A flaw was found in Moodle versions 3.8 before 3.8.3 3.7 before 3.7.6 3.6 before 3.6.10 3.5 before 3.5.12 and earlier unsupported versions. It was possible to create a SCORM package in such a way that when added to a course it could be interacted with via web services in order to achieve remote code execution.


An issue was discovered in the MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 software in all versions through 2.5.0. There is an unauthenticated remote code execution in the com_mb24sysapi module.


The Filemanager in CMS Made Simple 2.2.13 allows remote code execution via a .php.jpegd JPEG file as demonstrated by m1_files to admin/moduleinterface.php. The file should be sent as application/octet-stream and contain PHP code (it need not be a valid JPEG file).


FrozenNode Laravel-Administrator through 5.0.12 allows unrestricted file upload (and consequently Remote Code Execution) via admin/tips_image/image/file_upload image upload with PHP content within a GIF image that has the .php extension. NOTE: this product is discontinued.


Sonatype Nexus Repository before 3.21.2 allows Remote Code Execution.


A remote code execution vulnerability in UCB component of Mitel MiVoice Connect before 19.1 SP1 could allow an unauthenticated remote attacker to execute arbitrary scripts due to insufficient validation of URL parameters. A successful exploit could allow an attacker to gain access to sensitive information.


Gira TKS-IP-Gateway 4.0.7.7 is vulnerable to authenticated remote code execution via the backup functionality of the web frontend. This can be combined with CVE-2020-10794 for remote root access.


The sitepress-multilingual-cms (WPML) plugin before 4.3.7-b.2 for WordPress has CSRF due to a loose comparison. This leads to remote code execution in includes/class-wp-installer.php via a series of requests that leverage unintended comparisons of integers to strings.


The restapps (aka Rest Phone apps) module for Sangoma FreePBX and PBXact 13 14 and 15 through 15.0.19.2 allows remote code execution via a URL variable to an AMI command.


u'Remote

code

execution

can

happen

by

sending

a

carefully

crafted

POST

query

when

Device

configuration

is

accessed

from

a

tethered

client

through

webserver

due

to

lack

of

array

bound

check.'

in

Snapdragon

Auto

Snapdragon

Compute

Snapdragon

Consumer

IOT

Snapdragon

Industrial

IOT

Snapdragon

Mobile

Snapdragon

Voice

Music

Snapdragon

Wearables

Snapdragon

Wired

Infrastructure

and

Networking

in


A Remote Code Execution(RCE) vulnerability exists in some designated applications in ServiSign security plugin as long as the interface is captured attackers are able to launch RCE and executes arbitrary command on target system via malicious crafted scripts.


OpenSLP as used in VMware ESXi (7.0 before ESXi_7.0.1-0.0.16850804 6.7 before ESXi670-202010401-SG 6.5 before ESXi650-202010401-SG) has a use-after-free issue. A malicious actor residing in the management network who has access to port 427 on an ESXi machine may be able to trigger a use-after-free in the OpenSLP service resulting in remote code execution.


The Apros Evolution ConsciusMap and Furukawa provisioning systems through 2.8.1 allow remote code execution because of javax.faces.ViewState Java deserialization.


A specially crafted communication packet sent to the affected systems could cause a denial-of-service condition or allow remote code execution. This issue affects: Mitsubishi Electric MC Works64 version 4.02C (10.95.208.31) and earlier all versions; MC Works32 version 3.00A (9.50.255.02); ICONICS GenBroker64 Platform Services Workbench FrameWorX Server version 10.96 and prior; GenBroker32 version 9.5 and prior.


An issue was discovered in Gigamon GigaVUE 5.5.01.11. The upload functionality allows an arbitrary file upload for an authenticated user. If an executable file is uploaded into the www-root directory then it could yield remote code execution via the filename parameter.


PLCopen XML file parsing in Phoenix Contact PC Worx and PC Worx Express version 1.87 and earlier can lead to a stack-based overflow. Manipulated PC Worx projects could lead to a remote code execution due to insufficient input data validation.


The mappress-google-maps-for-wordpress plugin before 2.53.9 for WordPress does not correctly implement AJAX functions with nonces (or capability checks) leading to remote code execution.


An issue was discovered in OpenNMS Horizon before 26.0.1 and Meridian before 2018.1.19 and 2019 before 2019.1.7. The ActiveMQ channel configuration allowed for arbitrary deserialization of Java objects (aka ActiveMQ Minion payload deserialization) leading to remote code execution for any authenticated channel user regardless of its assigned permissions.


An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. checkout.c mishandles equivalent filenames that exist because of NTFS short names. This may allow remote code execution when cloning a repository. This issue is similar to CVE-2019-1353.


An issue was discovered in SmartBear ReadyAPI SoapUI Pro 3.2.5. Due to unsafe use of an Java RMI based protocol in an unsafe configuration an attacker can inject malicious serialized objects into the communication resulting in remote code execution in the context of a client-side Network Licensing Protocol component.


A SQL injection issue was found in SFOS 17.0 17.1 17.5 and 18.0 before 2020-04-25 on Sophos XG Firewall devices as exploited in the wild in April 2020. This affected devices configured with either the administration (HTTPS) service or the User Portal exposed on the WAN zone. A successful attack may have caused remote code execution that exfiltrated usernames and hashed passwords for the local device admin(s) portal admins and user accounts used for remote access (but not external Active Directory or LDAP passwords)


A specially crafted communication packet sent to the affected devices could allow remote code execution and a denial-of-service condition due to a deserialization vulnerability. This issue affects: Mitsubishi Electric MC Works64 version 4.02C (10.95.208.31) and earlier all versions; Mitsubishi Electric MC Works32 version 3.00A (9.50.255.02); ICONICS GenBroker64 Platform Services Workbench FrameWorX Server version 10.96 and prior; ICONICS GenBroker32 version 9.5 and prior.


MonoX

through

allows

remote

code

execution

via

or

because

of

deserialization

in

ModuleGallery.SilverLightUploadModule

and

SilverLightUploadHandler.


Zimbra before 8.8.15 Patch 10 and 9.x before 9.0.0 Patch 3 allows remote code execution via an avatar file. There is potential abuse of /service/upload servlet in the webmail subsystem. A user can upload executable files (exe sh bat jar) in the Contact section of the mailbox as an avatar image for a contact. A user will receive a \Corrupt File\ error but the file is still uploaded and stored locally in /opt/zimbra/data/tmp/upload/ leaving it open to possible remote execution.


An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. path.c mishandles equivalent filenames that exist because of NTFS Alternate Data Streams. This may allow remote code execution when cloning a repository. This issue is similar to CVE-2019-1352.


eQ-3 Homematic Central Control Unit (CCU)2 through 2.51.6 and CCU3 through 3.51.6 allow Remote Code Execution in the JSON API Method ReGa.runScript by unauthenticated attackers with access to the web interface due to the default auto-login feature being enabled during first-time setup (or factory reset).


The mappress-google-maps-for-wordpress plugin before 2.54.6 for WordPress does not correctly implement capability checks for AJAX functions related to creation/retrieval/deletion of PHP template files leading to Remote Code Execution. NOTE: this issue exists because of an incomplete fix for CVE-2020-12077.


rConfig 3.9.4 is vulnerable to remote code execution due to improper validation in the file upload functionality. vendor.crud.php accepts a file upload by checking content-type without considering the file extension and header. Thus an attacker can exploit this by uploading a .php file to vendor.php that contains arbitrary PHP code and changing the content-type to image/gif.


Apache Solr versions 6.6.0 to 6.6.6 7.0.0 to 7.7.3 and 8.0.0 to 8.6.2 prevents some features considered dangerous (which could be used for remote code execution) to be configured in a ConfigSet that's uploaded via API without authentication/authorization. The checks in place to prevent such features can be circumvented by using a combination of UPLOAD/CREATE actions.


An issue was discovered in the Elementor Pro plugin before 2.9.4 for WordPress as exploited in the wild in May 2020 in conjunction with CVE-2020-13125. An attacker with the Subscriber role can upload arbitrary executable files to achieve remote code execution. NOTE: the free Elementor plugin is unaffected.


An unrestricted file-upload issue in EditLaunchPadDialog.aspx in Ivanti Endpoint Manager 2019.1 and 2020.1 allows an authenticated attacker to gain remote code execution by uploading a malicious aspx file. The issue is caused by insufficient file extension validation and insecure file operations on the uploaded image which upon failure will leave the temporarily created files in an accessible location on the server.


AnyDesk before 5.5.3 on Linux and FreeBSD has a format string vulnerability that can be exploited for remote code execution.


An exploitable use-after-free vulnerability exists in WebKitGTK browser version 2.30.1 x64. A specially crafted HTML web page can cause a use-after-free condition resulting in a remote code execution. The victim needs to visit a malicious web site to trigger this vulnerability.


A Remote code execution vulnerability exists in DEXT5Upload in DEXT5 through 2.7.1402870. An attacker can upload a PHP file via dext5handler.jsp handler because the uploaded file is stored under dext5uploadeddata/.


Sabberworm PHP CSS Parser before 8.3.1 calls eval on uncontrolled data possibly leading to remote code execution if the function allSelectors() or getSelectorsBySpecificity() is called with input from an attacker.


An out-of-bounds write vulnerability exists in the Ethernet/IP server functionality of EIP Stack Group OpENer 2.3 and development commit 8c73bf3. A specially crafted series of network requests can lead to remote code execution. An attacker can send a sequence of requests to trigger this vulnerability.


Arbitrary PHP code execution vulnerability in Drupal Core under certain circumstances. An attacker could trick an administrator into visiting a malicious site that could result in creating a carefully named directory on the file system. With this directory in place an attacker could attempt to brute force a remote code execution vulnerability. Windows servers are most likely to be affected. This issue affects: Drupal Drupal Core 8.8.x versions prior to 8.8.8; 8.9.x versions prior to 8.9.1; 9.0.1 versions prior to 9.0.1.


A code execution vulnerability exists in the WebSocket functionality of Webkit WebKitGTK 2.30.0. A specially crafted web page can trigger a use-after-free vulnerability which can lead to remote code execution. An attacker can get a user to visit a webpage to trigger this vulnerability.


Netsweeper through 6.4.3 allows unauthenticated remote code execution because webadmin/tools/unixlogin.php (with certain Referer headers) launches a command line with client-supplied parameters and allows injection of shell metacharacters.


Jenkins Google Kubernetes Engine Plugin 0.8.0 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types resulting in a remote code execution vulnerability.


Jenkins Pipeline: AWS Steps Plugin 1.40 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types resulting in a remote code execution vulnerability.


Jenkins OpenShift Pipeline Plugin 1.0.56 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types resulting in a remote code execution vulnerability.


Jenkins Yaml Axis Plugin 0.2.0 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types resulting in a remote code execution vulnerability.


Jenkins ElasticBox Jenkins Kubernetes CI/CD Plugin 1.3 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types resulting in a remote code execution vulnerability.


Jenkins Literate Plugin 1.0 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types resulting in a remote code execution vulnerability.


Jenkins AWS SAM Plugin 1.2.2 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types resulting in a remote code execution vulnerability.


Jenkins RadarGun Plugin 1.7 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types resulting in a remote code execution vulnerability.


Jenkins Azure Container Service Plugin 1.0.1 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types resulting in a remote code execution vulnerability.


Jenkins SCM Filter Jervis Plugin 0.2.1 and earlier does not configure its YAML parser to prevent the instantiation of arbitrary types resulting in a remote code execution vulnerability.


An exploitable out-of-bounds indexing vulnerability exists within the RW fabric message particle type of Aerospike Database Server 3.10.0.3. A specially crafted packet can cause the server to fetch a function table outside the bounds of an array resulting in remote code execution. An attacker can simply connect to the port to trigger this vulnerability.


An issue was discovered in Moxa NPort 5110 versions prior to 2.6 NPort 5130/5150 Series versions prior to 3.6 NPort 5200 Series versions prior to 2.8 NPort 5400 Series versions prior to 3.11 NPort 5600 Series versions prior to 3.7 NPort 5100A Series & NPort P5150A versions prior to 1.3 NPort 5200A Series versions prior to 1.3 NPort 5150AI-M12 Series versions prior to 1.2 NPort 5250AI-M12 Series versions prior to 1.2 NPort 5450AI-M12 Series versions prior to 1.2 NPort 5600-8-DT Series versions prior to 2.4 NPort 5600-8-DTL Series versions prior to 2.4 NPort 6x50 Series versions prior to 1.13.11 NPort IA5450A versions prior to v1.4. Firmware can be updated over the network without authentication which may allow remote code execution.


Apache OpenMeetings before 3.1.2 is vulnerable to Remote Code Execution via RMI deserialization attack.


An exploitable out of bounds write exists in the handling of compressed TIFF images in ImageMagicks's convert utility. A crafted TIFF document can lead to an out of bounds write which in particular circumstances could be leveraged into remote code execution. The vulnerability can be triggered through any user controlled TIFF that is handled by this functionality.


Apache Camel's Jackson and JacksonXML unmarshalling operation are vulnerable to Remote Code Execution attacks.


An exploitable heap write out of bounds vulnerability exists in the decoding of BPG images in Libbpg library. A crafted BPG image decoded by libbpg can cause an integer underflow vulnerability causing an out of bounds heap write leading to remote code execution. This vulnerability can be triggered via attempting to decode a crafted BPG image using Libbpg.


Remote code execution is possible with Apache Tomcat before 6.0.48 7.x before 7.0.73 8.x before 8.0.39 8.5.x before 8.5.7 and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.


A potential remote code execution vulnerability exists in the PDF parsing functionality of Nitro Pro 10. A specially crafted PDF file can cause a vulnerability resulting in potential code execution. An attacker can send the victim a specific PDF file to trigger this vulnerability.


An exploitable remote code execution vulnerability exists in the handling of TIFF images in LibTIFF version 4.0.6. A crafted TIFF document can lead to a type confusion vulnerability resulting in remote code execution. This vulnerability can be triggered via a TIFF file delivered to the application using LibTIFF's tag extension functionality.


SKYSEA Client View Ver.11.221.03 and earlier allows remote code execution via a flaw in processing authentication on the TCP connection with the management console program.


Exponent CMS 2.3.9 suffers from a remote code execution vulnerability in /install/index.php. An attacker can upload 'php' file to the website through uploader_paste.php then overwrite /framework/conf/config.php which leads to arbitrary code execution.


Exponent

CMS

suffers

from

a

remote

code

execution

vulnerability

in

An

attacker

can

upload

an

evil

'exploit.tar.gz'

file

to

the

website

then

extract

it

by

visiting

'/install/index.php?install_sample=../../files/exploit'

which

leads

to

arbitrary

code

execution.


limbus-buildgen is a \build anywhere\ build system. limbus-buildgen versions below 0.1.1 download binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.


ibapi is an Interactive Brokers API addon for NodeJS. ibapi downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. Before 2.5.6 it may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.


grunt-images is a grunt plugin for processing images. grunt-images downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.


iedriver is an NPM wrapper for Selenium IEDriver. iedriver versions below 3.0.0 download binary resources over HTTP which leaves the module vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.


pk-app-wonderbox is an integration with wonderbox pk-app-wonderbox downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.


scala-bin is a binary wrapper for Scala. scala-bin downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.


windows-seleniumjar-mirror downloads the Selenium Jar file windows-seleniumjar-mirror downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.


poco - The POCO libraries downloads source file resources used for compilation over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.


dalek-browser-ie-canary is Internet Explorer bindings for DalekJS. dalek-browser-ie-canary downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.


appium-chromedriver is a Node.js wrapper around Chromedriver. Versions below 2.9.4 download binary resources over HTTP which leaves the module vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.


The wsecure plugin before 2.4 for WordPress has remote code execution via shell metacharacters in the wsecure-config.php publish parameter.


roslib-socketio - The standard ROS Javascript Library fork for add support to socket.io roslib-socketio downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.


install-nw is a module which quickly and robustly installs and caches NW.js. install-nw versions below 1.1.5 download binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.


macaca-chromedriver-zxa is a Node.js wrapper for the selenium chromedriver. macaca-chromedriver-zxa downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.


libsbml is a module that installs Linux binaries for libSBML libsbml downloads resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.


closure-utils is Utilities for Closure Library based projects. closure-utils downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.


mystem is a Node.js wrapper for MyStem morphology text analyzer by Yandex.ru mystem downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.


The clang-extra module installs LLVM's clang-extra tools. clang-extra downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.


haxe-dev is a cross-platform toolkit. haxe-dev downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.


The npm-test-sqlite3-trunk module provides asynchronous non-blocking SQLite3 bindings. npm-test-sqlite3-trunk downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.


mongodb-instance before 0.0.3 installs mongodb locally. mongodb-instance downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.


grunt-webdriver-qunit is a grunt plugin to run qunit with webdriver in grunt grunt-webdriver-qunit downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.


webdriver-launcher is a Node.js Selenium Webdriver Launcher. webdriver-launcher downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.


The windows-iedriver module downloads fixed version of iedriverserver.exe windows-iedriver downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.


fis-parser-sass-bin a plugin for fis to compile sass using node-sass-binaries. fis-parser-sass-bin downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.


wasdk is a toolkit for creating WebAssembly modules. wasdk downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.


haxe is a cross-platform toolkit haxe downloads zipped resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested zip file with an attacker controlled zip file if the attacker is on the network or positioned in between the user and the remote server.


frames-compiler downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.


serc.js is a Selenium RC process wrapper serc.js downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.


dwebp-bin is a dwebp node.js wrapper that convert WebP into PNG. dwebp-bin downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.


In Redaxo 5.2.0 the cron management of the admin panel suffers from CSRF that leads to arbitrary Remote Code Execution via addons/cronjob/lib/types/phpcode.php.


Fuseki server wrapper and management API in fuseki before 1.0.1 downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.


windows-seleniumjar is a module that downloads the Selenium Jar file windows-seleniumjar downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.


herbivore is a packet sniffing and crafting library. Built on libtins herbivore 0.0.3 and below download binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.


closurecompiler is a Closure Compiler for node.js. closurecompiler downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.


grunt-ccompiler is a Closure Compiler Grunt Plugin. grunt-ccompiler downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.


baryton-saxophone is a module to install and launch Selenium Server for Mac Linux and Windows. baryton-saxophone versions below 3.0.1 download binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.


alto-saxophone is a module to install and launch Chromedriver for Mac Linux or Windows. alto-saxophone versions below 2.25.1 download binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.


openframe-glsviewer is a Openframe extension which adds support for shaders via glslViewer. openframe-glsviewer downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.


ntfserver is a Network Testing Framework Server. ntfserver downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.


Haxe 3 : The Cross-Platform Toolkit (a fork from David Mouton's damoebius/haxe-npm) haxe3 downloads resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.


macaca-chromedriver is a Node.js wrapper for the selenium chromedriver. macaca-chromedriver before 1.0.29 downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.


phantomjs-cheniu is a Headless WebKit with JS API phantomjs-cheniu downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.


marionette-socket-host is a marionette-js-runner host for sending actions over a socket. marionette-socket-host downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.


air-sdk is a NPM wrapper for the Adobe AIR SDK. air-sdk downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.


apk-parser2 is a module which extracts Android Manifest info from an APK file. apk-parser2 downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.


selenium-standalone-painful installs a start-selenium command line to start a standalone selenium server with chrome-driver. selenium-standalone-painful downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.


openframe-ascii-image module is an openframe plugin which adds support for ascii images via fim. openframe-ascii-image downloads resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.


ibm_db is an asynchronous/synchronous interface for node.js to IBM DB2 and IBM Informix. ibm_db before 1.0.2 downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.


libsbmlsim is a module that installs linux binaries for libsbmlsim libsbmlsim downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.


slimerjs-edge is a npm wrapper for installing the bleeding edge version of slimerjs. slimerjs-edge downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.


healthcenter - IBM Monitoring and Diagnostic Tools health Center agent healthcenter downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.


mystem3 is a NodeJS wrapper for the Yandex MyStem 3. mystem3 downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.


box2d-native downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.


The NETGEAR WNR2000v5 router allows an administrator to perform sensitive actions by invoking the apply.cgi URL on the web server of the device. This special URL is handled by the embedded web server (uhttpd) and processed accordingly. The web server also contains another URL apply_noauth.cgi that allows an unauthenticated user to perform sensitive actions on the device. This functionality can be exploited to change the router settings (such as the answers to the password-recovery questions) and achieve remote code execution.


node-thulac is a node binding for thulac. node-thulac downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.


mystem-wrapper is a Yandex mystem app wrapper module. mystem-wrapper downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.


imageoptim is a Node.js wrapper for some images compression algorithms. imageoptim downloads zipped resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested tarball with an attacker controlled tarball if the attacker is on the network or positioned in between the user and the remote server.


mystem-fix is a node.js wrapper for MyStem morphology text analyzer by Yandex.ru mystem-fix downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.


native-opencv is the OpenCV library installed via npm native-opencv downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.


product-monitor is a HTML/JavaScript template for monitoring a product by encouraging product developers to gather all the information about the status of a product including live monitoring statistics endpoints and test results into one place. product-monitor versions below 2.2.5 download JavaScript resources over HTTP which leaves the module vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested JavaScript file with an attacker controlled JavaScript file if the attacker is on the network or positioned in between the user and the remote server.


soci downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.


nodeschnaps is a NodeJS compatibility layer for Java (Rhino). nodeschnaps downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.


selenium-portal is a Selenium Testing Framework selenium-portal downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.


nodewebkit is an installer for node-webkit. nodewebkit downloads zipped resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested zip file with an attacker controlled zip file if the attacker is on the network or positioned in between the user and the remote server.


embedza is a module to create HTML snippets/embeds from URLs using info from oEmbed Open Graph meta tags. embedza versions below 1.2.4 download JavaScript resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested JavaScript file with an attacker controlled JavaScript file if the attacker is on the network or positioned in between the user and the remote server.


aerospike is an Aerospike add-on module for Node.js. aerospike versions below 2.4.2 download binary resources over HTTP which leaves the module vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.


qbs is a build tool that helps simplify the build process for developing projects across multiple platforms. qbs downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.


bkjs-wand is imagemagick wand support for node.js and backendjs bkjs-wand versions lower than 0.3.2 download binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.


windows-latestchromedriver downloads the latest version of chromedriver.exe. windows-latestchromedriver downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.


scala-standalone-bin is a Binary wrapper for ScalaJS. scala-standalone-bin downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.


In Hazelcast before 3.11 the cluster join procedure is vulnerable to remote code execution via Java deserialization. If an attacker can reach a listening Hazelcast instance with a crafted JoinRequest and vulnerable classes exist in the classpath the attacker can run arbitrary code.


arrayfire-js is a module for ArrayFire for the Node.js platform. arrayfire-js downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.


dalek-browser-ie is Internet Explorer bindings for DalekJS. dalek-browser-ie downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.


dalek-browser-chrome-canary provides Google Chrome bindings for DalekJS. dalek-browser-chrome-canary downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.


selenium-wrapper is a selenium server wrapper including installation and chrome webdriver. selenium-wrapper downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.


wixtoolset is a Node module wrapper around the wixtoolset binaries wixtoolset downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.


webdrvr is a npm wrapper for Selenium Webdriver including Chromedriver / IEDriver / IOSDriver / Ghostdriver. webdrvr downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.


haxeshim haxe shim to deal with coexisting versions. haxeshim downloads resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.


Kindlegen is a simple Node.js wrapper of the official kindlegen program. Kindlegen versions before 1.1.0 download binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.


Chromedriver is an NPM wrapper for selenium ChromeDriver. Chromedriver before 2.26.1 downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.


cue-sdk-node is a Corsair Cue SDK wrapper for node.js. cue-sdk-node downloads zipped resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested zip file with an attacker controlled zip file if the attacker is on the network or positioned in between the user and the remote server.


google-closure-tools-latest is a Node.js module wrapper for downloading the latest version of the Google Closure tools google-closure-tools-latest downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.


resourcehacker is a Node wrapper of Resource Hacker (windows executable resource editor). resourcehacker downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.


nw is an installer for nw.js. nw downloads zipped resources over HTTP It may be possible to cause remote code execution (RCE) by swapping out the requested zip file with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.


selenium-chromedriver is a simple utility for downloading the Selenium Webdriver for Google Chrome selenium-chromedriver downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.


fis-sass-all is another libsass wrapper for node. fis-sass-all downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.


curses is bindings for the native curses library a full featured console IO library. curses downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.


chromedriver126 is chromedriver version 1.26 for linux OS. chromedriver126 downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.


cmake installs the cmake x86 linux binaries. cmake downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.


js-given is a JavaScript frontend to jgiven. js-given downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.


strider-sauce is Sauce Labs / Selenium support for Strider. strider-sauce downloads zipped resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested zip file with an attacker controlled zip file if the attacker is on the network or positioned in between the user and the remote server.


atom-node-module-installer installs node modules for atom-shell applications. atom-node-module-installer binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.


operadriver is a Opera Driver for Selenium. operadriver versions below 0.2.3 download binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.


massif is a Phantomjs fork massif downloads resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.


rs-brightcove is a wrapper around brightcove's web api rs-brightcove downloads source file resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.


Prince is a Node API for executing XML/HTML to PDF renderer PrinceXML via prince(1) CLI. prince downloads zipped resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested tarball with an attacker controlled tarball if the attacker is on the network or positioned in between the user and the remote server.


node-air-sdk is an AIR SDK for nodejs. node-air-sdk downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.


selenium-binaries downloads Selenium related binaries for your OS. selenium-binaries downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.


headless-browser-lite is a minimal npm installer for phantomjs and slimerjs with no external dependencies. headless-browser-lite downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.


galenframework-cli is the node wrapper for the Galen Framework. galenframework-cli below 2.3.1 download binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.


windows-selenium-chromedriver is a module that downloads the Selenium Jar file. windows-selenium-chromedriver downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.


httpsync is a port of libcurl to node.js. httpsync downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.


jstestdriver is a wrapper for Google's jstestdriver. jstestdriver downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.


robot-js is a module for native system automation for node.js. robot-js downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.


redis-srvr is a npm wrapper for redis-server. redis-srvr downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.


jdf-sass is a fork from node-sass jdf use only. jdf-sass downloads executable resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested file with an attacker controlled file if the attacker is on the network or positioned in between the user and the remote server.


cloudpub-redis is a module for CloudPub: Redis Backend cloudpub-redis downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.


fibjs is a runtime for javascript applictions built on google v8 JS. fibjs downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.


arcanist downloads resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.


apk-parser is a tool to extract Android Manifest info from an APK file. apk-parser versions below 0.1.6 download binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.


Steroids is PhoneGap on Steroids providing native UI elements multiple WebViews and enhancements for better developer productivity. steroids downloads zipped resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested tarball with an attacker controlled tarball if the attacker is on the network or positioned in between the user and the remote server.


tomita-parser is a Node wrapper for Yandex Tomita Parser tomita-parser downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.


selenium-download downloads the latest versions of the selenium standalone server and the chromedriver. selenium-download before 2.0.7 downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.


co-cli-installer downloads the co-cli module as part of the install process but does so over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.


react-native-baidu-voice-synthesizer is a baidu voice speech synthesizer for react native. react-native-baidu-voice-synthesizer downloads resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.


pngcrush-installer is an installer for Pngcrush. pngcrush-installer versions below 1.8.10 download binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.


broccoli-closure is a Closure compiler plugin for Broccoli. broccoli-closure before 1.3.1 downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.


sauce-connect is a Node.js wrapper over the SauceLabs SauceConnect.jar program for establishing a secure tunnel for intranet testing. sauce-connect downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.


dalek-browser-chrome is Google Chrome bindings for DalekJS. dalek-browser-chrome downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.


xd-testing is a testing library for cross-device (XD) web applications. xd-testing downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.


tomita is a node wrapper for Yandex Tomita Parser tomita downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.


libxl provides Node bindings for the libxl library for reading and writing excel (XLS and XLSX) spreadsheets. libxl downloads zipped resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested zip file with an attacker controlled zip file if the attacker is on the network or positioned in between the user and the remote server.


nw-with-arm is a NW Installer including ARM-Build. nw-with-arm downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.


webrtc-native uses WebRTC from chromium project. webrtc-native downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.


apk-parser3 is a module to extract Android Manifest info from an APK file. apk-parser3 versions before 0.1.3 download binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.


pm2-kafka is a PM2 module that installs and runs a kafka server pm2-kafka downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested resources with an attacker controlled copy if the attacker is on the network or positioned in between the user and the remote server.


jvminstall is a module for downloading and unpacking jvm to local system. jvminstall downloads binary resources over HTTP which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution (RCE) by swapping out the requested binary with an attacker controlled binary if the attacker is on the network or positioned in between the user and the remote server.


Kunena before 5.0.4 does not restrict avatar file extensions to gif jpeg jpg and png. This can lead to XSS and remote code execution.


An issue was discovered in phpMyAdmin. phpMyAdmin can be used to trigger a remote code execution attack against certain PHP installations that are running with the dbase extension. All 4.6.x versions (prior to 4.6.4) 4.4.x versions (prior to 4.4.15.8) and 4.0.x versions (prior to 4.0.10.17) are affected.


An issue was discovered in phpMyAdmin. A user can execute a remote code execution attack against a server when phpMyAdmin is being run as a CGI application. Under certain server configurations a user can pass a query string which is executed as a command-line argument by the file generator_plugin.sh. All 4.6.x versions (prior to 4.6.4) 4.4.x versions (prior to 4.4.15.8) and 4.0.x versions (prior to 4.0.10.17) are affected.


When processing authorization requests using the whitelabel views in Spring Security OAuth 2.0.0 to 2.0.9 and 1.0.0 to 1.0.5 the response_type parameter value was executed as Spring SpEL which enabled a malicious user to trigger remote code execution via the crafting of the value for response_type.


By manipulating the URL parameter externalLoginKey a malicious logged in user could pass valid Freemarker directives to the Template Engine that are reflected on the webpage; a specially crafted Freemarker template could be used for remote code execution. Mitigation: Upgrade to Apache OFBiz 16.11.01


The console in Puppet Enterprise 2015.x and 2016.x prior to 2016.4.0 includes unsafe string reads that potentially allows for remote code execution on the console node.


Lexmark Markvision Enterprise before 2.3.0 misuses the Apache Commons Collections Library leading to remote code execution because of Java deserialization.


Microsoft .NET Framework 4.6 and 4.6.1 mishandles library loading which allows local users to gain privileges via a crafted application aka \.NET Framework Remote Code Execution Vulnerability.\


Microsoft Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 and Windows 10 Gold and 1511 mishandle DLL loading which allows local users to gain privileges via a crafted application aka \Windows DLL Loading Remote Code Execution Vulnerability.\


Microsoft Internet Explorer 11 mishandles DLL loading which allows local users to gain privileges via a crafted application aka \DLL Loading Remote Code Execution Vulnerability.\


The hotrod java client in infinispan before 9.1.0.Final automatically deserializes bytearray message contents in certain events. A malicious user could exploit this flaw by injecting a specially-crafted serialized object to attain remote code execution or conduct other attacks.


Microsoft Windows 7 SP1 Windows 8 Windows 8.1 Windows Server 2012 R2 and Windows 10 Gold and 1511 mishandle DLL loading which allows local users to gain privileges via a crafted application aka \DLL Loading Remote Code Execution Vulnerability.\


Microsoft Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT Gold and 8.1 and Windows 10 Gold and 1511 mishandle DLL loading which allows local users to gain privileges via a crafted application aka \DLL Loading Remote Code Execution Vulnerability.\


Microsoft Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 Windows 10 Gold and 1511 and Internet Explorer 10 and 11 mishandle DLL loading which allows local users to gain privileges via a crafted application aka \DLL Loading Remote Code Execution Vulnerability.\


Internet Information Services (IIS) in Microsoft Windows Vista SP2 and Server 2008 SP2 mishandles library loading which allows local users to gain privileges via a crafted application aka \Windows DLL Loading Remote Code Execution Vulnerability.\


Apache Commons FileUpload before 1.3.3 DiskFileItem File Manipulation Remote Code Execution


Mirror Manager version 0.7.2 and older is vulnerable to remote code execution in the checkin code.


Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product this issue may or not occur and authentication may be required. NOTE: the vendor's position is that untrusted data is not an intended use case. The product's behavior will not be changed because some users rely on deserialization of trusted data.


NuMedia Soft NMS DVD Burning SDK Activex NMSDVDX.DVDEngineX.1 ActiveX control (NMSDVDX.dll) 1.013C and earlier as used in CDBurnerXP 4.2.1.976 BurnAware 2.1.3 Blaze Media Pro 8.02 Special Edition and possibly other products allows remote attackers to overwrite and create arbitrary files via calls to the EnableLog and LogMessage methods. NOTE: this issue might only be exploitable in limited environments or non-default browser settings. NOTE: some of these details are obtained from third party information. NOTE: this can be leveraged for remote code execution by accessing files using hcp:// URLs.


The Chilkat XML ChilkatUtil.CkData.1 ActiveX control (ChilkatUtil.dll) 3.0.3.0 and earlier allows remote attackers to create overwrite and modify arbitrary files for execution via a call to the (1) SaveToFile (2) SaveToTempFile or (3) AppendBinary method. NOTE: this issue might only be exploitable in limited environments or non-default browser settings. NOTE: this can be leveraged for remote code execution by accessing files using hcp:// URLs.


The GdPicture (1) Light Imaging Toolkit 4.7.1 GdPicture4S.Imaging ActiveX control (gdpicture4s.ocx) 4.7.0.1 and (2) Pro Imaging SDK 5.7.1 GdPicturePro5S.Imaging ActiveX control (gdpicturepro5s.ocx) 5.7.0.1 allows remote attackers to create overwrite and modify arbitrary files via the SaveAsPDF method. NOTE: this issue might only be exploitable in limited environments or non-default browser settings. NOTE: this can be leveraged for remote code execution by accessing files using hcp:// URLs. NOTE: some of these details are obtained from third party information.


OpenVAS Manager v2.0.3 allows plugin remote code execution.


The telnet URI handler in Microsoft Internet Explorer 6 through 9 does not properly launch the handler application which allows remote attackers to execute arbitrary programs via a crafted web site aka \Telnet Handler Remote Code Execution Vulnerability.\


ImpressPages CMS v1.0.12 has Unspecified Remote Code Execution (fixed in v1.0.13)


Windows Resilient File System (ReFS) Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-21928 CVE-2022-21958 CVE-2022-21959 CVE-2022-21960 CVE-2022-21961 CVE-2022-21962 CVE-2022-21963.


Windows Resilient File System (ReFS) Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-21892 CVE-2022-21928 CVE-2022-21958 CVE-2022-21959 CVE-2022-21960 CVE-2022-21962 CVE-2022-21963.


Windows Resilient File System (ReFS) Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-21892 CVE-2022-21928 CVE-2022-21959 CVE-2022-21960 CVE-2022-21961 CVE-2022-21962 CVE-2022-21963.


Windows Resilient File System (ReFS) Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-21892 CVE-2022-21928 CVE-2022-21958 CVE-2022-21960 CVE-2022-21961 CVE-2022-21962 CVE-2022-21963.


Windows Resilient File System (ReFS) Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-21892 CVE-2022-21928 CVE-2022-21958 CVE-2022-21959 CVE-2022-21961 CVE-2022-21962 CVE-2022-21963.


Windows Resilient File System (ReFS) Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-21892 CVE-2022-21928 CVE-2022-21958 CVE-2022-21959 CVE-2022-21960 CVE-2022-21961 CVE-2022-21963.


Windows Resilient File System (ReFS) Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-21892 CVE-2022-21928 CVE-2022-21958 CVE-2022-21959 CVE-2022-21960 CVE-2022-21961 CVE-2022-21962.


Windows Resilient File System (ReFS) Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-21892 CVE-2022-21958 CVE-2022-21959 CVE-2022-21960 CVE-2022-21961 CVE-2022-21962 CVE-2022-21963.


The REST API in Zoho ManageEngine Applications Manager before build 14740 allows an unauthenticated SQL Injection via a crafted request leading to Remote Code Execution.


LAquis SCADA Versions 4.1.0.3870 and prior has a path traversal vulnerability which may allow remote code execution.


LAquis SCADA Versions 4.1.0.3870 and prior has an untrusted pointer dereference vulnerability which may allow remote code execution.


IBM Security Access Manager Appliance 9.0.4.0 and 9.0.5.0 could allow remote code execution when Advanced Access Control or Federation services are running. IBM X-Force ID: 147370.


A security issue was found in EdgePower 24V/54V firmware v1.7.0 and earlier where due to missing CSRF protections an attacker would have been able to perform unauthorized remote code execution.


Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability


Microsoft SharePoint Server Remote Code Execution Vulnerability


Microsoft SharePoint Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-34467 CVE-2021-34520.


Microsoft SharePoint Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-34467 CVE-2021-34468.


Microsoft SharePoint Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-34468 CVE-2021-34520.


Microsoft SharePoint Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-42309.


Microsoft SharePoint Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-42294.


Microsoft SharePoint Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-40487.


Microsoft SharePoint Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-26420 CVE-2021-31963.


Microsoft SharePoint Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-26420 CVE-2021-31966.


Microsoft SharePoint Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-31963 CVE-2021-31966.


Microsoft SharePoint Server Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-41344.


Microsoft SharePoint Server Remote Code Execution Vulnerability.


Visual Studio Code Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-28457 CVE-2021-28473 CVE-2021-28475 CVE-2021-28477.


Visual Studio Code Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-28457 CVE-2021-28469 CVE-2021-28473 CVE-2021-28477.


Visual Studio Code Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-28469 CVE-2021-28473 CVE-2021-28475 CVE-2021-28477.


Visual Studio Code Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-28457 CVE-2021-28469 CVE-2021-28475 CVE-2021-28477.


Visual Studio Code Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-28457 CVE-2021-28469 CVE-2021-28473 CVE-2021-28475.


Visual Studio Code Remote Code Execution Vulnerability


Visual Studio Code Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-34528.


Visual Studio Code Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-34529.


Visual Studio Code Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-31214.


Visual Studio Code Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-31211.


Visual Studio Code Remote Containers Extension Remote Code Execution Vulnerability


Visual Studio Code Remote Code Execution Vulnerability.


Visual Studio Code Remote Development Extension Remote Code Execution Vulnerability.


Visual Studio Code Remote Development Extension Remote Code Execution Vulnerability


The Treck TCP/IP stack before 6.0.1.66 allows Remote Code Execution related to IPv4 tunneling.


The Treck TCP/IP stack before 6.0.1.66 allows Remote Code execution via a single invalid DNS response.


CuppaCMS v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the saveConfigData function in /classes/ajax/Functions.php.


Victor v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the component admin/profile.php?section=admin.


All versions of package ajaxpro.2 are vulnerable to Deserialization of Untrusted Data due to the possibility of deserialization of arbitrary .NET classes which can be abused to gain remote code execution.


All versions of package com.bstek.ureport:ureport2-console are vulnerable to Remote Code Execution by connecting to a malicious database server causing arbitrary file read and deserialization of local gadgets.


HEVC Video Extensions Remote Code Execution Vulnerability


VP9 Video Extensions Remote Code Execution Vulnerability


HEVC Video Extensions Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-1644.


HEVC Video Extensions Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-1643.


HEVC

Video

Extensions

Remote

Code

Execution

Vulnerability

This

CVE

ID

is

unique

from


HEVC Video Extensions Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-31947 CVE-2021-33775 CVE-2021-33777 CVE-2021-33778.


HEVC Video Extensions Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-31947 CVE-2021-33775 CVE-2021-33776 CVE-2021-33778.


HEVC Video Extensions Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-31947 CVE-2021-33776 CVE-2021-33777 CVE-2021-33778.


HEVC Video Extensions Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-31947 CVE-2021-33775 CVE-2021-33776 CVE-2021-33777.


HEVC Video Extensions Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-40452 CVE-2021-40453.


HEVC Video Extensions Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-33775 CVE-2021-33776 CVE-2021-33777 CVE-2021-33778.


HEVC Video Extensions Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-40452 CVE-2021-41360.


HEVC Video Extensions Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-40453 CVE-2021-41360.


VP9 Video Extensions Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-24451.


VP9 Video Extensions Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-24501.


HEVC Video Extensions Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-22006 CVE-2022-22007 CVE-2022-23301 CVE-2022-24452 CVE-2022-24456.


HEVC Video Extensions Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-22006 CVE-2022-22007 CVE-2022-23301 CVE-2022-24453 CVE-2022-24456.


HEVC Video Extensions Remote Code Execution Vulnerability.


HEVC Video Extensions Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-22006 CVE-2022-22007 CVE-2022-23301 CVE-2022-24452 CVE-2022-24453.


HEVC Video Extensions Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-22006 CVE-2022-23301 CVE-2022-24452 CVE-2022-24453 CVE-2022-24456.


HEVC Video Extensions Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-22007 CVE-2022-23301 CVE-2022-24452 CVE-2022-24453 CVE-2022-24456.


VP9 Video Extensions Remote Code Execution Vulnerability.


HEVC Video Extensions Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-22006 CVE-2022-22007 CVE-2022-24452 CVE-2022-24453 CVE-2022-24456.


HEVC Video Extensions Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-21844 CVE-2022-21927.


HEVC Video Extensions Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-21844 CVE-2022-21926.


HEVC Video Extensions Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-21926 CVE-2022-21927.


HEVC Video Extensions Remote Code Execution Vulnerability This CVE ID is unique from CVE-2020-17106 CVE-2020-17107 CVE-2020-17108 CVE-2020-17110.


HEVC Video Extensions Remote Code Execution Vulnerability This CVE ID is unique from CVE-2020-17106 CVE-2020-17107 CVE-2020-17108 CVE-2020-17109.


HEVC Video Extensions Remote Code Execution Vulnerability This CVE ID is unique from CVE-2020-17106 CVE-2020-17107 CVE-2020-17109 CVE-2020-17110.


HEVC Video Extensions Remote Code Execution Vulnerability This CVE ID is unique from CVE-2020-17107 CVE-2020-17108 CVE-2020-17109 CVE-2020-17110.


HEVC Video Extensions Remote Code Execution Vulnerability This CVE ID is unique from CVE-2020-17106 CVE-2020-17108 CVE-2020-17109 CVE-2020-17110.


Unauthentication vulnerabilities have been identified in Geutebruck G-Cam/EFD-2250 Version 1.12.0.4 and Topline TopFD-2125 Version 3.15.1 IP cameras which may allow remote code execution.


A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an authenticated remote attacker to send a specially crafted HTTP message and achieve remote code execution with elevated privileges.


A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an unauthenticated remote attacker to send a specially crafted HTTP message and achieve remote code execution with elevated privileges.


A vulnerability was discovered in Tenda AC9 v3.0 V15.03.06.42_multi and Tenda AC9 V1.0 V15.03.05.19(6318)_CN which allows for remote code execution via shell metacharacters in the guestuser field to the __fastcall function with a POST request.


PrinterLogic Web Stack versions 19.1.1.13 SP9 and below do not sanitize user input resulting in pre-auth remote code execution.


PrinterLogic Web Stack versions 19.1.1.13 SP9 and below deserializes attacker controlled leading to pre-auth remote code execution.


PrinterLogic Web Stack versions 19.1.1.13 SP9 and below use a hardcoded APP_KEY value leading to pre-auth remote code execution.


Microsoft Windows Media Foundation Remote Code Execution Vulnerability


Microsoft Windows Media Foundation Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-34439 CVE-2021-34503.


Microsoft Windows Media Foundation Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-34439 CVE-2021-34441.


Microsoft Windows Media Foundation Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-34441 CVE-2021-34503.


Microsoft Windows Media Foundation Remote Code Execution Vulnerability.


Microsoft Windows Vista SP2 and Server 2008 SP2 mishandle dynamic link library (DLL) loading which allows local users to gain privileges via a crafted application aka \Library Loading Input Validation Remote Code Execution Vulnerability.\


Microsoft Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 and Windows 7 SP1 mishandle library loading which allows local users to gain privileges via a crafted application aka \Windows Library Loading Remote Code Execution Vulnerability.\


Microsoft Windows Vista SP2 and Server 2008 SP2 mishandle library loading which allows local users to gain privileges via a crafted application aka \Library Loading Input Validation Remote Code Execution Vulnerability.\


Microsoft Word Remote Code Execution Vulnerability


Microsoft Word Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-1715.


Microsoft Word Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-1716.


Microsoft Word Remote Code Execution Vulnerability.


In OpenJPEG 2.3.0 a stack-based buffer overflow was discovered in the pgxtoimage function in jpwl/convert.c. The vulnerability causes an out-of-bounds write which may lead to remote denial of service or possibly remote code execution.

remote code execution
denial of service
buffer overflow


In OpenJPEG 2.3.0 a stack-based buffer overflow was discovered in the pgxtovolume function in jp3d/convert.c. The vulnerability causes an out-of-bounds write which may lead to remote denial of service or possibly remote code execution.


A remote code execution vulnerability exists when Windows Hyper-V Network Switch on a host server fails to properly validate input from an authenticated user on a guest operating system aka 'Hyper-V Remote Code Execution Vulnerability'.

remote code execution
improper input validation


A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest operating system aka 'Windows Hyper-V Remote Code Execution Vulnerability'.


A remote code execution vulnerability exists when the Visual Studio C++ Redistributable Installer improperly validates input before loading dynamic link library (DLL) files aka 'Visual Studio Remote Code Execution Vulnerability'.


A remote code execution vulnerability exists when Windows Hyper-V Network Switch on a host server fails to properly validate input from an authenticated user on a guest operating system aka 'Hyper-V Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0719.


A remote code execution vulnerability exists in the way that the MSHTML engine inproperly validates input aka \MSHTML Engine Remote Code Execution Vulnerability.\ This affects Microsoft Office Microsoft Office Word Viewer Internet Explorer 9 Internet Explorer 11 Microsoft Excel Viewer Internet Explorer 10 Office 365 ProPlus.


A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest operating system aka \Windows Hyper-V Remote Code Execution Vulnerability.\ This affects Windows Server 2016 Windows 10 Windows Server 2019 Windows 10 Servers. This CVE ID is unique from CVE-2019-0550.


A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0889 CVE-2019-0890 CVE-2019-0891 CVE-2019-0893 CVE-2019-0894 CVE-2019-0895 CVE-2019-0897 CVE-2019-0898 CVE-2019-0899 CVE-2019-0900 CVE-2019-0901 CVE-2019-0902.

remote code execution
improper memory handle


A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory aka \Jet Database Engine Remote Code Execution Vulnerability.\ This affects Windows 7 Windows Server 2012 R2 Windows RT 8.1 Windows Server 2008 Windows Server 2019 Windows Server 2012 Windows 8.1 Windows Server 2016 Windows Server 2008 R2 Windows 10 Windows 10 Servers. This CVE ID is unique from CVE-2019-0538 CVE-2019-0575 CVE-2019-0576 CVE-2019-0577 CVE-2019-0578 CVE-2019-0579 CVE-2019-0580 CVE-2019-0581 CVE-2019-0583 CVE-2019-0584.


A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0590 CVE-2019-0591 CVE-2019-0593 CVE-2019-0605 CVE-2019-0610 CVE-2019-0640 CVE-2019-0642 CVE-2019-0644 CVE-2019-0651 CVE-2019-0652 CVE-2019-0655.


A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory aka \Jet Database Engine Remote Code Execution Vulnerability.\ This affects Windows 7 Windows Server 2012 R2 Windows RT 8.1 Windows Server 2008 Windows Server 2019 Windows Server 2012 Windows 8.1 Windows Server 2016 Windows Server 2008 R2 Windows 10 Windows 10 Servers. This CVE ID is unique from CVE-2019-0575 CVE-2019-0576 CVE-2019-0577 CVE-2019-0578 CVE-2019-0579 CVE-2019-0580 CVE-2019-0581 CVE-2019-0582 CVE-2019-0583 CVE-2019-0584.


A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0846 CVE-2019-0847 CVE-2019-0851 CVE-2019-0879.


A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0847 CVE-2019-0851 CVE-2019-0877 CVE-2019-0879.


A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory aka 'Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0823 CVE-2019-0825 CVE-2019-0826 CVE-2019-0827.


A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory aka \Jet Database Engine Remote Code Execution Vulnerability.\ This affects Windows 7 Windows Server 2012 R2 Windows RT 8.1 Windows Server 2008 Windows Server 2019 Windows Server 2012 Windows 8.1 Windows Server 2016 Windows Server 2008 R2 Windows 10 Windows 10 Servers. This CVE ID is unique from CVE-2019-0538 CVE-2019-0575 CVE-2019-0576 CVE-2019-0578 CVE-2019-0579 CVE-2019-0580 CVE-2019-0581 CVE-2019-0582 CVE-2019-0583 CVE-2019-0584.


A remote code execution vulnerability exists in the way that Windows Deployment Services TFTP Server handles objects in memory. An attacker who successfully exploited the vulnerability could execute arbitrary code with elevated permissions on a target system. To exploit the vulnerability an attacker could create a specially crafted request causing Windows to execute arbitrary code with elevated permissions. The security update addresses the vulnerability by correcting how Windows Deployment Services TFTP Server handles objects in memory aka 'Windows Deployment Services TFTP Server Remote Code Execution Vulnerability'.


A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory aka \Jet Database Engine Remote Code Execution Vulnerability.\ This affects Windows 7 Windows Server 2012 R2 Windows RT 8.1 Windows Server 2008 Windows Server 2019 Windows Server 2012 Windows 8.1 Windows Server 2016 Windows Server 2008 R2 Windows 10 Windows 10 Servers. This CVE ID is unique from CVE-2019-0538 CVE-2019-0575 CVE-2019-0576 CVE-2019-0577 CVE-2019-0578 CVE-2019-0579 CVE-2019-0580 CVE-2019-0581 CVE-2019-0582 CVE-2019-0584.


A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0904 CVE-2019-0905 CVE-2019-0906 CVE-2019-0907 CVE-2019-0908 CVE-2019-0909.


A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0806 CVE-2019-0812 CVE-2019-0829 CVE-2019-0860 CVE-2019-0861.


A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory aka 'Internet Explorer Memory Corruption Vulnerability'.


A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory aka 'Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0946 CVE-2019-0947.


A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0913 CVE-2019-0914 CVE-2019-0915 CVE-2019-0916 CVE-2019-0917 CVE-2019-0922 CVE-2019-0923 CVE-2019-0924 CVE-2019-0925 CVE-2019-0927 CVE-2019-0933 CVE-2019-0937.


A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory aka 'GDI+ Remote Code Execution Vulnerability'.


A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0912 CVE-2019-0913 CVE-2019-0914 CVE-2019-0915 CVE-2019-0916 CVE-2019-0917 CVE-2019-0922 CVE-2019-0923 CVE-2019-0924 CVE-2019-0925 CVE-2019-0927 CVE-2019-0933.


A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory aka 'Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0671 CVE-2019-0672 CVE-2019-0673 CVE-2019-0675.


A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0904 CVE-2019-0905 CVE-2019-0907 CVE-2019-0908 CVE-2019-0909 CVE-2019-0974.


A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0806 CVE-2019-0810 CVE-2019-0812 CVE-2019-0860 CVE-2019-0861.


A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory aka 'Windows VBScript Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0665 CVE-2019-0666 CVE-2019-0667.


A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0889 CVE-2019-0890 CVE-2019-0891 CVE-2019-0894 CVE-2019-0895 CVE-2019-0896 CVE-2019-0897 CVE-2019-0898 CVE-2019-0899 CVE-2019-0900 CVE-2019-0901 CVE-2019-0902.


A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0595 CVE-2019-0596 CVE-2019-0598 CVE-2019-0599 CVE-2019-0625.


A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0889 CVE-2019-0890 CVE-2019-0891 CVE-2019-0893 CVE-2019-0894 CVE-2019-0895 CVE-2019-0896 CVE-2019-0897 CVE-2019-0898 CVE-2019-0899 CVE-2019-0900 CVE-2019-0901.


A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0989 CVE-2019-0992 CVE-2019-0993 CVE-2019-1002 CVE-2019-1003 CVE-2019-1024 CVE-2019-1051 CVE-2019-1052.


A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0889 CVE-2019-0890 CVE-2019-0891 CVE-2019-0893 CVE-2019-0894 CVE-2019-0895 CVE-2019-0896 CVE-2019-0898 CVE-2019-0899 CVE-2019-0900 CVE-2019-0901 CVE-2019-0902.


A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0991 CVE-2019-0992 CVE-2019-0993 CVE-2019-1002 CVE-2019-1003 CVE-2019-1024 CVE-2019-1051 CVE-2019-1052.


In Apache JSPWiki 2.9.0 to 2.11.0.M2 a carefully crafted URL could execute javascript on another user's session. No information could be saved on the server or jspwiki database nor would an attacker be able to execute js on someone else's browser; only on its own browser.


A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory aka \Jet Database Engine Remote Code Execution Vulnerability.\ This affects Windows 7 Windows Server 2012 R2 Windows RT 8.1 Windows Server 2008 Windows Server 2019 Windows Server 2012 Windows 8.1 Windows Server 2016 Windows Server 2008 R2 Windows 10 Windows 10 Servers. This CVE ID is unique from CVE-2019-0538 CVE-2019-0575 CVE-2019-0576 CVE-2019-0577 CVE-2019-0578 CVE-2019-0579 CVE-2019-0580 CVE-2019-0582 CVE-2019-0583 CVE-2019-0584.


A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory aka 'Windows VBScript Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0665 CVE-2019-0667 CVE-2019-0772.


A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory aka 'GDI+ Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0618.


A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory aka \Microsoft Word Remote Code Execution Vulnerability.\ This affects Word Microsoft Office Microsoft Office Word Viewer Office 365 ProPlus Microsoft SharePoint Microsoft Office Online Server Microsoft Word Microsoft SharePoint Server.


A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory aka 'GDI+ Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0662.


A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory aka 'Microsoft Word Remote Code Execution Vulnerability'.