In removeInterfaceAddress of NetworkController.cpp there is a possible use after free. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-119496789.


In libxaac there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution in the media server with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-116019594


In ihevcd_parse_pps of ihevcd_parse_headers.c there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-130024844.


In numerous hand-crafted functions in libmpeg2 NEON registers are not preserved. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-120644655.


In libxaac there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-117100617


In huff_dec_1D of nlc_dec.cpp there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-119292397.


In libxaac there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-117660045


In ihevcd_sao_shift_ctb of ihevcd_sao.c there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-130023983.


In libxaac there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-118149009


In FindSharedFunctionInfo of objects.cc there is a possible out of bounds read due to a mistake in AST traversal. This could lead to remote code execution in the pacprocessor with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-8.1 Android-9 Android ID: A-138442295


In libxaac there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-112705155


In UpdateLoadElement of ic.cc there is a possible out-of-bounds write due to type confusion. This could lead to remote code execution in the proxy auto-config with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9 Android ID: A-117607414


In libxaac there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-112707186


In libxaac there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-115907334


In libxaac there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-117495362


In libxaac there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-116117112


In VlcDequantH263IntraBlock_SH of vlc_dequant.cpp there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-136173699


Dell SupportAssist Client versions prior to 3.2.0.90 contain a remote code execution vulnerability. An unauthenticated attacker sharing the network access layer with the vulnerable system can compromise the vulnerable system by tricking a victim user into downloading and executing arbitrary executables via SupportAssist client from attacker hosted sites.


Mitigates a remote code execution issue in ArcSight Logger versions prior to 6.7.


Mitigates a potential remote code execution issue in ArcSight Logger versions prior to 6.7.


Atlassian Bitbucket Data Center licensed instances starting with version 5.13.0 before 5.13.6 (the fixed version for 5.13.x) from 5.14.0 before 5.14.4 (fixed version for 5.14.x) from 5.15.0 before 5.15.3 (fixed version for 5.15.x) from 5.16.0 before 5.16.3 (fixed version for 5.16.x) from 6.0.0 before 6.0.3 (fixed version for 6.0.x) and from 6.1.0 before 6.1.2 (the fixed version for 6.1.x) allow remote attackers who have admin permissions to achieve remote code execution on a Bitbucket server instance via path traversal through the Data Center migration tool.


The Widget Connector macro in Atlassian Confluence Server before version 6.6.12 (the fixed version for 6.6.x) from version 6.7.0 before 6.12.3 (the fixed version for 6.12.x) from version 6.13.0 before 6.13.3 (the fixed version for 6.13.x) and from version 6.14.0 before 6.14.2 (the fixed version for 6.14.x) allows remote attackers to achieve path traversal and remote code execution on a Confluence Server or Data Center instance via server-side template injection.


Incorrect sanitation of the 302 redirect field in HTTP transport method of apt versions 1.4.8 and earlier can lead to content injection by a MITM attacker potentially leading to remote code execution on the target machine.


A potential security vulnerability has been identified in Micro Focus Network Automation Software 9.20 9.21 10.00 10.10 10.20 10.30 10.40 10.50 2018.05 2018.08 2018.11 and Micro Focus Network Operations Management (NOM) all versions. The vulnerability could be remotely exploited to Remote Code Execution.


Confluence Server and Data Center had a path traversal vulnerability in the downloadallattachments resource. A remote attacker who has permission to add attachments to pages and / or blogs or to create a new space or a personal space or who has 'Admin' permissions for a space can exploit this path traversal vulnerability to write files to arbitrary locations which can lead to remote code execution on systems that run a vulnerable version of Confluence Server or Data Center. All versions of Confluence Server from 2.0.0 before 6.6.13 (the fixed version for 6.6.x) from 6.7.0 before 6.12.4 (the fixed version for 6.12.x) from 6.13.0 before 6.13.4 (the fixed version for 6.13.x) from 6.14.0 before 6.14.3 (the fixed version for 6.14.x) and from 6.15.0 before 6.15.2 are affected by this vulnerability.


An issue was discovered in Mattermost Packages before 5.16.3. A Droplet could allow Internet access to a service that has a remote code execution problem.


The HTTP API in Prismview System 9 11.10.17.00 and Prismview Player 11 13.09.1100 allows remote code execution by uploading RebootSystem.lnk and requesting /REBOOTSYSTEM or /RESTARTVNC. (Authentication is required but an XML file containing credentials can be downloaded.)


In ruamel.yaml through 0.16.7 the load method allows remote code execution if the application calls this method with an untrusted argument. In other words this issue affects developers who are unaware of the need to use methods such as safe_load in these use cases.


An issue was discovered on Alcatel-Lucent OmniVista 8770 devices before 4.1.2. An authenticated remote attacker with elevated privileges in the Web Directory component on port 389 may upload a PHP file to achieve Remote Code Execution as SYSTEM.


A problem was found in Pydio Core before 8.2.4 and Pydio Enterprise before 8.2.4. A PHP object injection is present in the page plugins/uploader.http/HttpDownload.php. An authenticated user with basic privileges can inject objects and achieve remote code execution.


Trend Micro Anti-Threat Toolkit (ATTK) versions 1.62.0.1218 and below have a vulnerability that may allow an attacker to place malicious files in the same directory potentially leading to arbitrary remote code execution (RCE) when executed. Another attack vector similar to CVE-2019-9491 was idenitfied and resolved in version 1.62.0.1228 of the tool.


The way in which velocity templates were used in Atlassian Jira Server and Data Center prior to version 8.8.0 allowed remote attackers to gain remote code execution if they were able to exploit a server side template injection vulnerability.


A

problem

was

found

in

Pydio

Core

before

and

Pydio

Enterprise

before

A

PHP

object

injection

is

present

in

the

page

An

authenticated

user

with

basic

privileges

can

inject

objects

and

achieve

remote

code

execution.


MyWebSQL 3.7 has a remote code execution (RCE) vulnerability after an attacker writes shell code into the database and executes the Backup Database function with a .php filename for the backup's archive file.


A vulnerability in SonicWall Email Security appliance allow an unauthenticated user to perform remote code execution. This vulnerability affected Email Security Appliance version 10.0.2 and earlier.


A remote code execution vulnerability exists in Magento Open Source prior to 1.9.4.2 and Magento Commerce prior to 1.14.4.2 Magento 2.1 prior to 2.1.18 Magento 2.2 prior to 2.2.9 Magento 2.3 prior to 2.3.2. An authenticated user with admin privileges to create sitemaps can execute arbitrary PHP code by creating a malicious sitemap file.


Adobe Media Encoder version 13.0.2 has a use-after-free vulnerability. Successful exploitation could lead to remote code execution.


FUDForum 3.0.9 is vulnerable to Stored XSS via the nlogin parameter. This may result in remote code execution. An attacker can use a user account to fully compromise the system using a POST request. When the admin visits the user information the payload will execute. This will allow for PHP files to be written to the web root and for code to execute on the remote server.


Enterprise Access Client Auto-Updater allows for Remote Code Execution prior to version 2.0.1.


A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). An attacker with network access to the Application Server could gain remote code execution by sending specifically crafted packets to 8888/tcp. Please note that an attacker needs to have network access to the Application Server in order to exploit this vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known.


A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 Server can cause a Denial-of-Service condition and potentially gain remote code execution by sending specifically crafted packets to 5010/tcp. This vulnerability is independent from CVE-2019-18323 CVE-2019-18325 CVE-2019-18326 CVE-2019-18327 CVE-2019-18328 CVE-2019-18329 and CVE-2019-18330. Please note that an attacker needs to have network access to the MS3000 in order to exploit this vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known.


A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 Server can cause a Denial-of-Service condition and potentially gain remote code execution by sending specifically crafted packets to 5010/tcp. This vulnerability is independent from CVE-2019-18323 CVE-2019-18324 CVE-2019-18325 CVE-2019-18326 CVE-2019-18327 CVE-2019-18329 and CVE-2019-18330. Please note that an attacker needs to have network access to the MS3000 in order to exploit this vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known.


eQ-3 Homematic CCU2 2.47.20 and CCU3 3.47.18 with the Script Parser AddOn through 1.8 installed allow Remote Code Execution by unauthenticated attackers with access to the web interface via the exec.cgi script which executes TCL script content from an HTTP POST request.


A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 Server could cause a Denial-of-Service condition and potentially gain remote code execution by sending specifically crafted packets to 5010/tcp. This vulnerability is independent from CVE-2019-18323 CVE-2019-18324 CVE-2019-18325 CVE-2019-18326 CVE-2019-18327 CVE-2019-18328 and CVE-2019-18329. Please note that an attacker needs to have network access to the MS3000 in order to exploit this vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known.


A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). An attacker with valid authentication at the RMI interface could be able to gain remote code execution through an unsecured file upload. Please note that an attacker needs to have access to the Application Highway in order to exploit this vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known.


A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 Server can cause a Denial-of-Service condition and potentially gain remote code execution by sending specifically crafted packets to 5010/tcp. This vulnerability is independent from CVE-2019-18323 CVE-2019-18324 CVE-2019-18325 CVE-2019-18326 CVE-2019-18327 CVE-2019-18328 and CVE-2019-18330. Please note that an attacker needs to have network access to the MS3000 in order to exploit this vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known.


A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 Server could trigger a Denial-of-Service condition and potentially gain remote code execution by sending specifically crafted packets to port 5010/tcp. This vulnerability is independent from CVE-2019-18289 CVE-2019-18293 and CVE-2019-18296. Please note that an attacker needs to have network access to the MS3000 in order to exploit this vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known.


A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 Server could trigger a Denial-of-Service condition and potentially gain remote code execution by sending specifically crafted packets to port 5010/tcp. This vulnerability is independent from CVE-2019-18293 CVE-2019-18295 and CVE-2019-18296. Please note that an attacker needs to have network access to the MS3000 in order to exploit this vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known.


FUDForum 3.0.9 is vulnerable to Stored XSS via the User-Agent HTTP header. This may result in remote code execution. An attacker can use a user account to fully compromise the system via a GET request. When the admin visits user information under \User Manager\ in the control panel the payload will execute. This will allow for PHP files to be written to the web root and for code to execute on the remote server. The problem is in admsession.php and admuser.php.


A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). An attacker with network access to the Application Server could gain remote code execution by sending specifically crafted objects via RMI. Please note that an attacker needs to have network access to the Application Server in order to exploit this vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known.


A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 Server can cause a Denial-of-Service condition and potentially gain remote code execution by sending specifically crafted packets to 5010/tcp. This vulnerability is independent from CVE-2019-18323 CVE-2019-18324 CVE-2019-18326 CVE-2019-18327 CVE-2019-18328 CVE-2019-18329 and CVE-2019-18330. Please note that an attacker needs to have network access to the MS3000 in order to exploit this vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known.


A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 Server could trigger a Denial-of-Service condition and potentially gain remote code execution by sending specifically crafted packets to port 5010/tcp. This vulnerability is independent from CVE-2019-18289 CVE-2019-18295 and CVE-2019-18296. Please note that an attacker needs to have network access to the MS3000 in order to exploit this vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known.


SibSoft Xfilesharing through 2.5.1 allows cgi-bin/up.cgi arbitrary file upload. This can be combined with CVE-2019-18951 to achieve remote code execution via a .html file containing short codes that is served over HTTP.


A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 Server could cause a Denial-of-Service condition and potentially gain remote code execution by sending specifically crafted packets to 5010/tcp. This vulnerability is independent from CVE-2019-18324 CVE-2019-18325 CVE-2019-18326 CVE-2019-18327 CVE-2019-18328 CVE-2019-18329 and CVE-2019-18330. Please note that an attacker needs to have network access to the MS3000 in order to exploit this vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known.


A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). The AdminService is available without authentication on the Application Server. An attacker can gain remote code execution by sending specifically crafted objects to one of its functions. Please note that an attacker needs to have access to the Application Highway in order to exploit this vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known.


eQ-3 Homematic CCU2 2.47.20 and CCU3 3.47.18 with the E-Mail AddOn through 1.6.8.c installed allow Remote Code Execution by unauthenticated attackers with access to the web interface via the save.cgi script for payload upload and the testtcl.cgi script for its execution.


A vulnerability has been identified in SPPA-T3000 Application Server (All versions < Service Pack R8.2 SP2). An attacker with network access to the Application Server could gain remote code execution by sending specifically crafted packets to 1099/tcp. Please note that an attacker needs to have network access to the Application Server in order to exploit this vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known.


A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 Server can cause a Denial-of-Service condition and potentially gain remote code execution by sending specifically crafted packets to 5010/tcp. This vulnerability is independent from CVE-2019-18323 CVE-2019-18324 CVE-2019-18325 CVE-2019-18326 CVE-2019-18328 CVE-2019-18329 and CVE-2019-18330. Please note that an attacker needs to have network access to the MS3000 in order to exploit this vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known.


A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 Server could gain remote code execution by sending specifically crafted objects to one of the RPC services. Please note that an attacker needs to have network access to the MS3000 in order to exploit this vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known.


An issue was discovered in Orckestra C1 CMS through 6.6. The EntityTokenSerializer class in Composite.dll is prone to unvalidated deserialization of wrapped BinaryFormatter payloads leading to arbitrary remote code execution for any low-privilege user.


eQ-3 Homematic CCU2 2.47.20 and CCU3 3.47.18 with the HM-Print AddOn through 1.2a installed allow Remote Code Execution by unauthenticated attackers with access to the web interface via the exec.cgi and exec1.cgi scripts which execute TCL script content from an HTTP POST request.


A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 Server can cause a Denial-of-Service condition and potentially gain remote code execution by sending specifically crafted packets to 5010/tcp. This vulnerability is independent from CVE-2019-18323 CVE-2019-18324 CVE-2019-18325 CVE-2019-18327 CVE-2019-18328 CVE-2019-18329 and CVE-2019-18330. Please note that an attacker needs to have network access to the MS3000 in order to exploit this vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known.


Progress Telerik UI for ASP.NET AJAX through 2019.3.1023 contains a .NET deserialization vulnerability in the RadAsyncUpload function. This is exploitable when the encryption keys are known due to the presence of CVE-2017-11317 or CVE-2017-11357 or other means. Exploitation can result in remote code execution. (As of 2020.1.114 a default setting prevents the exploit. In 2019.3.1023 but not earlier versions a non-default setting can prevent exploitation.)


A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 Server could trigger a Denial-of-Service condition and potentially gain remote code execution by sending specifically crafted packets to port 5010/tcp. This vulnerability is independent from CVE-2019-18289 CVE-2019-18293 and CVE-2019-18295. Please note that an attacker needs to have network access to the MS3000 in order to exploit this vulnerability. At the time of advisory publication no public exploitation of this security vulnerability was known.


Rock RMS versions before 8.10 and versions 9.0 through 9.3 fails to properly validate files uploaded in the application. The only protection mechanism is a file-extension blacklist that can be bypassed by adding multiple spaces and periods after the file name. This could allow an attacker to upload ASPX code and gain remote code execution on the application. The application typically runs as LocalSystem as mandated in the installation guide. Patched in versions 8.10 and 9.4.


In GitLab EE 11.3 through 12.5.3 12.4.5 and 12.3.8 insufficient parameter sanitization for the Maven package registry could lead to privilege escalation and remote code execution vulnerabilities under certain conditions.


AjaxRestrictedCmdStat in zap in Ruckus Wireless Unleashed through 200.7.10.102.64 allows remote code execution via a POST request that uses tools/_rcmdstat.jsp to write to a specified filename.


The Strapi framework before 3.0.0-beta.17.8 is vulnerable to Remote Code Execution in the Install and Uninstall Plugin components of the Admin panel because it does not sanitize the plugin name and attackers can inject arbitrary shell commands to be executed by the execa function.


** DISPUTED ** Pandora FMS 7.x suffers from remote code execution vulnerability. With an authenticated user who can modify the alert system it is possible to define and execute commands as root/Administrator. NOTE: The product vendor states that the vulnerability as it is described is not in fact an actual vulnerability. They state that to be able to create alert commands you need to have admin rights. They also state that the extended ACL system can disable access to specific sections of the configuration such as defining new alert commands.


In IXP EasyInstall 6.2.13723 there is Remote Code Execution via the Agent Service. An unauthenticated attacker can communicate with the Agent Service over TCP port 20051 and execute code in the NT AUTHORITY\\SYSTEM context of the target system by using the Execute Command Line function.


Netis WF2419 is vulnerable to authenticated Remote Code Execution (RCE) as root through the router Web management page. The vulnerability has been found in firmware version V1.2.31805 and V2.2.36123. After one is connected to this page it is possible to execute system commands as root through the tracert diagnostic tool because of lack of user input sanitizing.


D-Link DAP-1860 devices before v1.04b03 Beta allow arbitrary remote code execution as root without authentication via shell metacharacters within an HNAP_AUTH HTTP header.


There is Authenticated remote code execution in Centreon Infrastructure Monitoring Software through 19.10 via Pollers misconfiguration leading to system compromise via apache crontab misconfiguration This allows the apache user to modify an executable file executed by root at 22:30 every day. To exploit the vulnerability someone must have Admin access to the Centreon Web Interface and create a custom main.php?p=60803&type=3 command. The user must then set the Pollers Post-Restart Command to this previously created command via the main.php?p=60901&o=c&server_id=1 URI. This is triggered via an export of the Poller Configuration.


An

issue

was

discovered

in

Squiz

Matrix

CMS

prior

to

prior

to

prior

to

and

prior

to

where

a

user

can

trigger

arbitrary

unserialization

of

a

PHP

object

from

a

POST

parameter

during

processing

of

a

Remote

Content

page

type.

This

unserialization

can

be

used

to

trigger

the

inclusion

of

arbitrary

files

on

the

filesystem

(local

file

inclusion)

and

results

in

remote

code

execution.


Tobesoft Nexacro v2019.9.25.1 and earlier version have an arbitrary code execution vulnerability by using method supported by Nexacro14 ActiveX Control. It allows attacker to cause remote code execution.


Tobesoft XPlatform v9.1 9.2.0 9.2.1 and 9.2.2 have a vulnerability that can load unauthorized DLL files. It allows attacker to cause remote code execution.


In IXP EasyInstall 6.2.13723 there is Remote Code Execution via weak permissions on the Engine Service share. The default file permissions of the IXP$ share on the server allows modification of directories and files (e.g. bat-scripts) which allows execution of code in the context of NT AUTHORITY\\SYSTEM on the target server and clients.


A vulnerability reported in Lenovo Service Bridge before version 4.1.0.1 could allow remote code execution.


An issue was discovered in BlogEngine.NET through 3.3.6.0. A path traversal and Local File Inclusion vulnerability in PostList.ascx.cs can cause unauthenticated users to load a PostView.ascx component from a potentially untrusted location on the local filesystem. This is especially dangerous if an authenticated user uploads a PostView.ascx file using the file manager utility which is currently allowed. This results in remote code execution for an authenticated user.


Forcepoint User ID (FUID) server versions up to 1.2 have a remote arbitrary file upload vulnerability on TCP port 5001. Successful exploitation of this vulnerability may lead to remote code execution. To fix this vulnerability upgrade to FUID version 1.3 or higher. To prevent the vulnerability on FUID versions 1.2 and below apply local firewall rules on the FUID server to disable all external access to port TCP/5001. FUID requires this port only for local connections through the loopback interface.


In Drupal Core versions 7.x prior to 7.62 8.6.x prior to 8.6.6 and 8.5.x prior to 8.5.9; A remote code execution vulnerability exists in PHP's built-in phar stream wrapper when performing file operations on an untrusted phar:// URI. Some Drupal code (core contrib and custom) may be performing file operations on insufficiently validated user input thereby being exposed to this vulnerability. This vulnerability is mitigated by the fact that such code paths typically require access to an administrative permission or an atypical configuration.


Panasonic FPWIN Pro version 7.3.0.0 and prior allows attacker-created project files to be loaded by an authenticated user triggering incompatible type errors because the resource does not have expected properties. This may lead to remote code execution.


In Artifex Ghostscript through 9.26 ephemeral or transient procedures can allow access to system operators leading to remote code execution.


A Use After Free: CWE-416 vulnerability exists in Zelio Soft 2 V5.2 and earlier which could cause remote code execution when opening a specially crafted Zelio Soft 2 project file.


An exploitable out-of-bounds write vulnerability exists in the TIFreadstripdata function of the igcore19d.dll library of Accusoft ImageGear 19.5.0. A specially crafted TIFF file file can cause an out-of-bounds write resulting in a remote code execution. An attacker needs to provide a malformed file to the victim to trigger the vulnerability.


An exploitable format string vulnerability exists in the iw_console conio_writestr functionality of the Moxa AWK-3131A firmware version 1.13. A specially crafted time server entry can cause an overflow of the time server buffer resulting in remote code execution. An attacker can send commands while authenticated as a low privilege user to trigger this vulnerability.


The Nexus Yum Repository Plugin in v2 is vulnerable to Remote Code Execution when instances using CommandLineExecutor.java are supplied vulnerable data such as the Yum Configuration Capability.


An exploitable remote code execution vulnerability exists in the iw_webs configuration parsing functionality of the Moxa AWK-3131A firmware version 1.13. A specially crafted user name entry can cause an overflow of an error message buffer resulting in remote code execution. An attacker can send commands while authenticated as a low privilege user to trigger this vulnerability.


An exploitable out-of-bounds write vulnerability exists in the igcore19d.dll TIFdecodethunderscan function of Accusoft ImageGear 19.3.0 library. A specially crafted TIFF file can cause an out of bounds write resulting in a remote code execution. An attacker needs to provide a malformed file to the victim to trigger the vulnerability.


An exploitable out-of-bounds write vulnerability exists in the igcore19d.dll PNG header-parser of the Accusoft ImageGear 19.3.0 library. A specially crafted PNG file can cause an out-of-bounds write resulting in a remote code execution. An attacker needs to provide a malformed file to the viction to trigger the vulnerability.


An exploitable use after free vulnerability exists in the window function functionality of Sqlite3 3.26.0. A specially crafted SQL command can cause a use after free vulnerability potentially resulting in remote code execution. An attacker can send a malicious SQL command to trigger this vulnerability.


A remote code execution vulnerability in development mode Rails <5.2.2.1 <6.0.0.beta3 can allow an attacker to guess the automatically generated development mode secret token. This secret token can be used in combination with other Rails internals to escalate to a remote code execution exploit.


An exploitable out-of-bounds write vulnerability exists in the igcore19d.dll BMP parser of the ImageGear 19.3.0 library. A specially crafted BMP file can cause an out-of-bounds write resulting in a remote code execution. An attacker needs to provide a malformed file to the victim to trigger the vulnerability.


An exploitable remote code execution vulnerability exists in the Cloud Connectivity functionality of WAGO PFC200 versions 03.02.02(14) 03.01.07(13) and 03.00.39(12). A specially crafted XML file will direct the Cloud Connectivity service to download and execute a shell script with root privileges.


An exploitable out-of-bounds write vulnerability exists in the igcore19d.dll GEM Raster parser of the Accusoft ImageGear 19.3.0 library. A specially crafted GEM file can cause an out-of-bounds write resulting in a remote code execution. An attacker needs to provide a malformed file to the victim to trigger the vulnerability.


An exploitable heap underflow vulnerability exists in the derive_taps_and_gains function in kdu_v7ar.dll of Kakadu Software SDK 7.10.2. A specially crafted jp2 file can cause a heap overflow which can result in remote code execution. An attacker could provide a malformed file to the victim to trigger this vulnerability.


Exim 4.85 through 4.92 (fixed in 4.92.1) allows remote code execution as root in some unusual configurations that use the ${sort } expansion for items that can be controlled by an attacker (e.g. $local_part or $domain).


In Directus 7 API through 2.3.0 uploading of PHP files is blocked only when the Apache HTTP Server is used leading to uploads/_/originals remote code execution with nginx.


In Directus 7 API before 2.2.1 uploading of PHP files is not blocked leading to uploads/_/originals remote code execution.


The Zoom Client before 4.4.53932.0709 on macOS allows remote code execution a different vulnerability than CVE-2019-13450. If the ZoomOpener daemon (aka the hidden web server) is running but the Zoom Client is not installed or can't be opened an attacker can remotely execute code with a maliciously crafted launch URL. NOTE: ZoomOpener is removed by the Apple Malware Removal Tool (MRT) if this tool is enabled and has the 2019-07-10 MRTConfigData.


Chamilo LMS 1.11.8 and 2.x allows remote code execution through an lp_upload.php unauthenticated file upload feature. It extracts a ZIP archive before checking its content and once it has been extracted does not check files in a recursive way. This means that by putting a .php file in a folder and then this folder in a ZIP archive the server will accept this file without any checks. Because one can access this file from the website it is remote code execution. This is related to a scorm imsmanifest.xml file the import_package function and extraction in $courseSysDir.$newDir.


In WebAccess versions 8.4.1 and prior an exploit executed over the network may cause improper control of generation of code which may allow remote code execution data exfiltration or cause a system crash.


CODESYS V3 web server all versions prior to 3.5.14.10 allows an attacker to send specially crafted http or https requests which could cause a stack overflow and create a denial-of-service condition or allow remote code execution.


In WebAccess versions 8.4.1 and prior an improper authorization vulnerability may allow an attacker to disclose sensitive information cause improper control of generation of code which may allow remote code execution or cause a system crash.


A vulnerable upl/async_upload.asp web API endpoint in Ivanti LANDESK Management Suite (LDMS aka Endpoint Manager) 10.0.1.168 Service Update 5 allows arbitrary file upload which may lead to arbitrary remote code execution.


lib/Controller/ExtractionController.php in the Extract add-on before 1.2.0 for Nextcloud allows Remote Code Execution via shell metacharacters in a RAR filename via ajax/extractRar.php (nameOfFile and directory parameters).


A remote code execution vulnerability exists in MapR CLDB code specifically in the JSON framework that is used in the CLDB code that handles login and ticket issuance. An attacker can use the 'class' property of the JSON request sent to the CLDB to influence the JSON library's decision on which Java class this JSON request is deserialized to. By doing so the attacker can force the MapR CLDB to construct a URLClassLoader which loads a malicious Java class from a remote path and instantiate this object in the MapR CLDB thus executing arbitrary code on the machine running the MapR CLDB and take over the cluster. By switching to the newer Jackson library and ensuring that all incoming JSON requests are only deserialized to the same class that it was serialized from the vulnerability is fixed. This vulnerability affects the entire MapR core platform.


Four-Faith Wireless Mobile Router F3x24 v1.0 devices allow remote code execution via the Command Shell (aka Administration > Commands) screen.


Bludit before 3.9.0 allows remote code execution for an authenticated user by uploading a php file while changing the logo through /admin/ajax/upload-logo.


An issue was discovered in PHOENIX CONTACT PC Worx through 1.86 PC Worx Express through 1.86 and Config+ through 1.86. A manipulated PC Worx or Config+ project file could lead to a Use-After-Free and remote code execution. The attacker needs to get access to an original PC Worx or Config+ project file to be able to manipulate it. After manipulation the attacker needs to exchange the original file with the manipulated one on the application programming workstation.


ubuntu-server.js in Status React Native Desktop before v0.57.8_mobile_ui allows Remote Code Execution.


SiteVision 4 allows Remote Code Execution.


An issue was discovered in PHOENIX CONTACT PC Worx through 1.86 PC Worx Express through 1.86 and Config+ through 1.86. A manipulated PC Worx or Config+ project file could lead to an Uninitialized Pointer and remote code execution. The attacker needs to get access to an original PC Worx or Config+ project file to be able to manipulate it. After manipulation the attacker needs to exchange the original file with the manipulated one on the application programming workstation.


FasterXML jackson-databind 2.x before 2.9.9.1 might allow attackers to have a variety of impacts by leveraging failure to block the logback-core class from polymorphic deserialization. Depending on the classpath content remote code execution may be possible.


In createInstanceFromNamedArguments in Shopware through 5.6.x a crafted web request can trigger a PHP object instantiation vulnerability which can result in an arbitrary deserialization if the right class is instantiated. An attacker can leverage this deserialization to achieve remote code execution. NOTE: this issue is a bypass for a CVE-2017-18357 whitelist patch.


An issue was discovered in SSHServerAPI.dll in Progress ipswitch WS_FTP Server 2018 before 8.6.1. Attackers have the ability to abuse a path traversal vulnerability using the SCP protocol. Attackers who leverage this flaw could also obtain remote code execution by crafting a payload that abuses the SITE command feature.


An issue was discovered in the Core Server in Ivanti Endpoint Manager (EPM) 2017.3 before SU7 and 2018.x before 2018.3 SU3 with remote code execution. In other words the issue affects 2017.3 2018.1 and 2018.3 installations that lack the April 2019 update.


In Godot through 3.1 remote code execution is possible due to the deserialization policy not being applied correctly.


The code which checks HMAC in form submissions used String.equals() for comparisons which results in a timing side channel for the comparison of the HMAC signatures. This could lead to remote code execution if an attacker is able to determine the correct signature for their payload. The comparison should be done with a constant time algorithm instead.


An issue was discovered in Kentico 12.0.x before 12.0.15 11.0.x before 11.0.48 10.0.x before 10.0.52 and 9.x versions. Due to a failure to validate security headers it was possible for a specially crafted request to the staging service to bypass the initial authentication and proceed to deserialize user-controlled .NET object input. This deserialization then led to unauthenticated remote code execution on the server where the Kentico instance was hosted.


In Advantech WebAccess HMI Designer Version 2.1.9.23 and prior processing specially crafted MCR files lacking proper validation of user supplied data may cause the system to write outside the intended buffer area allowing remote code execution.


Geutebruck

IP

Cameras

G-Cam(EBC-21xx/EFD-22xx/ETHC-22xx/EWPC-22xx):

All

versions

and

prior

may

allow

a

remote

authenticated

attacker

with

access

to

network

configuration

to

supply

system

commands

to

the

server

leading

to

remote

code

execution

as

root.


mongo-express before 0.54.0 is vulnerable to Remote Code Execution via endpoints that uses the `toBSON` method. A misuse of the `vm` dependency to perform `exec` commands in a non-safe environment.


In Symfony before 2.7.51 2.8.x before 2.8.50 3.x before 3.4.26 4.x before 4.1.12 and 4.2.x before 4.2.7 when service ids allow user input this could allow for SQL Injection and remote code execution. This is related to symfony/dependency-injection.


In WebAccess/SCADA Versions 8.3.5 and prior multiple out-of-bounds write vulnerabilities are caused by a lack of proper validation of the length of user-supplied data. Exploitation of these vulnerabilities may allow remote code execution.


In Teeworlds 0.7.2 there is a failed bounds check in CDataFileReader::GetData() and CDataFileReader::ReplaceData() and related functions in engine/shared/datafile.cpp that can lead to an arbitrary free and out-of-bounds pointer write possibly resulting in remote code execution.


Fred

MODX

Revolution

is

affected

by:

Incorrect

Access

Control

The

impact

is:

Remote

Code

Execution.

The

component

is:

The

attack

vector

is:

Uploading

a

PHP

file

or

change

data

in

the

database.

The

fixed

version

is:

and


In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pigeonhole before 0.5.7.2) protocol processing can fail for quoted strings. This occurs because '\\0' characters are mishandled and can lead to out-of-bounds writes and remote code execution.


Sitecore Experience Platform (XP) prior to 9.1.1 is vulnerable to remote code execution via deserialization aka TFS # 293863. An authenticated user with necessary permissions is able to remotely execute OS commands by sending a crafted serialized object.


OpenKM 6.3.2 through 6.3.7 allows an attacker to upload a malicious JSP file into the /okm:root directories and move that file to the home directory of the site via frontend/FileUpload and admin/repository_export.jsp. This is achieved by interfering with the Filesystem path control in the admin's Export field. As a result attackers can gain remote code execution through the application server with root privileges.


SimplyBook.me through 2019-05-11 does not properly restrict File Upload which could allow remote code execution.


An argument injection vulnerability in Atlassian Sourcetree for Windows's URI handlers in all versions prior to 3.1.3 allows remote attackers to gain remote code execution through the use of a crafted URI.


Atlassian Crowd and Crowd Data Center had the pdkinstall development plugin incorrectly enabled in release builds. Attackers who can send unauthenticated or authenticated requests to a Crowd or Crowd Data Center instance can exploit this vulnerability to install arbitrary plugins which permits remote code execution on systems running a vulnerable version of Crowd or Crowd Data Center. All versions of Crowd from version 2.1.0 before 3.0.5 (the fixed version for 3.0.x) from version 3.1.0 before 3.1.6 (the fixed version for 3.1.x) from version 3.2.0 before 3.2.8 (the fixed version for 3.2.x) from version 3.3.0 before 3.3.5 (the fixed version for 3.3.x) and from version 3.4.0 before 3.4.4 (the fixed version for 3.4.x) are affected by this vulnerability.


TeamSpeak 3 Client before 3.2.5 allows remote code execution in the Qt framework.


TYPO3 8.x before 8.7.25 and 9.x before 9.5.6 allows remote code execution because it does not properly configure the applications used for image processing as demonstrated by ImageMagick or GraphicsMagick.


** DISPUTED ** admin/app/mediamanager in Schlix CMS 2.1.8-7 allows Authenticated Unrestricted File Upload leading to remote code execution. NOTE: \While inadvertently allowing a PHP file to be uploaded via Media Manager was an oversight it still requires an admin permission. We think it's pretty rare for an administrator to exploit a bug on his/her own site to own his/her own site.\


An invalid free in mb_detect_order can cause the application to crash or potentially result in remote code execution. This issue affects HHVM versions prior to 3.30.12 all versions between 4.0.0 and 4.8.5 all versions between 4.9.0 and 4.23.1 as well as 4.24.0 4.25.0 4.26.0 4.27.0 4.28.0 and 4.28.1.


models/repo_mirror.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 mishandles mirror repo URL settings leading to remote code execution.


In PHP versions 7.1.x below 7.1.33 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data thus opening the possibility of remote code execution.


Akamai CloudTest before 58.30 allows remote code execution.


The client in Electronic Arts (EA) Origin 10.5.36 on Windows allows template injection in the title parameter of the Origin2 URI handler. This can be used to escape the underlying AngularJS sandbox and achieve remote code execution via an origin2://game/launch URL for QtApplication QDesktopServices communication.


A Remote Code Execution vulnerability exists in PRTG Network Monitor before 19.4.54.1506 that allows attackers to execute code due to insufficient sanitization when passing arguments to the HttpTransactionSensor.exe binary. In order to exploit the vulnerability remote authenticated administrators need to create a new HTTP Transaction Sensor and set specific settings when the sensor is executed.


Insufficient boundary checks when formatting numbers in number_format allows read/write access to out-of-bounds memory potentially leading to remote code execution. This issue affects HHVM versions prior to 3.30.10 all versions between 4.0.0 and 4.8.5 all versions between 4.9.0 and 4.18.2 and versions 4.19.0 4.19.1 4.20.0 4.20.1 4.20.2 4.21.0 4.22.0 4.23.0.


VMware GemFire versions prior to 9.10.0 9.9.1 9.8.5 and 9.7.5 and VMware Tanzu GemFire for VMs versions prior to 1.11.0 1.10.1 1.9.2 and 1.8.2 contain a JMX service available to the network which does not properly restrict input. A remote authenticated malicious user may request against the service with a crafted set of credentials leading to remote code execution.


The server component of TIBCO Software Inc.'s TIBCO Enterprise Runtime for R - Server Edition and TIBCO Spotfire Analytics Platform for AWS Marketplace contains a vulnerability that theoretically allows an authenticated user to trigger remote code execution in certain circumstances. When the affected component runs with the containerized TERR service on Linux the host can theoretically be tricked into running malicious code. This issue affects: TIBCO Enterprise Runtime for R - Server Edition version 1.2.0 and below and TIBCO Spotfire Analytics Platform for AWS Marketplace 10.4.0; 10.5.0.


Bitbucket Server and Bitbucket Data Center from version 4.13. before 5.16.11 from version 6.0.0 before 6.0.11 from version 6.1.0 before 6.1.9 from version 6.2.0 before 6.2.7 from version 6.3.0 before 6.3.6 from version 6.4.0 before 6.4.4 from version 6.5.0 before 6.5.3 from version 6.6.0 before 6.6.3 from version 6.7.0 before 6.7.3 from version 6.8.0 before 6.8.2 from version 6.9.0 before 6.9.1 had a Remote Code Execution vulnerability via the edit-file request. A remote attacker with write permission on a repository can write to any arbitrary file to the victims Bitbucket Server or Bitbucket Data Center instance using the edit-file endpoint if the user has Bitbucket Server or Bitbucket Data Center running and has the permission to write the file at that destination. In some cases this can result in execution of arbitrary code by the victims Bitbucket Server or Bitbucket Data Center instance.


CSZ CMS 1.2.3 allows arbitrary file upload as demonstrated by a .php file to admin/filemanager in the File Management Module which leads to remote code execution by visiting a photo/upload/2019/ URI.


The traceroute function on the TP-Link TL-WR840N v4 router with firmware through 0.9.1 3.16 is vulnerable to remote code execution via a crafted payload in an IP address input field.


The

profilegrid-user-profiles-groups-and-communities

plugin

before

for

WordPress

has

remote

code

execution

via

an

wp-admin/admin-ajax.php

request

with

the

substring

followed

by

PHP

code.


The KSLABS KSWEB (aka ru.kslabs.ksweb) application 3.93 for Android allows authenticated remote code execution via a POST request to the AJAX handler with the configFile parameter set to the arbitrary file to be written to (and the config_text parameter set to the content of the file to be created). This can be a PHP file that is written to in the public web directory and subsequently executed. The attacker must have network connectivity to the PHP server that is running on the Android device.


The ad-inserter plugin before 2.4.22 for WordPress has remote code execution.


TigerVNC version prior to 1.10.1 is vulnerable to stack use-after-return which occurs due to incorrect usage of stack memory in ZRLEDecoder. If decoding routine would throw an exception ZRLEDecoder may try to access stack variable which has been already freed during the process of stack unwinding. Exploitation of this vulnerability could potentially result into remote code execution. This attack appear to be exploitable via network connectivity.


An issue was discovered on Zolo Halo devices via the Linkplay firmware. There is Zolo Halo LAN remote code execution. The Zolo Halo Bluetooth speaker had a GoAhead web server listening on the port 80. The /httpapi.asp endpoint of the GoAhead web server was also vulnerable to multiple command execution vulnerabilities.


The Jira Importers Plugin in Atlassian Jira Server and Data Cente from version with 7.0.10 before 7.6.16 from 7.7.0 before 7.13.8 from 8.0.0 before 8.1.3 from 8.2.0 before 8.2.5 from 8.3.0 before 8.3.4 and from 8.4.0 before 8.4.1 allows remote attackers with Administrator permissions to gain remote code execution via a template injection vulnerability through the use of a crafted PUT request.


The

groundhogg

plugin

before

for

WordPress

has

wp-admin/admin-ajax.php?action=bulk_action_listener

remote

code

execution.


rpc.cgi in Webmin through 1.920 allows authenticated Remote Code Execution via a crafted object name because unserialise_variable makes an eval call. NOTE: the Webmin_Servers_Index documentation states \RPC can be used to run any command or modify any file on a server which is why access to it must not be granted to un-trusted Webmin users.\


An issue was discovered in JetBrains TeamCity 2018.2.4. It had a possible remote code execution issue. This was fixed in TeamCity 2019.1.


An issue was discovered in PRiSE adAS 1.7.0. An authenticated user can change the function used to hash passwords to any function leading to remote code execution.


eQ-3 HomeMatic CCU3 firmware version 3.41.11 allows Remote Code Execution in the ReGa.runScript method. An authenticated attacker can easily execute code and compromise the system.


The Branding Module in Viki Vera 4.9.1.26180 allows an authenticated user to change the logo on the website. An attacker could use this to upload a malicious .aspx file and gain Remote Code Execution on the site.


An issue was discovered in Tyto Sahi Pro 6.x through 8.0.0. TestRunner_Non_distributed (and distributed end points) does not have any authentication mechanism. This allow an attacker to execute an arbitrary script on the remote Sahi Pro server. There is also a password-protected web interface intended for remote access to scripts. This web interface lacks server-side validation which allows an attacker to create/modify/delete a script remotely without any password. Chaining both of these issues results in remote code execution on the Sahi Pro server.


admin/includes/class.import.snippet.php in the \Woody ad snippets\ plugin before 2.2.5 for WordPress allows unauthenticated options import as demonstrated by storing an XSS payload for remote code execution.


Incorrect authentication of application WebSocket connections in Loom Desktop for Mac up to 0.16.0 allows remote code execution from either malicious JavaScript in a browser or hosts on the same network during periods in which a user is recording a video with the application. The same attack vector can be used to crash the application at any time.


eQ-3 Homematic CCU2 and CCU3 with the XML-API through 1.2.0 AddOn installed allow Remote Code Execution by unauthenticated attackers with access to the web interface because the undocumented addons/xmlapi/exec.cgi script uses CMD_EXEC to execute TCL code from a POST request.


In Joomla! 3.9.7 and 3.9.8 inadequate filtering allows users authorised to create custom fields to manipulate the filtering options and inject an unvalidated option. In other words the filter attribute in subform fields allows remote code execution. This is fixed in 3.9.9.


eQ-3 Homematic CCU2 and CCU3 with the CUxD AddOn installed allow Remote Code Execution by unauthenticated attackers with access to the web interface because this interface can access the CMD_EXEC virtual device type 28.


cPanel before 80.0.22 allows remote code execution by a demo account because of incorrect URI dispatching (SEC-501).


RepetierServer.exe in Repetier-Server 0.8 through 0.91 does not properly validate the XML data structure provided when uploading a new printer configuration. When this is combined with CVE-2019-14450 an attacker can upload an \external command\ configuration as a printer configuration and achieve remote code execution. After exploitation loading of the external command configuration is dependent on a system reboot or service restart.


An issue was discovered in Alfresco Community Edition 5.2 201707. By leveraging multiple components in the Alfresco Software applications an exploit chain was observed that allows an attacker to achieve remote code execution on the victim machine. The attacker must upload malicious Solr configuration files and then receive a JMX connection from the victim and serve a Java object that results in deserialization and code execution.


SubTypeValidator.java

in

FasterXML

jackson-databind

before

mishandles

default

typing

when

ehcache

is

used

(because

of

net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup)

leading

to

remote

code

execution.


The Social Photo Gallery plugin 1.0 for WordPress allows Remote Code Execution by creating an album and attaching a malicious PHP file in the cover photo album because the file extension is not checked.


A flaw was found in the CloudForms management engine version 5.10 and CloudForms management version 5.11 which triggered remote code execution through NFS schedule backup. An attacker logged into the management console could use this flaw to execute arbitrary shell commands on the CloudForms server as root.


An issue was discovered on MicroDigital N-series cameras with firmware through 6400.0.8.5. The firmware update process is insecure leading to remote code execution. The attacker can provide arbitrary firmware in a .dat file via a webparam?system&action=set&upgrade URI.


The Illuminate component of Laravel Framework 5.7.x has a deserialization vulnerability that can lead to remote code execution if the content is controllable related to the __destruct method of the PendingCommand class in PendingCommand.php.


In Bluetooth there is a possible remote code execution due to an improper memory allocation. This could lead to remote code execution in Bluetooth with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-112159179


Trend Micro Anti-Threat Toolkit (ATTK) versions 1.62.0.1218 and below have a vulnerability that may allow an attacker to place malicious files in the same directory potentially leading to arbitrary remote code execution (RCE) when executed.


WordPress before 5.1.1 does not properly filter comment content leading to Remote Code Execution by unauthenticated users in a default configuration. This occurs because CSRF protection is mishandled and because Search Engine Optimization of A elements is performed incorrectly leading to XSS. The XSS results in administrative access which allows arbitrary changes to .php files. This is related to wp-admin/includes/ajax-actions.php and wp-includes/comment.php.


In Bluetooth there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-123584306


In libeffects there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-120874654


Caret before 2019-02-22 allows Remote Code Execution.


In Bluetooth there is a possible deserialization error due to missing string validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-109838537


WAC on the Sangfor Sundray WLAN Controller version 3.7.4.2 and earlier has a Remote Code Execution issue allowing remote attackers to achieve full access to the system because shell metacharacters in the nginx_webconsole.php Cookie header can be used to read an etc/config/wac/wns_cfg_admin_detail.xml file containing the admin password. (The password for root is the WebUI admin password concatenated with a static string.)


Remote code execution was discovered in Horde Groupware Webmail 5.2.22 and 5.2.17. Horde/Form/Type.php contains a vulnerable class that handles image upload in forms. When the Horde_Form_Type_image method onSubmit() is called on uploads it invokes the functions getImage() and _getUpload() which uses unsanitized user input as a path to save the image. The unsanitized POST parameter objectphotoimgfile is saved in the $uploadimgfile PHP variable allowing an attacker to manipulate the $tmp_file passed to move_uploaded_file() to save the uploaded file. By setting the parameter to (for example) ../usr/share/horde/static/bd.php one can write a PHP backdoor inside the web root. The static/ destination folder is a good candidate to drop the backdoor because it is always writable in Horde installations. (The unsanitized POST parameter went probably unnoticed because it's never submitted by the forms which default to securely using a random path.)


Jector Smart TV FM-K75 devices allow remote code execution because there is an adb open port with root permission.


ZInsVX.dll ActiveX Control 2018.02 and earlier in Zoneplayer contains a vulnerability that could allow remote attackers to execute arbitrary files by setting the arguments to the ActiveX method. This can be leveraged for remote code execution.


An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. The server allows remote code execution. Administrative users could upload an unsigned extension ZIP file containing executable code that is subsequently executed by the server.


The sr_freecap (aka freeCap CAPTCHA) extension 2.4.5 and below and 2.5.2 and below for TYPO3 fails to sanitize user input which allows execution of arbitrary Extbase actions resulting in Remote Code Execution.


In ATutor 2.2.4 an unauthenticated attacker can change the application settings and force it to use his crafted database which allows him to gain access to the application. Next he can change the directory that the application uploads files to which allows him to achieve remote code execution. This occurs because install/include/header.php does not restrict certain changes (to db_host db_login db_password and content_dir) within install/include/step5.php.


Indexhibit 2.1.5 allows a product reinstallation with resultant remote code execution via /ndxzstudio/install.php?p=2.


eQ-3 Homematic CCU2 before 2.47.18 and CCU3 before 3.47.18 allow Remote Code Execution by unauthenticated attackers with access to the web interface via an HTTP POST request to certain URLs related to the ReGa core process.


Centreon Web before 2.8.30 18.10.x before 18.10.8 19.04.x before 19.04.5 and 19.10.x before 19.10.2 allows Remote Code Execution by an administrator who can modify Macro Expression location settings. CVE-2019-16405 and CVE-2019-17501 are similar to one another and may be the same.


TylerTech

Eagle

deserializes

untrusted

user

input

resulting

in

remote

code

execution

via

a

crafted

Java

object

to

the

recorder/ServiceManager?service=tyler.empire.settings.SettingManager

URI.


Beckhoff Embedded Windows PLCs through 3.1.4024.0 and Beckhoff Twincat on Windows Engineering stations allow an attacker to achieve Remote Code Execution (as SYSTEM) via the Beckhoff ADS protocol.


In Tiny File Manager before 2.3.9 there is a remote code execution via Upload from URL and Edit/Rename files. Only authenticated users are impacted.


In OkayCMS through 2.3.4 an unauthenticated attacker can achieve remote code execution by injecting a malicious PHP object via a crafted cookie. This could happen at two places: first in view/ProductsView.php using the cookie price_filter and second in api/Comparison.php via the cookie comparison.


On Keeper K5 20.1.0.25 and 20.1.0.63 devices remote code execution can occur by inserting an SD card containing a file named zskj_script_run.sh that executes a reverse shell.


CompleteFTPService.exe in the server in EnterpriseDT CompleteFTP before 12.1.4 allows Remote Code Execution by leveraging a Windows user account that has SSH access. The exec command is always run as SYSTEM.


Apache Solr 5.0.0 to Apache Solr 8.3.1 are vulnerable to a Remote Code Execution through the VelocityResponseWriter. A Velocity template can be provided through Velocity templates in a configset `velocity/` directory or as a parameter. A user defined configset could contain renderable potentially malicious templates. Parameter provided templates are disabled by default but can be enabled by setting `params.resource.loader.enabled` by defining a response writer with that setting set to `true`. Defining a response writer requires configuration API access. Solr 8.4 removed the params resource loader entirely and only enables the configset-provided template rendering when the configset is `trusted` (has been uploaded by an authenticated user).


/var/WEB-GUI/cgi-bin/telnet.cgi on FiberHome HG2201T 1.00.M5007_JS_201804 devices allows pre-authentication remote code execution.


Footy Tipping Software AFL Web Edition 2019 allows arbitrary file upload and resultant remote code execution because a whitelist can be bypassed by an Administrator who uploads a crafted upload.dat file.


ReportLab through 3.5.26 allows remote code execution because of toColor(eval(arg)) in colors.py as demonstrated by a crafted XML document with '<span color=\' followed by arbitrary Python code.


Nokia IMPACT < 18A: An unrestricted File Upload vulnerability was found that may lead to Remote Code Execution.


qibosoft

allows

remote

code

execution

because

do/jf.php

makes

eval

calls.

The

attacker

can

use

the

Point

Introduction

Management

feature

to

supply

PHP

code

to

be

evaluated.

Alternatively

the

attacker

can

access

admin/index.php?lfj=jfadmin&action=addjf

via

CSRF

as

demonstrated

by

a

payload

in

the

content

parameter.


A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.19 Magento 2.2 prior to 2.2.10 Magento 2.3 prior to 2.3.3. An authenticated admin user with import product privileges can delete files through bulk product import and inject code into XSLT file. The combination of these manipulations can lead to remote code execution.


A server-side request forgery (SSRF) vulnerability exists in Magento 2.2 prior to 2.2.10 Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with admin privileges to modify store configurations can manipulate the connector api endpoint to enable remote code execution.


SolarWinds Orion NPM before 12.4 suffers from a SYSTEM remote code execution vulnerability in the OrionModuleEngine service. This service establishes a NetTcpBinding endpoint that allows remote unauthenticated clients to connect and call publicly exposed methods. The InvokeActionMethod method may be abused by an attacker to execute commands as the SYSTEM user.


A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10 Magento 2.3 prior to 2.3.3 or 2.3.2-p1. Dependency injection through Symphony framework allows service identifiers to be derived from user controlled data which can lead to remote code execution.


Stored XSS in Invision Power Board versions 3.3.1 - 3.4.8 leads to Remote Code Execution.


A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.19 Magento 2.2 prior to 2.2.10 Magento 2.3 prior to 2.3.3. An authenticated user with privileges to create products can craft custom layout update and use import product functionality to enable remote code execution.


A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10 Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with privileges to modify product catalogs can trigger PHP file inclusion through a crafted XML file that specifies product design update.


LiveZilla 5.0.1.4 has a Remote Code Execution vulnerability


WordPress plugin wp-cleanfix has Remote Code Execution


JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.


SQL injection vulnerability in Data Loss Protection (DLP) ePO extension 11.8.x prior to 11.8.100 11.7.x prior to 11.7.101 and 11.6.401 allows a remote authenticated attacker to inject unfiltered SQL into the DLP part of the ePO database. This could lead to remote code execution on the ePO server with privilege escalation.


OrbiTeam BSCW Classic before 7.4.3 allows authenticated remote code execution (RCE) during archive extraction via attacker-supplied Python code in the class attribute of a .bscw file. This is fixed in 5.0.12 5.1.10 5.2.4 7.3.3 and 7.4.3.


The Catch Themes Demo Import WordPress plugin is vulnerable to arbitrary file uploads via the import functionality found in the ~/inc/CatchThemesDemoImport.php file in versions up to and including 1.7 due to insufficient file type validation. This makes it possible for an attacker with administrative privileges to upload malicious files that can be used to achieve remote code execution.


BinderHub is a kubernetes-based cloud service that allows users to share reproducible interactive computing environments from code repositories. In affected versions a remote code execution vulnerability has been identified in BinderHub where providing BinderHub with maliciously crafted input could execute code in the BinderHub context with the potential to egress credentials of the BinderHub deployment including JupyterHub API tokens kubernetes service accounts and docker registry credentials. This may provide the ability to manipulate images and other user created pods in the deployment with the potential to escalate to the host depending on the underlying kubernetes configuration. Users are advised to update to version 0.2.0-n653. If users are unable to update they may disable the git repo provider by specifying the `BinderHub.repo_providers` as a workaround.


Barco MirrorOp Windows Sender before 2.5.3.65 uses cleartext HTTP and thus allows rogue software upgrades. An attacker on the local network can achieve remote code execution on any computer that tries to update Windows Sender due to the fact that the upgrade mechanism is not secured (is not protected with TLS).


Microsoft MPEG-2 Video Extension Remote Code Execution Vulnerability


Sitecore through 10.1 when Update Center is enabled allows remote authenticated users to upload arbitrary files and achieve remote code execution by visiting an uploaded .aspx file at an admin/Packages URL.


Unauthenticated remote code execution in Micro Focus Operations Bridge containerized affecting versions 2021.05 2021.08 and newer versions of Micro Focus Operations Bridge containerized if the deployment was upgraded from 2021.05 or 2021.08. The vulnerability could be exploited to unauthenticated remote code execution.


The assets/index.php Image Upload feature of the NASCENT RemKon Device Manager 4.0.0.0 allows attackers to upload any code to the target system and achieve remote code execution.


Wireless devices running certain Arcadyan-derived firmware (such as KPN Experia WiFi 1.00.15) do not properly sanitise user input to the syslog configuration form. An authenticated remote attacker could leverage this to alter the device configuration and achieve remote code execution. This can be exploited in conjunction with CVE-2021-20090.


The wp-publications WordPress plugin is vulnerable to restrictive local file inclusion via the Q_FILE parameter found in the ~/bibtexbrowser.php file which allows attackers to include local zip files and achieve remote code execution in versions up to and including 0.0.


Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability


In the Amazon AWS WorkSpaces client 3.0.10 through 3.1.8 on Windows argument injection in the workspaces:// URI handler can lead to remote code execution because of the Chromium Embedded Framework (CEF) --gpu-launcher argument. This is fixed in 3.1.9.


Open Management Infrastructure Remote Code Execution Vulnerability


Remote Code Execution can occur in Simple Water Refilling Station Management System 1.0 via the System Logo option on the system_info page in classes/SystemSettings.php with an update_settings action.


Remote

Procedure

Call

Runtime

Remote

Code

Execution

Vulnerability

This

CVE

ID

is

unique

from


Visual Studio Code Kubernetes Tools Remote Code Execution Vulnerability


Web Media Extensions Remote Code Execution Vulnerability


Remote Development Extension for Visual Studio Code Remote Code Execution Vulnerability


Visual Studio Code GitHub Pull Requests and Issues Extension Remote Code Execution Vulnerability


Windows Media Video Decoder Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-27095.


Microsoft Jet Red Database Engine and Access Connectivity Engine Remote Code Execution Vulnerability


Online

Ordering

System

is

vulnerable

to

arbitrary

file

upload

through

which

may

lead

to

remote

code

execution

(RCE).


Draeger X-Dock Firmware before 03.00.13 has Hard-Coded Credentials leading to remote code execution by an authenticated attacker.


Visual Studio Code Maven for Java Extension Remote Code Execution Vulnerability


Hyper-V Remote Code Execution Vulnerability


LUCY Security Awareness Software through 4.7.x allows unauthenticated remote code execution because the Migration Tool (in the Support section) allows upload of .php files within a system.tar.gz file. The .php file becomes accessible with a public/system/static URI.


Windows GDI+ Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-28348 CVE-2021-28349.


Windows GDI+ Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-28349 CVE-2021-28350.


Draeger X-Dock Firmware before 03.00.13 has Active Debug Code on a debug port leading to remote code execution by an authenticated attacker.


Windows GDI+ Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-28348 CVE-2021-28350.


Mark Text through 0.16.3 allows attackers arbitrary command execution. This could lead to Remote Code Execution (RCE) by opening .md files containing a mutation Cross Site Scripting (XSS) payload.


A remote server side request forgery (SSRF) remote code execution vulnerability was discovered in Aruba ClearPass Policy Manager version(s) prior to 6.9.5 6.8.9 6.7.14-HF1. Aruba has released patches for Aruba ClearPass Policy Manager that address this security vulnerability.


Composer is a dependency manager for PHP. URLs for Mercurial repositories in the root composer.json and package source download URLs are not sanitized correctly. Specifically crafted URL values allow code to be executed in the HgDriver if hg/Mercurial is installed on the system. The impact to Composer users directly is limited as the composer.json file is typically under their own control and source download URLs can only be supplied by third party Composer repositories they explicitly trust to download and execute source code from e.g. Composer plugins. The main impact is to services passing user input to Composer including Packagist.org and Private Packagist. This allowed users to trigger remote code execution. The vulnerability has been patched on Packagist.org and Private Packagist within 12h of receiving the initial vulnerability report and based on a review of logs to the best of our knowledge was not abused by anyone. Other services/tools using VcsRepository/VcsDriver or derivatives may also be vulnerable and should upgrade their composer/composer dependency immediately. Versions 1.10.22 and 2.0.13 include patches for this issue.


Ratpack is a toolkit for creating web applications. In versions prior to 1.9.0 a malicious attacker can achieve Remote Code Execution (RCE) via a maliciously crafted Java deserialization gadget chain leveraged against the Ratpack session store. If one's application does not use Ratpack's session mechanism it is not vulnerable. Ratpack 1.9.0 introduces a strict allow-list mechanism that mitigates this vulnerability when used. Two possible workarounds exist. The simplest mitigation for users of earlier versions is to reduce the likelihood of attackers being able to write to the session data store. Alternatively or additionally the allow-list mechanism could be manually back ported by providing an alternative implementation of `SessionSerializer` that uses an allow-list.


Remote Code Execution in cominput.jsp and comoutput.jsp in Northstar Technologies Inc NorthStar Club Management 6.3 allows remote unauthenticated users to inject and execute arbitrary system commands via the unsanitized user-controlled \command\ and \commandvalues\ parameters.


Discord-Recon is a bot for the Discord chat service. Versions of Discord-Recon 0.0.3 and prior contain a vulnerability in which a remote attacker is able to overwrite any file on the system with the command results. This can result in remote code execution when the user overwrite important files on the system. As a workaround bot maintainers can edit their `setting.py` file then add `<` and `>` into the `RCE` variable inside of it to fix the issue without an update. The vulnerability is patched in version 0.0.4.


Discord Recon Server is a bot that allows one to do one's reconnaissance process from one's Discord. A vulnerability in Discord Recon Server prior to 0.0.3 could be exploited to read internal files from the system and write files into the system resulting in remote code execution. This issue has been fixed in version 0.0.3. As a workaround one may copy the code from `assets/CommandInjection.py` in the Discord Recon Server code repository and overwrite vulnerable code from one's own Discord Recon Server implementation with code that contains the patch.


AjaxSearchPro before 4.20.8 allows Deserialization of Untrusted Data (in the import database feature of the administration panel) leading to Remote Code execution.


Integria IMS in its 5.0.92 version is vulnerable to a Remote Code Execution attack through file uploading. An unauthenticated attacker could abuse the AsyncUpload() function in order to exploit the vulnerability.


Deserialization of untrusted data in the login page of ASSUWEB 359.3 build 1 subcomponent of ACA ASSUREX RENTES product allows a remote attacker to inject unsecure serialized Java object using a specially crafted HTTP request resulting in an unauthenticated remote code execution on the server.


A dependency confusion vulnerability was reported in the Antilles open-source software prior to version 1.0.1 that could allow for remote code execution during installation due to a package listed in requirements.txt not existing in the public package index (PyPi). MITRE classifies this weakness as an Uncontrolled Search Path Element (CWE-427) in which a private package dependency may be replaced by an unauthorized package of the same name published to a well-known public repository such as PyPi. The configuration has been updated to only install components built by Antilles removing all other public package indexes. Additionally the antilles-tools dependency has been published to PyPi.


Nagios XI 5.7.5 and earlier allows authenticated admins to upload arbitrary files due to improper validation of the rename functionality in custom-includes component which leads to remote code execution by uploading php files.


A flaw was found in the ptp4l program of the linuxptp package. A missing length check when forwarding a PTP message between ports allows a remote attacker to cause an information leak crash or potentially remote code execution. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. This flaw affects linuxptp versions before 3.1.1 before 2.0.1 before 1.9.3 before 1.8.1 before 1.7.1 before 1.6.1 and before 1.5.1.


A flaw was found in mbsync before v1.3.6 and v1.4.2 where an unchecked pointer cast allows a malicious or compromised server to write an arbitrary integer value past the end of a heap-allocated structure by issuing an unexpected APPENDUID response. This could be plausibly exploited for remote code execution on the client.


** DISPUTED ** Laminas Project laminas-http before 2.14.2 and Zend Framework 3.0.0 has a deserialization vulnerability that can lead to remote code execution if the content is controllable related to the __destruct method of the Zend\\Http\\Response\\Stream class in Stream.php. NOTE: Zend Framework is no longer supported by the maintainer. NOTE: the laminas-http vendor considers this a \vulnerability in the PHP language itself\ but has added certain type checking as a way to prevent exploitation in (unrecommended) use cases where attacker-supplied data can be deserialized.


OpenNMS Meridian 2016 2017 2018 before 2018.1.25 2019 before 2019.1.16 and 2020 before 2020.1.5 Horizon 1.2 through 27.0.4 and Newts <1.5.3 has Incorrect Access Control which allows local and remote code execution using JEXL expressions.


An arbitrary file upload vulnerability in the YITH WooCommerce Gift Cards Premium plugin before 3.3.1 for WordPress allows remote attackers to achieve remote code execution on the operating system in the security context of the web server. In order to exploit this vulnerability an attacker must be able to place a valid Gift Card product into the shopping cart. An uploaded file is placed at a predetermined path on the web server with a user-specified filename and extension. This occurs because the ywgc-upload-picture parameter can have a .php value even though the intention was to only allow uploads of Gift Card images.


OctoRPKI

does

not

escape

a

URI

with

a

filename

containing

this

allows

a

repository

to

create

a

file

(ex.

which

would

then

be

written

to

disk

outside

the

base

cache

folder.

This

could

allow

for

remote

code

execution

on

the

host

machine

OctoRPKI

is

running

on.


An unauthenticated remote code execution vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an attacker on the same network unauthorized access to the device.


Microsoft Defender Remote Code Execution Vulnerability


Windows Fax Compose Form Remote Code Execution Vulnerability


Windows Fax Service Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-24077.


MuleSoft is aware of a Remote Code Execution vulnerability affecting certain versions of a Mule runtime component that may affect both CloudHub and on-premise customers. Versions affected: Mule 4.1.x and 4.2.x runtime released before February 2 2021.


Microsoft DTV-DVD Video Decoder Remote Code Execution Vulnerability


In p2p_copy_client_info of p2p.c there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution if the target device is performing a Wi-Fi Direct search with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-8.1 Android-9Android ID: A-172937525


In Android TV there is a possible silent pairing due to lack of rate limiting in the pairing flow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-8.1 Android-9Android ID: A-180745296


In gatt_process_notification of gatt_cl.cc there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution over Bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-197536150


In phNxpNciHal_process_ext_rsp of phNxpNciHal_ext.cc there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution over NFC with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-9Android ID: A-181660091


In handle_rc_metamsg_cmd of btif_rc.cc there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution over Bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-8.1 Android-9 Android-10Android ID: A-181860042


In rw_mfc_handle_read_op of rw_mfc.cc there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution via a malicious NFC packet with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11Android ID: A-178725766


In GetTimeStampAndPkt of DumpstateDevice.cpp there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android kernel Android ID: A-179620905 References: N/A


In rw_t3t_process_error of rw_t3t.cc there is a possible double free due to uninitialized data. This could lead to remote code execution over NFC with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-9 Android-10 Android-11 Android-8.1Android ID: A-179687208


In avrc_pars_vendor_cmd of avrc_pars_tg.cc there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution over Bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android; Versions: Android-11 Android-8.0 Android-8.1 Android-9 Android-10; Android ID: A-168802990.


In various functions in WideVine there are possible out of bounds writes due to improper input validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android SoCAndroid ID: A-188061006


In sdp_copy_raw_data of sdp_discovery.cc there is a possible system compromise due to a double free. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-8.1 Android-9 Android-10Android ID: A-174052148


In Factory::CreateStrictFunctionMap of factory.cc there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote code execution in an unprivileged process with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-9 Android-10 Android-11 Android-8.1Android ID: A-167389063


In

Builtins::Generate_ArgumentsAdaptorTrampoline

of

builtins-arm.cc

and

related

files

there

is

a

possible

out

of

bounds

write

due

to

an

incorrect

bounds

check.

This

could

lead

to

remote

code

execution

in

an

unprivileged

process

with

no

additional

execution

privileges

needed.

User

interaction

is

not

needed

for

exploitation.Product:

AndroidVersions:

ID:


An issue was discovered in the Headunit NTG6 in the MBUX Infotainment System on Mercedes-Benz vehicles through 2021. A Message Length is not checked in the HiQnet Protocol leading to remote code execution.


This

affects

the

package

unisharp/laravel-filemanager

from

The

upload()

function

does

not

sufficiently

validate

the

file

type

when

uploading.

An

attacker

may

be

able

to

reproduce

the

following

steps:

Install

a

package

with

a

web

Laravel

application.

Navigate

to

the

Upload

window

Upload

an

image

file

then

capture

the

request

Edit

the

request

contents

with

a

malicious

file

(webshell)

Enter

the

path

of

file

uploaded

on

URL

Remote

Code

Execution

**Note:

Prevention

for

bad

extensions

can

be

done

by

using

a

whitelist

in

the

config

file(lfm.php).

Corresponding

document

can

be

found

in

the


Eaton Intelligent Power Manager (IPM) prior to 1.69 is vulnerable to unauthenticated remote code execution vulnerability. IPM software does not sanitize the date provided via coverterCheckList action in meta_driver_srv.js class. Attackers can send a specially crafted packet to make IPM connect to rouge SNMP server and execute attacker-controlled code.


All versions of package git are vulnerable to Remote Code Execution (RCE) due to missing sanitization in the Git.git method which allows execution of OS commands rather than just git commands. Steps to Reproduce 1. Create a file named exploit.js with the following content: js var Git = require(\git\).Git; var repo = new Git(\repo-test\); var user_input = \version; date\; repo.git(user_input function(err result) { console.log(result); }) 2. In the same directory as exploit.js run npm install git. 3. Run exploit.js: node exploit.js. You should see the outputs of both the git version and date command-lines. Note that the repo-test Git repository does not need to be present to make this PoC work.


An issue was discovered in the Headunit NTG6 in the MBUX Infotainment System on Mercedes-Benz vehicles through 2021. The count in MultiSvGet GetAttributes and MultiSvSet is not checked in the HiQnet Protocol leading to remote code execution.


An issue was discovered in HERMES 2.1 in the MBUX Infotainment System on Mercedes-Benz vehicles through 2021. The SH2 MCU allows remote code execution.


The package md-to-pdf before 5.0.0 are vulnerable to Remote Code Execution (RCE) due to utilizing the library gray-matter to parse front matter content without disabling the JS engine.


The package studio-42/elfinder before 2.1.58 are vulnerable to Remote Code Execution (RCE) via execution of PHP code in a .phar file. NOTE: This only applies if the server parses .phar files as PHP.


The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templates coming from an untrusted source.


The package total.js before 3.4.8 are vulnerable to Remote Code Execution (RCE) via set.


An issue was discovered in the Headunit NTG6 in the MBUX Infotainment System on Mercedes-Benz vehicles through 2021. A type confusion issue affects MultiSvSetAttributes in the HiQnet Protocol leading to remote code execution.


Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1 2.12.4 and 2.3.2.


An Improper Input Validation vulnerability in DataImportHandler of Apache Solr allows an attacker to provide a Windows UNC path resulting in an SMB network call being made from the Solr host to another host on the network. If the attacker has wider access to the network this may lead to SMB attacks which may result in: * The exfiltration of sensitive data such as OS user hashes (NTLM/LM hashes) * In case of misconfigured systems SMB Relay Attacks which can lead to user impersonation on SMB Shares or in a worse-case scenario Remote Code Execution This issue affects all Apache Solr versions prior to 8.11.1. This issue only affects Windows.


Zoho ManageEngine O365 Manager Plus before Build 4416 allows remote code execution via BCP file overwrite through the ChangeDBAPI component.


An

issue

was

discovered

in

Quest

KACE

Desktop

Authority

before

contains

a

vulnerability

that

could

allow

pre-authentication

remote

code

execution.

An

attacker

could

upload

a

.ASP

file

to

reside

at


textpattern 4.8.7 is vulnerable to Cross Site Scripting (XSS) via /textpattern/index.php Body. A remote and unauthenticated attacker can use XSS to trigger remote code execution by uploading a webshell. To do so they must first steal the CSRF token before submitting a file upload request.


ownCloud owncloud/client before 2.9.2 allows Resource Injection by a server into the desktop client via a URL leading to remote code execution.


Zoho ManageEngine ServiceDesk Plus before 11306 ServiceDesk Plus MSP before 10530 and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution. This is related to /RestAPI URLs in a servlet and ImportTechnicians in the Struts configuration.


Zoho ManageEngine CloudSecurityPlus before Build 4117 allows remote code execution through the updatePersonalizeSettings component due to an improper security patch for CVE-2021-40175.


In QuickBox Pro v2.5.8 and below the config.php file has a variable which takes a GET parameter value and parses it into a shell_exec(''); function without properly sanitizing any shell arguments therefore remote code execution is possible. Additionally as the media server is running as root by default attackers can use the sudo command within this shell_exec(''); function which allows for privilege escalation by means of RCE.


In the wazuh-slack active response script in Wazuh 4.2.x before 4.2.5 untrusted user agents are passed to a curl command line potentially resulting in remote code execution.


iCMS <= 8.0.0 allows users to add and render a comtom template which has a SSTI vulnerability which causes remote code execution.


Simple College Website 1.0 is vulnerable to unauthenticated file upload & remote code execution via UNION-based SQL injection in the username parameter on /admin/login.php.


Wondershare LTD Dr. Fone as of 2021-12-06 version is affected by Remote code execution. Due to software design flaws an unauthenticated user can communicate over UDP with the \InstallAssistService.exe\ service(the service is running under SYSTEM privileges) and manipulate it to execute malicious executable without any validation from a remote location and gain SYSTEM privileges


A flaw was found in mbsync in isync 1.4.0 through 1.4.3. Due to an unchecked condition a malicious or compromised IMAP server could use a crafted mail message that lacks headers (i.e. one that starts with an empty line) to provoke a heap overflow which could conceivably be exploited for remote code execution.


Zoho ManageEngine Desktop Central is vulnerable to authentication bypass leading to remote code execution on the server as exploited in the wild in December 2021. For Enterprise builds 10.1.2127.17 and earlier upgrade to 10.1.2127.18. For Enterprise builds 10.1.2128.0 through 10.1.2137.2 upgrade to 10.1.2137.3. For MSP builds 10.1.2127.17 and earlier upgrade to 10.1.2127.18. For MSP builds 10.1.2128.0 through 10.1.2137.2 upgrade to 10.1.2137.3.


Embedded web server input sanitization vulnerability in Lexmark devices through 2021-12-07 which can which can lead to remote code execution on the device.


Dynamics Business Central Remote Code Execution Vulnerability


Windows Kernel Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-34458.


Polaris Office v9.103.83.44230 is affected by a Uninitialized Pointer Vulnerability in PolarisOffice.exe and EngineDLL.dll that may cause a Remote Code Execution. To exploit the vulnerability someone must open a crafted PDF file.


Microsoft Defender Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-34522.


UploadService in Hitachi Vantara Pentaho Business Analytics through 9.1 does not properly verify uploaded user files which allows an authenticated user to upload various files of different file types. Specifically a .jsp file is not allowed but a .jsp. file is allowed (and leads to remote code execution).


Windows Address Book Remote Code Execution Vulnerability


In Eclipse Theia 0.1.1 to 0.2.0 it is possible to exploit the default build to obtain remote code execution (and XXE) via the theia-xml-extension. This extension uses lsp4xml (recently renamed to LemMinX) in order to provide language support for XML. This is installed by default.


There are multiple out-of-bounds vulnerabilities in some processes of D-Link AC2600(DIR-2640) 1.01B04. Ordinary permissions can be elevated to administrator permissions resulting in local arbitrary code execution. An attacker can combine other vulnerabilities to further achieve the purpose of remote code execution.


Windows MSHTML Platform Remote Code Execution Vulnerability


The Keybase Client for Windows before version 5.7.0 contains a path traversal vulnerability when checking the name of a file uploaded to a team folder. A malicious user could upload a file to a shared folder with a specially crafted file name which could allow a user to execute an application which was not intended on their host machine. If a malicious user leveraged this issue with the public folder sharing feature of the Keybase client this could lead to remote code execution.


Windows Kernel Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-34508.


Microsoft Defender Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-34464.


Windows Font Driver Host Remote Code Execution Vulnerability


Neo4j through 3.4.18 (with the shell server enabled) exposes an RMI service that arbitrarily deserializes Java objects e.g. through setSessionVariable. An attacker can abuse this for remote code execution because there are dependencies with exploitable gadget chains.


Windows MSHTML Platform Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-34497.


Windows Print Spooler Remote Code Execution Vulnerability


Windows Graphics Component Font Parsing Remote Code Execution Vulnerability


PHPMailer before 6.5.0 on Windows allows remote code execution if lang_path is untrusted data and has a UNC pathname.


Windows MSHTML Platform Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-34447.


The Serv-U File Server allows for events such as user login failures to be audited by executing a command. This command can be supplied with parameters that can take the form of user string variables allowing remote code execution.


Insecure Deserialization of untrusted data remote code execution vulnerability was discovered in Patch Manager Orion Platform Integration module. An Authenticated Attacker with network access via HTTP can compromise this vulnerability can result in Remote Code Execution.


Afian FileRun 2021.03.26 allows Remote Code Execution (by administrators) via the Check Path value for the magick binary.


Afian FileRun 2021.03.26 allows Remote Code Execution (by administrators) via the Check Path value for the ffmpeg binary.


ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages. The exploitation does not require authentication and remote code execution can be triggered by sending a single crafted /ccversion/* request to the server. The vulnerability exists due to the usage of Sun ONE Application Framework (JATO) found in versions of Java 8 or earlier


This vulnerability allows attackers to impersonate users and perform arbitrary actions leading to a Remote Code Execution (RCE) from the Alerts Settings page.