the lack of proper validation of user-supplied data which can result in a write past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-8692.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of TP-LINK TL-WR841N routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web service which listens on TCP port 80 by default. When parsing the Host request header the process does not properly validate the length of user-supplied data prior to copying it to a fixed-length static buffer. An attacker can leverage this vulnerability to execute code in the context of the admin user. Was ZDI-CAN-8457.


A memory initialization issue was addressed with improved memory handling. This issue is fixed in macOS Mojave 10.14.6 Security Update 2019-004 High Sierra Security Update 2019-004 Sierra. A malicious application may be able to execute arbitrary code with system privileges.


In Indexhibit 2.1.5 remote attackers can execute arbitrary code via the v parameter (in conjunction with the id parameter) in a upd_jxcode=true action to the ndxzstudio/?a=system URI.


A use after free issue was addressed with improved memory management. This issue is fixed in watchOS 5.2 macOS Mojave 10.14.4 Security Update 2019-002 High Sierra Security Update 2019-002 Sierra iOS 12.2. An application may be able to execute arbitrary code with kernel privileges.


A validation issue existed in the entitlement verification. This issue was addressed with improved validation of the process entitlement. This issue is fixed in macOS Catalina 10.15.1. An application may be able to execute arbitrary code with system privileges.


In Magento to 1.9.4.3 and Magento prior to 1.14.4.3 an authenticated user with administrative privileges for editing attribute sets can execute arbitrary code through custom layout modification.


In Magento prior to 1.9.4.3 and Magento prior to 1.14.4.3 an authenticated user with administrative privileges to edit product attributes can execute arbitrary code through crafted layout updates.


Multiple input validation issues existed in MIG generated code. These issues were addressed with improved validation. This issue is fixed in iOS 12.2 macOS Mojave 10.14.4 tvOS 12.2 watchOS 5.2. A malicious application may be able to execute arbitrary code with system privileges.


Multiple unrestricted file upload vulnerabilities in (1) media-upload.php (2) media-upload-lncthumb.php and (3) media-upload-sq_button.php in lib/admin/ in the OptimizePress theme before 1.61 for WordPress allow remote attackers to execute arbitrary code by uploading a file with an executable extension then accessing it via a direct request to the file in images_comingsoon images_lncthumbs or images_optbuttons in wp-content/uploads/optpress/ as exploited in the wild in November 2013.


Unrestricted file upload vulnerability in AgentLogUploadServlet in ManageEngine DesktopCentral 7.x and 8.0.0 before build 80293 allows remote attackers to execute arbitrary code by uploading a file with a jsp extension then accessing it via a direct request to the file in the webroot.


Slackware 14.0 and 14.1 and Slackware LLVM 3.0-i486-2 and 3.3-i486-2 contain world-writable permissions on the /tmp directory which could allow remote attackers to execute arbitrary code with root privileges.


ack 2.00 through 2.11_02 allows remote attackers to execute arbitrary code via a (1) --pager (2) --regex or (3) --output option in a .ackrc file in a directory to be searched.


Slackware 13.1 13.37 14.0 and 14.1 contain world-writable permissions on the iodbctest and iodbctestw programs within the libiodbc package which could allow local users to use RPATH information to execute arbitrary code with root privileges.


Ice Cold Apps Servers Ultimate 6.0.2(12) does not require authentication for TELNET SSH or FTP which allows remote attackers to execute arbitrary code by uploading PHP scripts.


The firmware on GateHouse; Harris BGAN RF-7800B-VU204 and BGAN RF-7800B-DU204; Hughes Network Systems 9201 9450 and 9502; Inmarsat; Japan Radio JUE-250 and JUE-500; and Thuraya IP satellite terminals does not require authentication for sessions on TCP port 1827 which allows remote attackers to execute arbitrary code via unspecified protocol operations.


SAP

Sybase

Adaptive

Server

Enterprise

(ASE)

before

before

and

before

or

allows

remote

authenticated

users

to

execute

arbitrary

code

via

unspecified

vectors

aka


The Belkin WeMo Home Automation firmware before 3949 has a hardcoded GPG key which makes it easier for remote attackers to spoof firmware updates and execute arbitrary code via crafted signed data.


The Web Console in HP Application Information Optimizer (formerly HP Database Archiving) 6.2 6.3 6.4 7.0 and 7.1 allows remote attackers to execute arbitrary code or obtain sensitive information via unspecified vectors aka ZDI-CAN-2004.


Uscan in devscripts before 2.13.9 allows remote attackers to execute arbitrary code via a crafted tarball.


Unrestricted file upload vulnerability in the Worksheet designer in SpagoBI before 4.1 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension then accessing it via a direct request to the file in an unspecified directory aka \XSS File Upload.\


The Updater in Rackspace Openstack Windows Guest Agent for XenServer before 1.2.6.0 allows remote attackers to execute arbitrary code via a crafted serialized .NET object to TCP port 1984 which triggers the download and extraction of a ZIP file that overwrites the Agent service binary.


SAP Sybase Adaptive Server Enterprise (ASE) before 15.0.3 ESD#4.3 15.5 before 15.5 ESD#5.3 and 15.7 before 15.7 SP50 or 15.7 SP100 allows remote authenticated users to execute arbitrary code via unspecified vectors aka CR736689.


The Web Console in HP Application Information Optimizer (formerly HP Database Archiving) 6.2 6.3 6.4 7.0 and 7.1 allows remote attackers to execute arbitrary code or obtain sensitive information via unspecified vectors aka ZDI-CAN-1656.


webman/imageSelector.cgi in Synology DiskStation Manager (DSM) 4.0 before 4.0-2259 4.2 before 4.2-3243 and 4.3 before 4.3-3810 Update 1 allows remote attackers to append data to arbitrary files and consequently execute arbitrary code via a pathname in the SLICEUPLOAD X-TMP-FILE HTTP header.


Unspecified vulnerability in Virtual User Generator in HP LoadRunner before 11.52 Patch 1 allows remote attackers to execute arbitrary code via unknown vectors aka ZDI-CAN-1833.


The server in Brocade Network Advisor before 12.1.0 as used in EMC Connectrix Manager Converged Network Edition (CMCNE) HP B-series SAN Network Advisor and possibly other products allows remote attackers to execute arbitrary code by using a servlet to upload an executable file.


Unrestricted file upload vulnerability in plugins/editor.zoho/agent/save_zoho.php in the Zoho plugin in Pydio (formerly AjaXplorer) before 5.0.4 allows remote attackers to execute arbitrary code by uploading an executable file and then accessing this file at a location specified by the format parameter of a move operation.


The nsGfxScrollFrameInner::IsLTR function in Mozilla Firefox before 26.0 Firefox ESR 24.x before 24.2 Thunderbird before 24.2 and SeaMonkey before 2.23 allows remote attackers to execute arbitrary code via crafted use of JavaScript code for ordered list elements.


The Groovy script console in VMware Hyperic HQ 4.6.6 allows remote authenticated administrators to execute arbitrary code via a Runtime.getRuntime().exec call.


steps/utils/save_pref.inc in Roundcube webmail before 0.8.7 and 0.9.x before 0.9.5 allows remote attackers to modify configuration settings via the _session parameter which can be leveraged to read arbitrary files conduct SQL injection attacks and execute arbitrary code.


The setgid wrapper libx2go-server-db-sqlite3-wrapper.c in X2Go Server before 4.0.0.2 allows remote attackers to execute arbitrary code via unspecified vectors related to the path to libx2go-server-db-sqlite3-wrapper.pl.


UpdateDomainControllerServlet in the SNAC registration server in HP ProCurve Manager (PCM) 3.20 and 4.0 PCM+ 3.20 and 4.0 and Identity Driven Manager (IDM) 4.0 does not properly validate the adCert argument which allows remote attackers to upload .jsp files and consequently execute arbitrary code via unspecified vectors aka ZDI-CAN-1743.


The virtio_scsi_load_request function in hw/scsi/scsi-bus.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a crafted savevm image which triggers an out-of-bounds array access.


Unspecified vulnerability in Virtual User Generator in HP LoadRunner before 11.52 allows remote attackers to execute arbitrary code via unknown vectors aka ZDI-CAN-1850.


Multiple

unspecified

vulnerabilities

in

in

JOAL

as

used

in

JOGAMP

allow

context-dependent

attackers

to

execute

arbitrary

code

via

a

crafted

parameter

to

the

alGetProcAddressStatic

or

method

in

jogamp.openal.ALImpl.dispatch.


HP Service Manager 9.30 through 9.32 allows remote attackers to execute arbitrary code via an unspecified \injection\ approach.


Unrestricted file upload vulnerability in the avatar upload functionality in Simple Machines Forum before 2.0.6 and 2.1 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension then accessing it via a direct request to the file in an unspecified directory.


Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications which allows attackers to execute arbitrary code via an application package file (APK) that is modified in a way that does not violate the cryptographic signature probably involving multiple entries in a Zip file with the same name in which one entry is validated but the other entry is installed aka Android security bug 8219321 and the \Master Key\ vulnerability.


The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag which allows remote attackers to execute arbitrary code via a crafted string that triggers an eval operation.


HP ProCurve Manager (PCM) 3.20 and 4.0 PCM+ 3.20 and 4.0 Identity Driven Manager (IDM) 4.0 and Application Lifecycle Management allow remote attackers to execute arbitrary code via a marshalled object to (1) EJBInvokerServlet or (2) JMXInvokerServlet aka ZDI-CAN-1760. NOTE: this is probably a duplicate of CVE-2007-1036 CVE-2010-0738 and/or CVE-2012-0874.


wp-includes/functions.php in WordPress before 3.6.1 does not properly determine whether data has been serialized which allows remote attackers to execute arbitrary code by triggering erroneous PHP unserialize operations.


RichFaces implementation in Nuxeo Platform 5.6.0 before HF27 and 5.8.0 before HF-01 does not restrict the classes for which deserialization methods can be called which allows remote attackers to execute arbitrary code via crafted serialized data. NOTE: this vulnerability may overlap CVE-2013-2165.


Unspecified vulnerability in Virtual User Generator in HP LoadRunner before 11.52 allows remote attackers to execute arbitrary code via unknown vectors aka ZDI-CAN-1832.


The ssi_sd_transfer function in hw/sd/ssi-sd.c in QEMU before 1.7.2 allows remote attackers to execute arbitrary code via a crafted arglen value in a savevm image.


The default configuration of Parallels Plesk Panel 9.0.x and 9.2.x on UNIX and Small Business Panel 10.x on UNIX has an improper ScriptAlias directive for phppath which makes it easier for remote attackers to execute arbitrary code via a crafted request a different vulnerability than CVE-2012-1823.


The usb_device_post_load function in hw/usb/bus.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a crafted savevm image related to a negative setup_len or setup_index value.


UpdateCertificatesServlet in the SNAC registration server in HP ProCurve Manager (PCM) 3.20 and 4.0 PCM+ 3.20 and 4.0 and Identity Driven Manager (IDM) 4.0 does not properly validate the fileName argument which allows remote attackers to upload .jsp files and consequently execute arbitrary code via unspecified vectors aka ZDI-CAN-1743.


GitLab 5.0 before 5.4.2 Community Edition before 6.2.4 Enterprise Edition before 6.2.1 and gitlab-shell before 1.7.8 allows remote attackers to execute arbitrary code via a crafted change using SSH.


Unspecified vulnerability in dbd_manager in LeftHand OS before 11.0 in HP StoreVirtual 4000 and StoreVirtual VSA Software (formerly LeftHand Virtual SAN Appliance) allows remote attackers to execute arbitrary code via unknown vectors aka ZDI-CAN-1509.


The virtio_load function in virtio/virtio.c in QEMU 1.x before 1.7.2 allows remote attackers to execute arbitrary code via a crafted savevm image which triggers an out-of-bounds write.


Unrestricted file upload vulnerability in the user profile page feature in the Timeline Plugin 4.2.5p9 for SocialEngine allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension then accessing it via a direct request to the file in public/temporary/timeline/.


The DiagnosticsHandler in JGroup 3.0.x 3.1.x 3.2.x before 3.2.9 and 3.3.x before 3.3.3 allows remote attackers to obtain sensitive information (diagnostic information) and execute arbitrary code by reusing valid credentials.


Unrestricted file upload vulnerability in multi.php in Simple Dropbox Upload plugin before 1.8.8.1 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension then accessing it via a direct request to the file in wp-content/uploads/wpdb/.


The com.ibm.rmi.io.SunSerializableFactory class in IBM Java SDK 7.0.0 before SR6 allows remote attackers to bypass a sandbox protection mechanism and execute arbitrary code via vectors related to deserialization inside the AccessController doPrivileged block.


Graphite 0.9.5 through 0.9.10 uses the pickle Python module unsafely which allows remote attackers to execute arbitrary code via a crafted serialized object related to (1) remote_storage.py (2) storage.py (3) render/datalib.py and (4) whitelist/views.py a different vulnerability than CVE-2013-5093.


Use-after-free vulnerability in the nsEventListenerManager::SetEventHandler function in Mozilla Firefox before 25.0 Firefox ESR 17.x before 17.0.10 and 24.x before 24.1 Thunderbird before 24.1 Thunderbird ESR 17.x before 17.0.10 and SeaMonkey before 2.22 allows remote attackers to execute arbitrary code via vectors related to a memory allocation through the garbage collection (GC) API.


The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python module unsafely which allows remote attackers to execute arbitrary code via a crafted serialized object.


hxds.dll in Microsoft Office 2007 SP3 and 2010 SP1 and SP2 does not implement the ASLR protection mechanism which makes it easier for remote attackers to execute arbitrary code via a crafted COM component on a web site that is visited with Internet Explorer as exploited in the wild in December 2013 aka \HXDS ASLR Vulnerability.\


Use-after-free

vulnerability

in

the

nsIOService::NewChannelFromURIWithProxyFlags

function

in

Mozilla

Firefox

before

Firefox

ESR

before

and

before

Thunderbird

before

Thunderbird

ESR

before

and

SeaMonkey

before

allows

remote

attackers

to

execute

arbitrary

code

via

vectors

involving

a

blob:

URL.


Use-after-free vulnerability in the nsNodeUtils::LastRelease function in the table-editing user interface in the editor component in Mozilla Firefox before 26.0 Firefox ESR 24.x before 24.2 Thunderbird before 24.2 and SeaMonkey before 2.23 allows remote attackers to execute arbitrary code by triggering improper garbage collection.


IBM SPSS Analytical Decision Management 6.1 before IF1 6.2 before IF1 and 7.0 before FP1 IF6 might allow remote attackers to execute arbitrary code by deploying and accessing a service.


Unrestricted file upload vulnerability in frames/upload-images.php in the Complete Gallery Manager plugin before 3.3.4 rev40279 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension then accessing it via a direct request to the file in wp-content/year/month/.


VhttpdMgr in Thomson Reuters Velocity Analytics Vhayu Analytic Server 6.94 build 2995 allows remote attackers to execute arbitrary code via a URL in the fileName parameter during an importFile action.


The Square Squash allows remote attackers to execute arbitrary code via a YAML document in the (1) namespace parameter to the deobfuscation function or (2) sourcemap parameter to the sourcemap function in app/controllers/api/v1_controller.rb.


Microsoft SharePoint Server 2010 SP1 and SP2 and 2013 and Office Web Apps 2013 allows remote attackers to execute arbitrary code via crafted page content aka \SharePoint Page Content Vulnerabilities.\


Unspecified vulnerability in JustSystems Ichitaro 2006 through 2011; Ichitaro Government 6 7 and 2006 through 2010; Ichitaro 2011 Sou; Ichitaro 2012 Shou; Ichitaro 2013 Gen and Gen Trial Edition; Ichitaro Pro; Ichitaro Pro 2 and Pro 2 Trial Edition; Ichitaro Viewer; and Ichitaro Portable with oreplug allows remote attackers to execute arbitrary code via a crafted document.


Adobe Flash Player before 11.7.700.257 and 11.8.x and 11.9.x before 11.9.900.170 on Windows and Mac OS X and before 11.2.202.332 on Linux Adobe AIR before 3.9.0.1380 Adobe AIR SDK before 3.9.0.1380 and Adobe AIR SDK & Compiler before 3.9.0.1380 allow remote attackers to execute arbitrary code via crafted .swf content that leverages an unspecified \type confusion \ as exploited in the wild in December 2013.


Unrestricted file upload vulnerability in system/controllers/ajax/attachments.php in Sharetronix 3.1.1.3 3.1.1 and earlier allows remote attackers to execute arbitrary code by uploading a file with an executable extension then accessing it via a direct request to the file in an unspecified directory.


Microsoft Publisher 2003 SP3 does not properly check the data type of an unspecified return value which allows remote attackers to execute arbitrary code via a crafted Publisher file aka \Publisher Return Value Validation Vulnerability.\


The USB kernel-mode drivers in Microsoft Windows XP SP2 and SP3 Windows Server 2003 SP2 Windows Vista SP2 Windows Server 2008 SP2 R2 and R2 SP1 Windows 7 Gold and SP1 Windows 8 and Windows Server 2012 do not properly handle objects in memory which allows physically proximate attackers to execute arbitrary code by connecting a crafted USB device aka \Windows USB Descriptor Vulnerability \ a different vulnerability than CVE-2013-1286 and CVE-2013-1287.


Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object aka \Internet Explorer Use After Free Vulnerability \ a different vulnerability than CVE-2013-1309 and CVE-2013-2551.


The Print Spooler in Microsoft Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8 Windows Server 2012 and Windows RT does not properly manage memory during deletion of printer connections which allows remote authenticated users to execute arbitrary code via a crafted request aka \Print Spooler Vulnerability.\


The HTTP Profiling functionality on Cisco Wireless LAN Controller (WLC) devices with software 7.3.101.0 allows remote authenticated users to execute arbitrary code via a crafted HTTP User-Agent header aka Bug ID CSCuc15636.


The Dragonfly gem 0.7 before 0.8.6 and 0.9.x before 0.9.13 for Ruby when used with Ruby on Rails allows remote attackers to execute arbitrary code via a crafted request.


Microsoft Internet Explorer 8 does not properly handle objects in memory which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly allocated or (2) is deleted as exploited in the wild in May 2013.


Use-after-free vulnerability in the JS_GetGlobalForScopeChain function in Mozilla Firefox before 24.0 Thunderbird before 24.0 and SeaMonkey before 2.21 allows remote attackers to execute arbitrary code by leveraging incorrect garbage collection in situations involving default compartments and frame-chain restoration.


Microsoft Publisher 2003 SP3 allows remote attackers to execute arbitrary code via a crafted Publisher file that triggers access to an invalid pointer aka \Publisher Corrupt Interface Pointer Vulnerability.\


Microsoft Word 2003 SP3 and Word Viewer allow remote attackers to execute arbitrary code via crafted shape data in a Word document aka \Word Shape Corruption Vulnerability.\


The JMX Remoting functionality in Apache Geronimo 3.x before 3.0.1 as used in IBM WebSphere Application Server (WAS) Community Edition 3.0.0.3 and other products does not properly implement the RMI classloader which allows remote attackers to execute arbitrary code by using the JMX connector to send a crafted serialized object.


Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object aka \Internet Explorer Use After Free Vulnerability \ a different vulnerability than CVE-2013-1303 and CVE-2013-1338.


The Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier and OpenJDK 6 and 7 allows remote attackers to execute arbitrary code via unspecified vectors involving reflection Libraries \improper toString calls \ and the JDBC driver manager as demonstrated by James Forshaw during a Pwn2Own competition at CanSecWest 2013.


The (1) template and (2) inline_template functions in the master server in Puppet before 2.6.18 2.7.x before 2.7.21 and 3.1.x before 3.1.1 and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2 allows remote authenticated users to execute arbitrary code via a crafted catalog request.


The default configuration of Microsoft SharePoint Portal Server 2003 SP3 SharePoint Server 2007 SP3 and 2010 SP1 and SP2 and Office Web Apps 2010 does not set the EnableViewStateMac attribute which allows remote attackers to execute arbitrary code by leveraging an unassigned workflow aka \MAC Disabled Vulnerability.\


Microsoft Publisher 2003 SP3 does not properly check the return value of an unspecified method which allows remote attackers to execute arbitrary code via a crafted Publisher file aka \Publisher Return Value Handling Vulnerability.\


Use-after-free vulnerability in Mozilla Firefox before 21.0 Firefox ESR 17.x before 17.0.6 Thunderbird before 17.0.6 and Thunderbird ESR 17.x before 17.0.6 allows remote attackers to execute arbitrary code via vectors involving an onresize event during the playing of a video.


Microsoft Publisher 2003 SP3 2007 SP3 and 2010 SP1 allows remote attackers to execute arbitrary code via a crafted Publisher file that triggers incorrect pointer handling aka \Publisher Pointer Handling Vulnerability.\


The Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier 6 Update 43 and earlier 5.0 Update 41 and earlier and JavaFX 2.2.7 and earlier allows remote attackers to execute arbitrary code via vectors related to 2D as demonstrated by Joshua Drake during a Pwn2Own competition at CanSecWest 2013.


Mozilla Firefox before 24.0 Firefox ESR 17.x before 17.0.9 Thunderbird before 24.0 Thunderbird ESR 17.x before 17.0.9 and SeaMonkey before 2.21 do not ensure that initialization occurs for JavaScript objects with compartments which allows remote attackers to execute arbitrary code by leveraging incorrect scope handling.


Opera before 12.13 allows remote attackers to execute arbitrary code via vectors involving DOM events.


The IcedTea-Web plugin before 1.2.3 and 1.3.x before 1.3.2 allows remote attackers to execute arbitrary code via a crafted file that validates as both a GIF and a Java JAR file aka \GIFAR.\


Puppet 2.7.x before 2.7.21 and 3.1.x before 3.1.1 when running Ruby 1.9.3 or later allows remote attackers to execute arbitrary code via vectors related to \serialized attributes.\


Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object aka \Internet Explorer Use After Free Vulnerability \ a different vulnerability than CVE-2013-1308 and CVE-2013-2551.


Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object aka \Internet Explorer Use After Free Vulnerability \ a different vulnerability than CVE-2013-1303 and CVE-2013-1304.


Use-after-free vulnerability in the mozilla::layout::ScrollbarActivity function in Mozilla Firefox before 24.0 Firefox ESR 17.x before 17.0.9 Thunderbird before 24.0 Thunderbird ESR 17.x before 17.0.9 and SeaMonkey before 2.21 allows remote attackers to execute arbitrary code via vectors related to image-document scrolling.


Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object aka \Internet Explorer Use After Free Vulnerability \ a different vulnerability than CVE-2013-1304 and CVE-2013-1338.


The BrokerFactory functionality in Apache OpenJPA 1.x before 1.2.3 and 2.x before 2.2.2 creates local executable JSP files containing logging trace data produced during deserialization of certain crafted OpenJPA objects which makes it easier for remote attackers to execute arbitrary code by creating a serialized object and leveraging improperly secured server programs.


Untrusted search path vulnerability in Lenovo Thinkpad Bluetooth with Enhanced Data Rate Software 6.4.0.2900 and earlier allows local users and possibly remote attackers to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse DLL that is located in the same folder as a file that is processed by Lenovo Bluetooth.


Use-after-free vulnerability in Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object aka \Internet Explorer Use After Free Vulnerability \ a different vulnerability than CVE-2013-0811.


Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier 6 Update 43 and earlier and 5.0 Update 41 and earlier; and OpenJDK 6 and 7; allows remote attackers to affect confidentiality integrity and availability via vectors related to RMI. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from another vendor that this issue is related to the default java.rmi.server.useCodebaseOnly setting of false which allows remote attackers to perform \dynamic class downloading\ and execute arbitrary code.


Microsoft Publisher 2003 SP3 does not properly check table range data which allows remote attackers to execute arbitrary code via a crafted Publisher file aka \Publisher Invalid Range Check Vulnerability.\


The USB kernel-mode drivers in Microsoft Windows XP SP2 and SP3 Windows Server 2003 SP2 Windows Vista SP2 Windows Server 2008 SP2 R2 and R2 SP1 Windows 7 Gold and SP1 Windows 8 and Windows Server 2012 do not properly handle objects in memory which allows physically proximate attackers to execute arbitrary code by connecting a crafted USB device aka \Windows USB Descriptor Vulnerability \ a different vulnerability than CVE-2013-1285 and CVE-2013-1287.


Puppet before 2.6.18 2.7.x before 2.7.21 and 3.1.x before 3.1.1 and Puppet Enterprise before 1.2.7 and 2.7.x before 2.7.2 when listening for incoming connections is enabled and allowing access to the \run\ REST endpoint is allowed allows remote authenticated users to execute arbitrary code via a crafted HTTP request.


Microsoft Publisher 2003 SP3 does not properly handle NULL values for unspecified data items which allows remote attackers to execute arbitrary code via a crafted Publisher file aka \Publisher Incorrect NULL Value Handling Vulnerability.\


The USB kernel-mode drivers in Microsoft Windows XP SP2 and SP3 Windows Server 2003 SP2 Windows Vista SP2 Windows Server 2008 SP2 R2 and R2 SP1 Windows 7 Gold and SP1 Windows 8 and Windows Server 2012 do not properly handle objects in memory which allows physically proximate attackers to execute arbitrary code by connecting a crafted USB device aka \Windows USB Descriptor Vulnerability \ a different vulnerability than CVE-2013-1285 and CVE-2013-1286.


Microsoft Publisher 2003 SP3 does not properly validate the size of an unspecified array which allows remote attackers to execute arbitrary code via a crafted Publisher file aka \Publisher Negative Value Allocation Vulnerability.\


Use-after-free vulnerability in Adobe Flash Player before 10.3.183.63 and 11.x before 11.6.602.168 on Windows before 10.3.183.61 and 11.x before 11.6.602.167 on Mac OS X before 10.3.183.61 and 11.x before 11.2.202.270 on Linux before 11.1.111.43 on Android 2.x and 3.x and before 11.1.115.47 on Android 4.x; Adobe AIR before 3.6.0.597; and Adobe AIR SDK before 3.6.0.599 allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2013-0644 and CVE-2013-0649.


The Tomcat Web Management feature in Cisco Unified Customer Voice Portal (CVP) Software before 9.0.1 ES 11 does not properly configure Tomcat components which allows remote attackers to execute arbitrary code via a crafted (1) HTTP or (2) HTTPS request aka Bug ID CSCub38384.


Microsoft Communicator 2007 R2 Lync 2010 Lync 2010 Attendee and Lync Server 2013 do not properly handle objects in memory which allows remote attackers to execute arbitrary code via an invitation that triggers access to a deleted object aka \Lync RCE Vulnerability.\


Use-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object aka \Internet Explorer Use After Free Vulnerability \ a different vulnerability than CVE-2013-1313.


Opera before 12.13 allows remote attackers to execute arbitrary code via crafted clipPaths in an SVG document.


Adobe Reader and Acrobat 9.x before 9.5.3 10.x before 10.1.5 and 11.x before 11.0.1 allow attackers to execute arbitrary code via unspecified vectors related to a \logic error \ a different vulnerability than CVE-2013-0608 CVE-2013-0611 CVE-2013-0614 and CVE-2013-0618.


Use-after-free vulnerability in Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object aka \Internet Explorer Use After Free Vulnerability \ a different vulnerability than CVE-2013-1307.


Unspecified vulnerability in the 2D component in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 15 and earlier 6 Update 41 and earlier and 5.0 Update 40 and earlier allows remote attackers to execute arbitrary code via unknown vectors a different vulnerability than CVE-2013-1493.


Unspecified vulnerability in the ExternalInterface ActionScript functionality in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X and before 10.3.183.67 and 11.x before 11.2.202.273 on Linux allows remote attackers to execute arbitrary code via crafted SWF content as exploited in the wild in February 2013.