This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_admin_apis.php. When parsing the line parameter the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9739.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_migration_cpanel.php. When parsing the filespace parameter the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9743.


In the version 12.1.0.1005 and below of 360 Total Security when the Gamefolde calls GameChrome.exe there exists a local privilege escalation vulnerability. An attacker who could exploit DLL hijacking to bypass the hips could execute arbitrary code on the Local system.


rConfig 3.9.5 could allow a remote authenticated attacker to execute arbitrary code on the system because of an error in the search.crud.php script. An attacker could exploit this vulnerability using the nodeId parameter.


Ubuntu's packaging of libvirt in 20.04 LTS created a control socket with world read and write permissions. An attacker could use this to overwrite arbitrary files or execute arbitrary code.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole 5.5.0.64. Although authentication is required to exploit this vulnerability the existing authentication mechanism can be bypassed. The specific flaw exists within the getFileFromURL method of the GWTTestServiceImpl class. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-10553.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_ftp_manager.php. When parsing the userLogin parameter the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9737.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_php_pecl.php. When parsing the phpversion parameter the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9715.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_disk_usage.php. When parsing the folderName parameter the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9713.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_admin_apis.php. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9720.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_mod_security.php. When parsing the dominio parameter the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9732.


A

regression

has

been

introduced

in

the

commit

preventing

JMX

re-bind.

By

passing

an

empty

environment

map

to

RMIConnectorServer

instead

of

the

map

that

contains

the

authentication

credentials

it

leaves

ActiveMQ

open

to

the

following

attack:

\A

remote

client

could

create

a

javax.management.loading.MLet

MBean

and

use

it

to

create

new

MBeans

from

arbitrary

URLs

at

least

if

there

is

no

security

manager.

In

other

words

a

rogue

remote

client

could

make

your

Java

application

execute

arbitrary

code.\

Mitigation:

Upgrade

to

Apache

ActiveMQ


Slack Nebula through 1.1.0 contains a relative path vulnerability that allows a low-privileged attacker to execute code in the context of the root user via tun_darwin.go or tun_windows.go. A user can also use Nebula to execute arbitrary code in the user's own context e.g. for user-level persistence or to bypass security controls. NOTE: the vendor states that this \requires a high degree of access and other preconditions that are tough to achieve.\


IntelMQ Manager from version 1.1.0 and before version 2.1.1 has a vulnerability where the backend incorrectly handled messages given by user-input in the \send\ functionality of the Inspect-tool of the Monitor component. An attacker with access to the IntelMQ Manager could possibly use this issue to execute arbitrary code with the privileges of the webserver. Version 2.1.1 fixes the vulnerability.


Zabbix Server 2.2.x and 3.0.x before 3.0.31 and 3.2 allows remote attackers to execute arbitrary code.


Arbitrary

code

execution

vulnerability

affecting

multiple

Micro

Focus

products.

Operation

Bridge

Manager

affecting

version:

versions

and

and

older

versions.

Application

Performance

Management

affecting

versions

and

with

uCMDB

CUP

Data

Center

Automation

affected

version

Operations

Bridge

(containerized)

affecting

versions:

Universal

CMDB

affecting

version:

Hybrid

Cloud

Management

affecting

version

Service

Management

Automation

affecting

version

and

The

vulnerability

could

allow

to

execute

arbitrary

code.


In Phproject before version 1.7.8 there's a vulnerability which allows users with access to file uploads to execute arbitrary code. This is patched in version 1.7.8.


The Zscaler Client Connector for Windows prior to 2.1.2.105 had a DLL hijacking vulnerability caused due to the configuration of OpenSSL. A local adversary may be able to execute arbitrary code in the SYSTEM context.


An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. Upload.ashx allows remote attackers to execute arbitrary code by uploading and executing an ASHX file.


Dungeon Crawl Stone Soup (aka DCSS or crawl) before 0.25 allows remote attackers to execute arbitrary code via Lua bytecode embedded in an uploaded .crawlrc file.


The wp-hotel-booking plugin through 1.10.2 for WordPress allows remote attackers to execute arbitrary code because of an unserialize operation on the thimpress_hotel_booking_1 cookie in load in includes/class-wphb-sessions.php.


The food-and-drink-menu plugin through 2.2.0 for WordPress allows remote attackers to execute arbitrary code because of an unserialize operation on the fdm_cart cookie in load_cart_from_cookie in includes/class-cart-manager.php.


A sandboxing issue in Odoo Community 11.0 through 13.0 and Odoo Enterprise 11.0 through 13.0 when running with Python 3.6 or later allows remote authenticated users to execute arbitrary code leading to privilege escalation.


An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Big Sur 11.1 Security Update 2020-001 Catalina Security Update 2020-007 Mojave. A malicious application may be able to execute arbitrary code with system privileges.


Insufficient RegEx in private-ip npm package v1.0.5 and below insufficiently filters reserved IP ranges resulting in indeterminate SSRF. An attacker can perform a large range of requests to ARIN reserved IP ranges resulting in an indeterminable number of critical attack vectors allowing remote attackers to request server-side resources or potentially execute arbitrary code through various SSRF techniques.


The update functionality of the Discover Media infotainment system in Volkswagen Polo 2019 vehicles allows physically proximate attackers to execute arbitrary code because some unsigned parts of a metainfo file are parsed which can cause attacker-controlled files to be written to the infotainment system and executed as root.


In

InoERP

an

unauthorized

attacker

can

execute

arbitrary

code

on

the

server

side

due

to

lack

of

validations

in


In Progress MOVEit Transfer before 2020.1 a malicious user could craft and store a payload within the application. If a victim within the MOVEit Transfer instance interacts with the stored payload it could invoke and execute arbitrary code within the context of the victim's browser (XSS).


An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) (Exynos 980 9820 and 9830 chipsets) software. The NPU driver allows attackers to execute arbitrary code because of unintended write and read operations on memory. The Samsung ID is SVE-2020-18610 (November 2020).


tdpServer on TP-Link Archer A7 AC1750 devices before 201029 allows remote attackers to execute arbitrary code via the slave_mac parameter. NOTE: this issue exists because of an incomplete fix for CVE-2020-10882 in which shell quotes are mishandled.


A

logic

vulnerability

when

handling

the

SaveGeneratorLong

instruction

in

Facebook

Hermes

prior

to

commit

allows

attackers

to

potentially

read

out

of

bounds

or

theoretically

execute

arbitrary

code

via

crafted

JavaScript.

Note

that

this

is

only

exploitable

if

the

application

using

Hermes

permits

evaluation

of

untrusted

JavaScript.

Hence

most

React

Native

applications

are

not

affected.


A

type

confusion

vulnerability

when

resolving

properties

of

JavaScript

objects

with

specially-crafted

prototype

chains

in

Facebook

Hermes

prior

to

commit

allows

attackers

to

potentially

execute

arbitrary

code

via

crafted

JavaScript.

Note

that

this

is

only

exploitable

if

the

application

using

Hermes

permits

evaluation

of

untrusted

JavaScript.

Hence

most

React

Native

applications

are

not

affected.


A format string vulnerability in the PAN-OS log daemon (logd) on Panorama allows a network based attacker with knowledge of registered firewall devices and access to Panorama management interfaces to execute arbitrary code bypassing the restricted shell and escalating privileges. This issue affects only PAN-OS 8.1 versions earlier than PAN-OS 8.1.13 on Panorama. This issue does not affect PAN-OS 7.1 PAN-OS 9.0 or later PAN-OS versions.


A

stack

overflow

vulnerability

in

Facebook

Hermes

'builtin

apply'

prior

to

commit

allows

attackers

to

potentially

execute

arbitrary

code

via

crafted

JavaScript.

Note

that

this

is

only

exploitable

if

the

application

using

Hermes

permits

evaluation

of

untrusted

JavaScript.

Hence

most

React

Native

applications

are

not

affected.


A vulnerability was discovered in the PyYAML library in versions before 5.3.1 where it is susceptible to arbitrary code execution when it processes untrusted YAML files through the full_load method or with the FullLoader loader. Applications that use the library to process untrusted input may be vulnerable to this flaw. An attacker could use this flaw to execute arbitrary code on the system by abusing the python/object/new constructor.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the SetFieldValue command of the communication API. The issue results from the lack of proper validation of user-supplied data which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9945.


This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the encryption of firmware update images. The issue results from the use of an inappropriate encryption algorithm. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root. Was ZDI-CAN-9649.


The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) before 7.9.1 contains a vulnerability in the ITM application server's WriteWindowMouse API. The vulnerability allows an anonymous remote attacker to execute arbitrary code with local administrator privileges. The vulnerability is caused by improper deserialization.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.1.29511. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of U3D objects in PDF files. The issue results from the lack of proper validation of user-supplied data which can result in a write past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-10193.


NCR SelfServ ATMs running APTRA XFS 05.01.00 do not encrypt authenticate or verify the integrity of messages between the BNA and the host computer which could allow an attacker with physical access to the internal components of the ATM to execute arbitrary code including code that enables the attacker to commit deposit forgery.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.1.29511. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of U3D objects in PDF files. The issue results from the lack of proper validation of user-supplied data which can result in a read past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-10462.


Serendipity before 2.3.4 on Windows allows remote attackers to execute arbitrary code because the filename of a renamed file may end with a dot. This file may then be renamed to have a .php filename.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.1.29511. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of U3D objects embedded in a PDF. The issue results from the lack of proper validation of user-supplied data which can result in a write past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-10189.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.7.1.29511. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the resetForm method. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-10614.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.1.29511. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of U3D objects in PDF files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-10192.


Use of unsafe yaml load. Allows instantiation of arbitrary objects. The flaw itself is caused by an unsafe parsing of YAML values which happens whenever an action message is processed to be sent and allows for the creation of Python objects. Through this flaw in the ROS core package of actionlib an attacker with local or remote access can make the ROS Master execute arbitrary code in Python form. Consider yaml.safe_load() instead. Located first in actionlib/tools/library.py:132. See links for more info on the bug.


NCR SelfServ ATMs running APTRA XFS 04.02.01 and 05.01.00 implement 512-bit RSA certificates to validate bunch note acceptor (BNA) software updates which can be broken by an attacker with physical access in a sufficiently short period of time thereby enabling the attacker to sign arbitrary files and CAB archives used to update BNA software as well as bypass application whitelisting resulting in the ability to execute arbitrary code.


The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) before 7.9.1 contains a vulnerability in the ITM application server's WriteImage API. The vulnerability allows an anonymous remote attacker to execute arbitrary code with local administrator privileges. The vulnerability is caused by improper deserialization.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the communication API. The issue lies in the handling of the CombineFiles command which allows an arbitrary file write with attacker controlled data. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9830.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.7.1.29511. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of widgets in XFA forms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-10650.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the tmpServer service which listens on TCP port 20002. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9662.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the OCRAndExportToExcel command of the communication API. The issue results from the lack of proper validation of user-supplied data which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9946.


This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the tdpServer service which listens on UDP port 20002 by default. When parsing the slave_mac parameter the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the root user. Was ZDI-CAN-9650.


This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of firmware updates. The issue results from the lack of proper validation of the firmware image prior to performing an upgrade. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root. Was ZDI-CAN-9648.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of NEC ESMPRO Manager 6.42. Authentication is not required to exploit this vulnerability. The specific flaw exists within the RMI service. The issue results from the lack of proper validation of user-supplied data which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-10007.


Triangle MicroWorks SCADA Data Gateway 3.02.0697 through 4.0.122 2.41.0213 through 4.0.122 allows remote attackers to execute arbitrary code due to the lack of proper validation of user-supplied data which can result in a type confusion condition. Authentication is not required to exploit this vulnerability. Only applicable to installations using DNP3 Data Sets.


This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of string table file uploads. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the web server. Was ZDI-CAN-9767.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the communication API. The issue lies in the handling of the ConvertToPDF command which allows an arbitrary file write with attacker controlled data. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9829.


This vulnerability allows network-adjacent attackers execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the tdpServer service which listens on UDP port 20002 by default. This issue results from the use of hard-coded encryption key. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root. Was ZDI-CAN-9652.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the AddWatermark command of the communication API. The issue results from the lack of proper validation of user-supplied data which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9942.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the GetFieldValue command of the communication API. The issue results from the lack of proper validation of user-supplied data which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9944.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of C-MORE HMI EA9 Firmware version 6.52 touch screen panels. Authentication is not required to exploit this vulnerability. The specific flaw exists within the control service which listens on TCP port 9999 by default. The issue results from the lack of authentication prior to allowing alterations to the system configuration. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-10493.


The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) before 7.9.1 contains a vulnerability in the ITM application server's WriteWindowMouseWithChunksV2 API. The vulnerability allows an anonymous remote attacker to execute arbitrary code with local administrator privileges. The vulnerability is caused by improper deserialization.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4.4587. Authentication is not required to exploit this vulnerability. The specific flaw exists within the HandshakeResult method. The issue results from the lack of proper validation of user-supplied data which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-10401.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.1.29511. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of U3D objects in PDF files. The issue results from the lack of proper validation of user-supplied data which can result in a read past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-10195.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of DNS responses. The issue results from the lack of proper validation of DNS reponses prior to further processing. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the root user. Was ZDI-CAN-9661.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the Export command of the communication API. The issue results from the lack of proper validation of user-supplied data which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9865.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the RotatePage command of the communication API. The issue results from the lack of proper validation of user-supplied data which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9943.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of DNS responses. A crafted DNS message can trigger an overflow of a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the root user. Was ZDI-CAN-9660.


The Windows installer for PostgreSQL 9.5 - 12 invokes system-provided executables that do not have fully-qualified paths. Executables in the directory where the installer loads or the current working directory take precedence over the intended executables. An attacker having permission to add files into one of those directories can use this to execute arbitrary code with the installer's administrative rights.


The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) before 7.9.1 contains a vulnerability in the ITM web console's ImportAlertRules feature. The vulnerability allows a remote attacker (with admin or config-admin privileges in the console) to execute arbitrary code with local administrator privileges. The vulnerability is caused by improper deserialization.


This vulnerability allows network-adjacent attackers to compromise the integrity of downloaded information on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the downloading of files via HTTPS. The issue results from the lack of proper validation of the certificate presented by the server. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-9647.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4.4587. Authentication is not required to exploit this vulnerability. The specific flaw exists within the PerformHandshake method. The issue results from the lack of proper validation of user-supplied data which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-10400.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.7.1.29511. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of XFA templates. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-10132.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.1.29511. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of U3D objects in PDF files. The issue results from the lack of proper validation of user-supplied data which can result in a read past the end of an allocated structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-10191.


eZ Publish Kernel before 5.4.14.1 6.x before 6.13.6.2 and 7.x before 7.5.6.2 and eZ Publish Legacy before 5.4.14.1 2017 before 2017.12.7.2 and 2019 before 2019.03.4.2 allow remote attackers to execute arbitrary code by uploading PHP code unless the vhost configuration permits only app.php execution.


NCR SelfServ ATMs running APTRA XFS 05.01.00 do not properly validate softare updates for the bunch note acceptor (BNA) enabling an attacker with physical access to internal ATM components to restart the host computer and execute arbitrary code with SYSTEM privileges because while booting the update process looks for CAB archives on removable media and executes a specific file without first validating the signature of the CAB archive.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit Reader 9.7.1.29511. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of AcroForms. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-10142.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the Save command of the communication API. The issue results from the lack of proper validation of user-supplied data which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9831.


An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Big Sur 11.1 Security Update 2020-001 Catalina Security Update 2020-007 Mojave macOS Big Sur 11.0.1. An application may be able to execute arbitrary code with kernel privileges.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.0.29478. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of the DuplicatePages command of the communication API. The issue results from the lack of proper validation of user-supplied data which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-9828.


This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PhantomPDF 9.7.1.29511. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of U3D objects in PDF files. The issue results from the lack of proper validation of user-supplied data which can result in a write past the end of an allocated object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-10464.


Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV320 and RV325 Series Routers and Cisco Small Business RV016 RV042 and RV082 Routers could allow an authenticated remote attacker with administrative privileges to execute arbitrary code on an affected device. The vulnerabilities are due to insufficient boundary restrictions on user-supplied input to scripts in the web-based management interface. An attacker with administrative privileges that are sufficient to log in to the web-based management interface could exploit each vulnerability by sending crafted requests that contain overly large values to an affected device causing a stack overflow. A successful exploit could allow the attacker to cause the device to crash or allow the attacker to execute arbitrary code with root privileges on the underlying operating system.


A vulnerability in the Cisco Discovery Protocol implementation for Cisco IOS XR Software could allow an unauthenticated adjacent attacker to execute arbitrary code or cause a reload on an affected device. The vulnerability is due to improper validation of string input from certain fields in Cisco Discovery Protocol messages. An attacker could exploit this vulnerability by sending a malicious Cisco Discovery Protocol packet to an affected device. A successful exploit could allow the attacker to cause a stack overflow which could allow the attacker to execute arbitrary code with administrative privileges on an affected device. Cisco Discovery Protocol is a Layer 2 protocol. To exploit this vulnerability an attacker must be in the same broadcast domain as the affected device (Layer 2 adjacent).


Multiple vulnerabilities in Cisco Webex Network Recording Player for Windows and Cisco Webex Player for Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerabilities are due to insufficient validation of certain elements of a Webex recording that is stored in the Advanced Recording Format (ARF) or Webex Recording Format (WRF). An attacker could exploit these vulnerabilities by sending a user a malicious ARF or WRF file through a link or email attachment and persuading the user to open the file with the affected software on the local system. A successful exploit could allow the attacker to execute arbitrary code on the affected system with the privileges of the targeted user.


A use after free issue was addressed with improved memory management. This issue is fixed in macOS Catalina 10.15.4 Security Update 2020-002 Mojave Security Update 2020-002 High Sierra. A malicious application may be able to execute arbitrary code with kernel privileges.


Multiple vulnerabilities in Cisco Webex Network Recording Player for Microsoft Windows and Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerabilities are due to insufficient validation of certain elements within a Webex recording that is stored in either the Advanced Recording Format (ARF) or the Webex Recording Format (WRF). An attacker could exploit these vulnerabilities by sending a malicious ARF or WRF file to a user through a link or email attachment and persuading the user to open the file on the local system. A successful exploit could allow the attacker to execute arbitrary code on the affected system with the privileges of the targeted user.


A vulnerability in the software update feature of Cisco Webex Meetings Desktop App for Mac could allow an unauthenticated remote attacker to execute arbitrary code on an affected system. The vulnerability is due to improper validation of cryptographic protections on files that are downloaded by the application as part of a software update. An attacker could exploit this vulnerability by persuading a user to go to a website that returns files to the client that are similar to files that are returned from a valid Webex website. The client may fail to properly validate the cryptographic protections of the provided files before executing them as part of an update. A successful exploit could allow the attacker to execute arbitrary code on the affected system with the privileges of the user.


A vulnerability in the Cisco Discovery Protocol implementation for Cisco NX-OS Software could allow an unauthenticated adjacent attacker to execute arbitrary code or cause a reload on an affected device. The vulnerability exists because the Cisco Discovery Protocol parser does not properly validate input for certain fields in a Cisco Discovery Protocol message. An attacker could exploit this vulnerability by sending a malicious Cisco Discovery Protocol packet to an affected device. An successful exploit could allow the attacker to cause a stack overflow which could allow the attacker to execute arbitrary code with administrative privileges on an affected device. Cisco Discovery Protocol is a Layer 2 protocol. To exploit this vulnerability an attacker must be in the same broadcast domain as the affected device (Layer 2 adjacent).


Multiple vulnerabilities in Cisco IOS Software for Cisco 809 and 829 Industrial Integrated Services Routers (Industrial ISRs) and Cisco 1000 Series Connected Grid Routers (CGR1000) could allow an unauthenticated remote attacker or an authenticated local attacker to execute arbitrary code on an affected system or cause an affected system to crash and reload. For more information about these vulnerabilities see the Details section of this advisory.


A vulnerability in the Java Remote Management Interface of Cisco Unified Contact Center Express (Unified CCX) could allow an unauthenticated remote attacker to execute arbitrary code on an affected device. The vulnerability is due to insecure deserialization of user-supplied content by the affected software. An attacker could exploit this vulnerability by sending a malicious serialized Java object to a specific listener on an affected system. A successful exploit could allow the attacker to execute arbitrary code as the root user on an affected device.


A vulnerability in Cisco Jabber for Windows could allow an authenticated remote attacker to execute arbitrary code. The vulnerability is due to improper validation of message contents. An attacker could exploit this vulnerability by sending specially crafted Extensible Messaging and Presence Protocol (XMPP) messages to the affected software. A successful exploit could allow the attacker to cause the application to execute arbitrary programs on the targeted system with the privileges of the user account that is running the Cisco Jabber client software possibly resulting in arbitrary code execution.


A vulnerability in the loading mechanism of specific DLLs in the Cisco Webex Teams client for Windows could allow an authenticated local attacker to load a malicious library. To exploit this vulnerability the attacker needs valid credentials on the Windows system. The vulnerability is due to incorrect handling of directory paths at run time. An attacker could exploit this vulnerability by placing a malicious DLL file in a specific location on the targeted system. This file will execute when the vulnerable application launches. A successful exploit could allow the attacker to execute arbitrary code on the targeted system with the privileges of another user’s account.


Multiple vulnerabilities in the web-based management interface of the Cisco RV110W Wireless-N VPN Firewall RV130 VPN Router RV130W Wireless-N Multifunction VPN Router and RV215W Wireless-N VPN Router could allow an authenticated remote attacker to execute arbitrary code on an affected device. The vulnerabilities are due to improper validation of user-supplied data in the web-based management interface. An attacker could exploit these vulnerabilities by sending malicious HTTP requests to a targeted device. A successful exploit could allow the attacker to execute arbitrary code on the underlying operating system of the affected device as a high-privilege user.


A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated local attacker to perform a DLL hijacking attack. To exploit this vulnerability the attacker would need to have valid credentials on the Windows system. The vulnerability is due to insufficient validation of resources that are loaded by the application at run time. An attacker could exploit this vulnerability by sending a crafted IPC message to the AnyConnect process. A successful exploit could allow the attacker to execute arbitrary code on the affected machine with SYSTEM privileges. To exploit this vulnerability the attacker would need to have valid credentials on the Windows system.


vRealize Operations for Horizon Adapter (6.7.x prior to 6.7.1 and 6.6.x prior to 6.6.1) uses a JMX RMI service which is not securely configured. An unauthenticated remote attacker who has network access to vRealize Operations with the Horizon Adapter running may be able to execute arbitrary code in vRealize Operations.


A vulnerability in Cisco Webex Network Recording Player for Microsoft Windows and Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exists due to insufficient validation of certain elements with a Webex recording stored in either the Advanced Recording Format (ARF) or the Webex Recording Format (WRF). An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file through a link or email attachment and persuading the user to open the file with the affected software on the local system. A successful exploit could allow the attacker to execute arbitrary code on the affected system with the privileges of the targeted user.


A vulnerability in Cisco Webex Meetings Desktop App could allow an unauthenticated remote attacker to execute programs on an affected end-user system. The vulnerability is due to improper validation of input that is supplied to application URLs. The attacker could exploit this vulnerability by persuading a user to follow a malicious URL. A successful exploit could allow the attacker to cause the application to execute other programs that are already present on the end-user system. If malicious files are planted on the system or on an accessible network file path the attacker could execute arbitrary code on the affected system.


A vulnerability in virtualization channel messaging in Cisco Webex Meetings Desktop App for Windows could allow a local attacker to execute arbitrary code on a targeted system. This vulnerability occurs when this app is deployed in a virtual desktop environment and using virtual environment optimization. This vulnerability is due to improper validation of messages processed by the Cisco Webex Meetings Desktop App. A local attacker with limited privileges could exploit this vulnerability by sending malicious messages to the affected software by using the virtualization channel interface. A successful exploit could allow the attacker to modify the underlying operating system configuration which could allow the attacker to execute arbitrary code with the privileges of a targeted user. Note: This vulnerability can be exploited only when Cisco Webex Meetings Desktop App is in a virtual desktop environment on a hosted virtual desktop (HVD) and is configured to use the Cisco Webex Meetings virtual desktop plug-in for thin clients.


Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV320 and RV325 Series Routers and Cisco Small Business RV016 RV042 and RV082 Routers could allow an authenticated remote attacker with administrative privileges to execute arbitrary code on an affected device. The vulnerabilities are due to insufficient boundary restrictions on user-supplied input to scripts in the web-based management interface. An attacker with administrative privileges that are sufficient to log in to the web-based management interface could exploit each vulnerability by sending crafted requests that contain overly large values to an affected device causing a stack overflow. A successful exploit could allow the attacker to cause the device to crash or allow the attacker to execute arbitrary code with root privileges on the underlying operating system.


An issue was discovered in Progress MOVEit Automation Web Admin. A Web Admin application endpoint failed to adequately sanitize malicious input which could allow an unauthenticated attacker to execute arbitrary code in a victim's browser aka XSS. This affects 2018 - 2018.0 prior to 2018.0.3 2018 SP1 - 2018.2 prior to 2018.2.3 2018 SP2 - 2018.3 prior to 2018.3.7 2019 - 2019.0 prior to 2019.0.3 2019.1 - 2019.1 prior to 2019.1.2 and 2019.2 - 2019.2 prior to 2019.2.2.


Improper handling of pointers in the System Management Mode (SMM) handling code may allow for a privileged attacker with physical or administrative access to potentially manipulate the AMD Generic Encapsulated Software Architecture (AGESA) to execute arbitrary code undetected by the operating system.


FactoryTalk Linx versions 6.00 6.10 and 6.11 RSLinx Classic v4.11.00 and prior Connected Components Workbench: Version 12 and prior ControlFLASH: Version 14 and later ControlFLASH Plus: Version 1 and later FactoryTalk Asset Centre: Version 9 and later FactoryTalk Linx CommDTM: Version 1 and later Studio 5000 Launcher: Version 31 and later Stud 5000 Logix Designer software: Version 32 and prior is vulnerable. The parsing mechanism that processes certain file types does not provide input sanitation. This may allow an attacker to use specially crafted files to traverse the file system and modify or expose sensitive data or execute arbitrary code.


An issue was discovered on Samsung mobile devices with O(8.X) P(9.0) and Q(10.0) software. The Quram image codec library allows attackers to overwrite memory and execute arbitrary code via crafted JPEG data that is mishandled during decoding. The Samsung ID is SVE-2020-16943 (May 2020).


rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path.


MonoX through 5.1.40.5152 allows administrators to execute arbitrary code by modifying an ASPX template.


An exploitable local privilege elevation vulnerability exists in the file system permissions of Sytech XL Reporter v14.0.1 install directory. Depending on the vector chosen an attacker can overwrite service executables and execute arbitrary code with privileges of user set to run the service or replace other files within the installation folder which would allow for local privilege escalation.


STMicroelectronics STM32F103 devices through 2020-05-20 allow physical attackers to execute arbitrary code via a power glitch and a specific flash patch/breakpoint unit configuration.


An exploitable local privilege elevation vulnerability exists in the file system permissions of the Mobile-911 Server V2.5 install directory. Depending on the vector chosen an attacker can overwrite the service executable and execute arbitrary code with System privileges or replace other files within the installation folder that could lead to local privilege escalation.


ExpressionEngine before 5.3.2 allows remote attackers to upload and execute arbitrary code in a .php%20 file via Compose Msg Add attachment and Save As Draft actions. A user with low privileges (member) is able to upload this. It is possible to bypass the MIME type check and file-extension check while uploading new files. Short aliases are not used for an attachment; instead direct access is allowed to the uploaded files. It is possible to upload PHP only if one has member access or registration/forum is enabled and one can create a member with the default group id of 5. To exploit this one must to be able to send and compose messages (at least).


OpenIAM before 4.2.0.3 allows remote attackers to execute arbitrary code via Groovy Script.


The management tool in MyLittleAdmin 3.8 allows remote attackers to execute arbitrary code because machineKey is hardcoded (the same for all customers' installations) in web.config and can be used to send serialized ASP code.


Apex Microelectronics APM32F103 devices allow physical attackers to execute arbitrary code via a power glitch and a specific flash patch/breakpoint unit configuration.


The security protection in Gigadevice GD32F103 devices allows physical attackers to redirect the control flow and execute arbitrary code via the debug interface.


An incomplete-cleanup vulnerability in the Office rendering engine of Gotenberg through 6.2.1 allows an attacker to overwrite LibreOffice configuration files and execute arbitrary code via macros.


In Liferay Portal before 7.3.2 and Liferay DXP 7.0 before fix pack 92 7.1 before fix pack 18 and 7.2 before fix pack 6 the template API does not restrict user access to sensitive objects which allows remote authenticated users to execute arbitrary code via crafted FreeMarker and Velocity templates.


Unrestricted file upload vulnerability in the \legacy course files\ and \file manager\ modules in Moodle 3.1.2 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension and then accessing it via unspecified vectors.


A missing check for whether a property of a JS object is private in V8 in Google Chrome prior to 55.0.2883.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.


Ansible before versions 2.1.4 2.2.1 is vulnerable to an improper input validation in Ansible's handling of data sent from client systems. An attacker with control over a client system being managed by Ansible and the ability to send facts back to the Ansible server could use this flaw to execute arbitrary code on the Ansible server using the Ansible server privileges.


JBoss RESTEasy before version 3.1.2 could be forced into parsing a request with YamlProvider resulting in unmarshalling of potentially untrusted data which could allow an attacker to execute arbitrary code with RESTEasy application permissions.


Unrestricted file upload vulnerability in the Blog appearance in the \Install or upgrade manually\ module in Dotclear through 2.10.4 allows remote authenticated super-administrators to execute arbitrary code by uploading a theme file with an zip extension and then accessing it via unspecified vectors.


The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a crafted serialized Java object which triggers an LDAP query to a third-party server.


Citrix Provisioning Services before 7.12 allows attackers to execute arbitrary code by overwriting a function pointer.


Unrestricted file upload vulnerability in the double extension support in the \image\ module in Moodle 3.1.2 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension and then accessing it via unspecified vectors.


steps/mail/sendmail.inc in Roundcube before 1.1.7 and 1.2.x before 1.2.3 when no SMTP server is configured and the sendmail program is enabled does not properly restrict the use of custom envelope-from addresses on the sendmail command line which allows remote authenticated users to execute arbitrary code via a modified HTTP request that sends a crafted e-mail message.


PricewaterhouseCoopers (PwC) ACE-ABAP 8.10.304 for SAP Security allows remote authenticated users to conduct ABAP injection attacks and execute arbitrary code via (1) SAPGUI or (2) Internet Communication Framework (ICF) over HTTP or HTTPS as demonstrated by WEBGUI or Report.


The CClient::ProcessServerPacket method in engine/client/client.cpp in Teeworlds before 0.6.4 allows remote servers to write to arbitrary physical memory locations and possibly execute arbitrary code via vectors involving snap handling.


IBM Maximo Asset Management 7.1 7.5 and 7.6 could allow a remote attacker to include arbitrary files. A remote attacker could send a specially-crafted URL request which could allow the attacker to execute arbitrary code on the vulnerable server. IBM X-Force ID: 120252.


Pillow before 3.3.2 allows context-dependent attackers to execute arbitrary code by using the \crafted image file\ approach related to an \Insecure Sign Extension\ issue affecting the ImagingNew in Storage.c component.


log_query_dlp.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as the root user via shell metacharacters in the cache_id parameter.


The hotfix_upload.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code via shell metacharacters in the file name of an uploaded file.


Improper verification of cryptographic signature vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows remote authenticated users to spoof update server and execute arbitrary code via a crafted input file.


log_query.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as the root user via shell metacharacters in the cache_id parameter.


log_query_dae.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as the root user via shell metacharacters in the cache_id parameter.


An XML External Entity (XXE) issue was discovered in Emerson Liebert SiteScan Web Version 6.5 and prior. An attacker may enter malicious input to Liebert SiteScan through a weakly configured XML parser causing the application to execute arbitrary code or disclose file contents from a server or connected network.


Improper control of generation of code vulnerability in Intel Security VirusScan Enterprise Linux (VSEL) 2.0.3 (and earlier) allows remote authenticated users to execute arbitrary code via a crafted HTTP request parameter.


IBM FileNet WorkPlace XT could allow a remote attacker to upload arbitrary files which could allow the attacker to execute arbitrary code on the vulnerable server.


admin_sys_time.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as the root user via shell metacharacters in the timezone parameter.


The REPL server (--listen) in GNU Guile 2.0.12 allows an attacker to execute arbitrary code via an HTTP inter-protocol attack.


in

Trend

Micro

Threat

Discovery

Appliance

and

earlier

allows

remote

authenticated

users

to

execute

arbitrary

code

via

an

archive

file

containing

a

symlink

to

or


drivers/firewire/net.c in the Linux kernel before 4.8.7 in certain unusual hardware configurations allows remote attackers to execute arbitrary code via crafted fragmented packets.


Huawei PC client software HiSuite 4.0.5.300_OVE has a dynamic link library (DLL) hijack vulnerability; an attacker can make the system load malicious DLL files to execute arbitrary code.


detected_potential_files.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as the root user via shell metacharacters in the cache_id parameter.


log_query_system.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code as the root user via shell metacharacters in the cache_id parameter.


Foxit Reader for Mac 2.1.0.0804 and earlier and Foxit Reader for Linux 2.1.0.0805 and earlier suffered from a vulnerability where weak file permissions could be exploited by attackers to execute arbitrary code. After the installation Foxit Reader's core files were world-writable by default allowing an attacker to overwrite them with backdoor code which when executed by privileged user would result in Privilege Escalation Code Execution or both.


sociomantic-tsunami git-hub before 0.10.3 allows remote attackers to execute arbitrary code via a crafted repository URL.


The interactive installer in PostgreSQL before 9.3.15 9.4.x before 9.4.10 and 9.5.x before 9.5.5 might allow remote attackers to execute arbitrary code by leveraging use of HTTP to download software.


SerializableProvider in RESTEasy in Red Hat Enterprise Linux Desktop 7 Red Hat Enterprise Linux HPC Node 7 Red Hat Enterprise Linux Server 7 and Red Hat Enterprise Linux Workstation 7 allows remote attackers to execute arbitrary code.


Unrestricted file upload vulnerability in the fileUnzip->unzip method in Dotclear before 2.10.3 allows remote authenticated users with permissions to manage media items to execute arbitrary code by uploading a ZIP file containing a file with a crafted extension as demonstrated by .php.txt or .php%20.


An issue was discovered in certain Apple products. macOS before 10.12.2 is affected. The issue involves the \xar\ component which allows remote attackers to execute arbitrary code via a crafted archive that triggers use of uninitialized memory locations.


The dropbearconvert command in Dropbear SSH before 2016.74 allows attackers to execute arbitrary code via a crafted OpenSSH key file.


Ghostscript before 9.21 might allow remote attackers to bypass the SAFER mode protection mechanism and consequently execute arbitrary code by leveraging type confusion in .initialize_dsc_parser.


An issue was discovered in certain Apple products. iOS before 10.1 is affected. macOS before 10.12.1 is affected. tvOS before 10.0.1 is affected. watchOS before 3.1 is affected. The issue involves the \Kernel\ component. It allows attackers to execute arbitrary code in a privileged context via a crafted app that leverages object-lifetime mishandling during process spawning.


ownCloud Desktop before 2.2.3 allows local users to execute arbitrary code and possibly gain privileges via a Trojan library in a \special path\ in the C: drive.


sociomantic-tsunami git-hub before 0.10.3 allows remote attackers to execute arbitrary code via a crafted repository name.


A type confusion vulnerability in the merge_param() function of php_http_params.c in PHP's pecl-http extension 3.1.0beta2 (PHP 7) and earlier as well as 2.6.0beta2 (PHP 5) and earlier allows attackers to crash PHP and possibly execute arbitrary code via crafted HTTP requests.


The PS Interpreter in Ghostscript 9.18 and 9.20 allows remote attackers to execute arbitrary code via crafted userparams.


The dbclient in Dropbear SSH before 2016.74 allows remote attackers to execute arbitrary code via a crafted (1) -m or (2) -c argument.


Microsoft Excel 2010 SP2 2013 SP1 2013 RT SP1 and 2016 misparses file formats which makes it easier for remote attackers to execute arbitrary code via a crafted document aka \Microsoft Office Security Feature Bypass Vulnerability.\


Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2016-4173 CVE-2016-4174 CVE-2016-4222 CVE-2016-4226 CVE-2016-4227 CVE-2016-4228 CVE-2016-4229 CVE-2016-4230 CVE-2016-4231 and CVE-2016-4248.


The tqdm._version module in tqdm versions 4.4.1 and 4.10 allows local users to execute arbitrary code via a crafted repo with a malicious git log in the current working directory.


system/libraries/Email.php in CodeIgniter before 3.1.3 allows remote attackers to execute arbitrary code by leveraging control over the email->from field to insert sendmail command-line arguments.


The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \\\ (backslash double quote) in a crafted Sender property.


The mail transport (aka Swift_Transport_MailTransport) in Swift Mailer before 5.4.5 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \\\ (backslash double quote) in a crafted e-mail address in the (1) From (2) ReturnPath or (3) Sender header.


The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code by leveraging improper interaction between the escapeshellarg function and internal escaping performed in the mail function in PHP. NOTE: this vulnerability exists because of an incorrect fix for CVE-2016-10033.


cPanel before 57.9999.54 allows demo accounts to execute arbitrary code via ajax_maketext_syntax_util.pl (SEC-109).


** DISPUTED ** WampServer 3.0.6 installs two services called 'wampapache' and 'wampmysqld' with weak file permissions running with SYSTEM privileges. This could potentially allow an authorized but non-privileged local user to execute arbitrary code with elevated privileges on the system. To properly exploit this vulnerability the local attacker must insert an executable file called mysqld.exe or httpd.exe and replace the original files. The next time the service starts the malicious file will get executed as SYSTEM. NOTE: the vendor disputes the relevance of this report taking the position that a configuration in which \'someone' (an attacker) is able to replace files on a PC\ is not \the fault of WampServer.\


** DISPUTED ** WampServer 3.0.6 has two files called 'wampmanager.exe' and 'unins000.exe' with a weak ACL for Modify. This could potentially allow an authorized but non-privileged local user to execute arbitrary code with elevated privileges on the system. To properly exploit this vulnerability the local attacker must insert an executable file called wampmanager.exe or unins000.exe and replace the original files. The next time one of these programs is launched by a more privileged user malicious code chosen by the local attacker will run. NOTE: the vendor disputes the relevance of this report taking the position that a configuration in which \'someone' (an attacker) is able to replace files on a PC\ is not \the fault of WampServer.\


In FlexNet Publisher versions before Luton SP1 (11.14.1.1) running FlexNet Publisher Licensing Service on Windows platform a boundary error related to a named pipe within the FlexNet Publisher Licensing Service can be exploited to cause an out-of-bounds memory read access and subsequently execute arbitrary code with SYSTEM privileges.


The setFrom function in the Sendmail adapter in the zend-mail component before 2.4.11 2.5.x 2.6.x and 2.7.x before 2.7.2 and Zend Framework before 2.4.11 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrary code via a \\\ (backslash double quote) in a crafted e-mail address.


cPanel before 57.9999.54 allows Webmail accounts to execute arbitrary code through forwarders (SEC-121).


Integer truncation error in the amap_alloc function in OpenBSD 5.8 and 5.9 allows local users to execute arbitrary code with kernel privileges via a large size value.


Use-after-free vulnerability in Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2016-4272 CVE-2016-4279 CVE-2016-6921 CVE-2016-6925 CVE-2016-6926 CVE-2016-6927 CVE-2016-6929 CVE-2016-6930 CVE-2016-6931 and CVE-2016-6932.


Use-after-free

vulnerability

in

Adobe

Reader

and

Acrobat

before

Acrobat

and

Acrobat

Reader

DC

Classic

before

and

Acrobat

and

Acrobat

Reader

DC

Continuous

before

on

Windows

and

OS

X

allows

attackers

to

execute

arbitrary

code

via

unspecified

vectors

a

different

vulnerability

than

and


Use-after-free vulnerability in Adobe Flash Player before 18.0.0.382 and 19.x through 23.x before 23.0.0.185 on Windows and OS X and before 11.2.202.637 on Linux allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2016-6987.


Use-after-free vulnerability in Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2016-4272 CVE-2016-4279 CVE-2016-6921 CVE-2016-6923 CVE-2016-6925 CVE-2016-6926 CVE-2016-6929 CVE-2016-6930 CVE-2016-6931 and CVE-2016-6932.


The server in Red Hat JBoss Operations Network (JON) when SSL authentication is not configured for JON server / agent communication allows remote attackers to execute arbitrary code via a crafted HTTP request related to message deserialization. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-3737.


A code-execution vulnerability exists during startup in jhi.dll and otpiha.dll in Symantec VIP Access Desktop before 2.2.2 which could let local malicious users execute arbitrary code.


The vApp Managers web application in EMC Unisphere for VMAX Virtual Appliance 8.x before 8.3.0 and Solutions Enabler Virtual Appliance 8.x before 8.3.0 allows remote authenticated users to execute arbitrary code via crafted input to the (1) GeneralCmdRequest (2) PersistantDataRequest or (3) GetCommandExecRequest class.


Unspecified methods in the RACF Connector component before 1.1.1.0 in ForgeRock OpenIDM and OpenICF improperly call the SearchControls constructor with returnObjFlag set to true which allows remote attackers to execute arbitrary code via a crafted serialized Java object aka LDAP entry poisoning.


A vulnerability in the Session Description Protocol (SDP) parser of Cisco Meeting Server could allow an unauthenticated remote attacker to execute arbitrary code on an affected system. This vulnerability affects the following products: Cisco Meeting Server releases prior to Release 2.0.3 Acano Server releases 1.9.x prior to Release 1.9.5 Acano Server releases 1.8.x prior to Release 1.8.17. More Information: CSCva76004. Known Affected Releases: 1.8.x 1.92.0.


SHDesigns' Resident Download Manager provides firmware update capabilities for Rabbit 2000/3000 CPU boards which according to the reporter may be used in some industrial control and embedded applications. The Resident Download Manager does not verify that the firmware is authentic before executing code and deploying the firmware to devices. A remote attacker with the ability to send UDP traffic to the device may be able to execute arbitrary code on the device. According to SHDesigns' website the Resident Download Manager and other Rabbit Tools have been discontinued since June 2011.


Use-after-free vulnerability in Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2016-4272 CVE-2016-4279 CVE-2016-6921 CVE-2016-6923 CVE-2016-6925 CVE-2016-6926 CVE-2016-6927 CVE-2016-6929 CVE-2016-6930 and CVE-2016-6931.


SAP HANA DB 1.00.73.00.389160 allows remote attackers to execute arbitrary code via vectors involving the audit logs aka SAP Security Note 2170806.


A vulnerability was found in Symantec Norton Download Manager versions prior to 5.6. A remote user can create a specially crafted DLL file that when placed on the target user's system will cause the Norton Download Manager component to load the remote user's DLL instead of the intended DLL and execute arbitrary code when the Norton Download Manager component is run by the target user.


JFrog Artifactory before 4.11 allows remote attackers to execute arbitrary code via an LDAP attribute with a crafted serialized Java object aka LDAP entry poisoning.


Trend Micro Smart Protection Server 2.5 before build 2200 2.6 before build 2106 and 3.0 before build 1330 allows local webserv users to execute arbitrary code with root privileges via a Trojan horse .war file in the Solr webapps directory.


Use-after-free vulnerability in Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2016-4272 CVE-2016-4279 CVE-2016-6921 CVE-2016-6923 CVE-2016-6925 CVE-2016-6927 CVE-2016-6929 CVE-2016-6930 CVE-2016-6931 and CVE-2016-6932.


The XSLoader::load method in XSLoader in Perl does not properly locate .so files when called in a string eval which might allow local users to execute arbitrary code via a Trojan horse library under the current working directory.


The Imagely NextGen Gallery plugin for Wordpress prior to version 2.1.57 does not properly validate user input in the cssfile parameter of a HTTP POST request which may allow an authenticated user to read arbitrary files from the server or execute arbitrary code on the server in some circumstances (dependent on server configuration).


Use-after-free vulnerability in Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2016-4272 CVE-2016-4279 CVE-2016-6921 CVE-2016-6923 CVE-2016-6925 CVE-2016-6926 CVE-2016-6927 CVE-2016-6929 CVE-2016-6931 and CVE-2016-6932.


in

Invision

Power

Services

IPS

Community

Suite

(aka

Invision

Power

Board

IPB

or

Power

Board)

before

when

used

with

PHP

before

or

before

allows

remote

attackers

to

execute

arbitrary

code

via

the

parameter.


The LDAP directory connector in Atlassian Crowd before 2.8.8 and 2.9.x before 2.9.5 allows remote attackers to execute arbitrary code via an LDAP attribute with a crafted serialized Java object aka LDAP entry poisoning.


Use-after-free

vulnerability

in

Adobe

Reader

and

Acrobat

before

Acrobat

and

Acrobat

Reader

DC

Classic

before

and

Acrobat

and

Acrobat

Reader

DC

Continuous

before

on

Windows

and

OS

X

allows

attackers

to

execute

arbitrary

code

via

unspecified

vectors

a

different

vulnerability

than

and


A privilege escalation vulnerability exists when loading DLLs during boot up and reboot in Symantec IT Management Suite 8.0 prior to 8.0 HF4 and Suite 7.6 prior to 7.6 HF7 Symantec Ghost Solution Suite 3.1 prior to 3.1 MP4 Symantec Endpoint Virtualization 7.x prior to 7.6 HF7 and Symantec Encryption Desktop 10.x prior to 10.4.1 which could let a local malicious user execute arbitrary code.


ObjectSocketWrapper.java in Gradle 2.12 allows remote attackers to execute arbitrary code via a crafted serialized object.


The vApp Managers web application in EMC Unisphere for VMAX Virtual Appliance 8.x before 8.3.0 and Solutions Enabler Virtual Appliance 8.x before 8.3.0 allows remote attackers to execute arbitrary code via crafted input to the (1) GetSymmCmdRequest or (2) RemoteServiceHandler class.


Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.17 Acrobat and Acrobat Reader DC Classic before 15.006.30198 and Acrobat and Acrobat Reader DC Continuous before 15.017.20050 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2016-4255.


Cisco Cloud Services Platform (CSP) 2100 2.0 allows remote attackers to execute arbitrary code via a crafted dnslookup command in an HTTP request aka Bug ID CSCuz89093.


Use-after-free vulnerability in Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2016-4272 CVE-2016-4279 CVE-2016-6923 CVE-2016-6925 CVE-2016-6926 CVE-2016-6927 CVE-2016-6929 CVE-2016-6930 CVE-2016-6931 and CVE-2016-6932.


Oracle MySQL through 5.5.52 5.6.x through 5.6.33 and 5.7.x through 5.7.15; MariaDB before 5.5.51 10.0.x before 10.0.27 and 10.1.x before 10.1.17; and Percona Server before 5.5.51-38.1 5.6.x before 5.6.32-78.0 and 5.7.x before 5.7.14-7 allow local users to create arbitrary configurations and bypass certain protection mechanisms by setting general_log_file to a my.cnf configuration. NOTE: this can be leveraged to execute arbitrary code with root privileges by setting malloc_lib. NOTE: the affected MySQL version information is from Oracle's October 2016 CPU. Oracle has not commented on third-party claims that the issue was silently patched in MySQL 5.5.52 5.6.33 and 5.7.15.


A vulnerability in Cisco Meeting Server and Meeting App could allow an unauthenticated remote attacker to execute arbitrary code on an affected system. This vulnerability affects the following products: Cisco Meeting Server releases prior to 2.0.1 Acano Server releases prior to 1.8.16 and prior to 1.9.3 Cisco Meeting App releases prior to 1.9.8 Acano Meeting Apps releases prior to 1.8.35. More Information: CSCva75942 CSCvb67878. Known Affected Releases: 1.81.92.0.


Use-after-free vulnerability in Adobe Flash Player before 18.0.0.382 and 19.x through 23.x before 23.0.0.185 on Windows and OS X and before 11.2.202.637 on Linux allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2016-6981.


Use-after-free vulnerability in Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2016-4272 CVE-2016-4279 CVE-2016-6921 CVE-2016-6923 CVE-2016-6926 CVE-2016-6927 CVE-2016-6929 CVE-2016-6930 CVE-2016-6931 and CVE-2016-6932.


Use-after-free vulnerability in Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2016-4272 CVE-2016-4279 CVE-2016-6921 CVE-2016-6923 CVE-2016-6925 CVE-2016-6926 CVE-2016-6927 CVE-2016-6930 CVE-2016-6931 and CVE-2016-6932.


IBM AppScan Enterprise Edition could allow a remote attacker to execute arbitrary code on the system caused by improper handling of objects in memory. By persuading a victim to open specially-crafted content an attacker could exploit this vulnerability to execute arbitrary code on the system in the same context as the victim.


Use-after-free vulnerability in Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2016-4272 CVE-2016-4279 CVE-2016-6921 CVE-2016-6923 CVE-2016-6925 CVE-2016-6926 CVE-2016-6927 CVE-2016-6929 CVE-2016-6930 and CVE-2016-6932.


The Qualcomm GPS subsystem in Android on Android One devices allows remote attackers to execute arbitrary code.


Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2016-4173 CVE-2016-4222 CVE-2016-4226 CVE-2016-4227 CVE-2016-4228 CVE-2016-4229 CVE-2016-4230 CVE-2016-4231 and CVE-2016-4248.


Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2016-4173 CVE-2016-4174 CVE-2016-4222 CVE-2016-4226 CVE-2016-4227 CVE-2016-4228 CVE-2016-4229 CVE-2016-4230 and CVE-2016-4248.


Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2016-4173 CVE-2016-4174 CVE-2016-4222 CVE-2016-4226 CVE-2016-4227 CVE-2016-4228 CVE-2016-4230 CVE-2016-4231 and CVE-2016-4248.


The Phar extension in PHP before 5.5.34 5.6.x before 5.6.20 and 7.x before 7.0.5 allows remote attackers to execute arbitrary code via a crafted filename as demonstrated by mishandling of \\0 characters by the phar_analyze_path function in ext/phar/phar.c.


The Filter SDK in HPE KeyView 10.18 through 10.24 allows remote attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2016-4387 CVE-2016-4388 and CVE-2016-4390.


The REST plugin in Apache Struts 2 2.3.19 through 2.3.28.1 allows remote attackers to execute arbitrary code via a crafted expression.


/ext/phar/phar_object.c in PHP 7.0.7 and 5.6.x allows remote attackers to execute arbitrary code. NOTE: Introduced as part of an incomplete fix to CVE-2015-6833.


Jython before 2.7.1rc1 allows attackers to execute arbitrary code via a crafted serialized PyFunction object.


Use-after-free vulnerability in Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2016-4279 CVE-2016-6921 CVE-2016-6923 CVE-2016-6925 CVE-2016-6926 CVE-2016-6927 CVE-2016-6929 CVE-2016-6930 CVE-2016-6931 and CVE-2016-6932.


Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code by leveraging an unspecified \type confusion \ a different vulnerability than CVE-2016-4223 and CVE-2016-4224.


Use-after-free

vulnerability

in

Adobe

Reader

and

Acrobat

before

Acrobat

and

Acrobat

Reader

DC

Classic

before

and

Acrobat

and

Acrobat

Reader

DC

Continuous

before

on

Windows

and

OS

X

allows

attackers

to

execute

arbitrary

code

via

unspecified

vectors

a

different

vulnerability

than

and


OpenStack Murano before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka) Murano-dashboard before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka) and python-muranoclient before 0.7.3 (liberty) and 0.8.x before 0.8.5 (mitaka) improperly use loaders inherited from yaml.Loader when parsing MuranoPL and UI files which allows remote attackers to create arbitrary Python objects and execute arbitrary code via crafted extended YAML tags in UI definitions in packages.


The Chef Manage (formerly opscode-manage) add-on before 1.12.0 for Chef allows remote attackers to execute arbitrary code via crafted serialized data in a cookie.


Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code by leveraging an unspecified \type confusion \ a different vulnerability than CVE-2016-4223 and CVE-2016-4225.


Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2016-4173 CVE-2016-4174 CVE-2016-4222 CVE-2016-4226 CVE-2016-4227 CVE-2016-4228 CVE-2016-4229 CVE-2016-4231 and CVE-2016-4248.


Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2016-4173 CVE-2016-4174 CVE-2016-4222 CVE-2016-4226 CVE-2016-4227 CVE-2016-4229 CVE-2016-4230 CVE-2016-4231 and CVE-2016-4248.


Adobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary code via unspecified vectors as exploited in the wild in May 2016.


The Filter SDK in HPE KeyView 10.18 through 10.24 allows remote attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2016-4387 CVE-2016-4389 and CVE-2016-4390.


The Filter SDK in HPE KeyView 10.18 through 10.24 allows remote attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2016-4387 CVE-2016-4388 and CVE-2016-4389.


Multiple untrusted search path vulnerabilities in cURL and libcurl before 7.49.1 when built with SSPI or telnet is enabled allow local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse (1) security.dll (2) secur32.dll or (3) ws2_32.dll in the application or current working directory.


Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2016-4173 CVE-2016-4174 CVE-2016-4226 CVE-2016-4227 CVE-2016-4228 CVE-2016-4229 CVE-2016-4230 CVE-2016-4231 and CVE-2016-4248.


HPE Smart Update in Storage Sizing Tool before 13.0 Converged Infrastructure Solution Sizer Suite (CISSS) before 2.13.1 Power Advisor before 7.8.2 Insight Management Sizer before 16.12.1 Synergy Planning Tool before 3.3 SAP Sizing Tool before 16.12.1 Sizing Tool for SAP Business Suite powered by HANA before 16.11.1 Sizer for ConvergedSystems Virtualization before 16.7.1 Sizer for Microsoft Exchange Server before 16.12.1 Sizer for Microsoft Lync Server 2013 before 16.12.1 Sizer for Microsoft SharePoint 2013 before 16.13.1 Sizer for Microsoft SharePoint 2010 before 16.11.1 and Sizer for Microsoft Skype for Business Server 2015 before 16.5.1 allows remote attackers to execute arbitrary code via unspecified vectors.


The mysql user parameter configuration script (userparameter_mysql.conf) in the agent in Zabbix before 2.0.18 2.2.x before 2.2.13 and 3.0.x before 3.0.3 when used with a shell other than bash allows context-dependent attackers to execute arbitrary code or SQL commands via the mysql.size parameter.


Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2016-4173 CVE-2016-4174 CVE-2016-4222 CVE-2016-4227 CVE-2016-4228 CVE-2016-4229 CVE-2016-4230 CVE-2016-4231 and CVE-2016-4248.


Apple iOS before 10 OS X before 10.12 tvOS before 10 and watchOS before 3 mishandle signed disk images which allows attackers to execute arbitrary code in a privileged context via a crafted app.


Curl before 7.49.1 in Apple OS X before macOS Sierra prior to 10.12 allows remote or local attackers to execute arbitrary code gain sensitive information cause denial-of-service conditions bypass security restrictions and perform unauthorized actions. This may aid in other attacks.


Apache Qpid AMQP 0-x JMS client before 6.0.4 and JMS (AMQP 1.0) before 0.10.0 does not restrict the use of classes available on the classpath which might allow remote authenticated users with permission to send messages to deserialize arbitrary objects and execute arbitrary code by leveraging a crafted serialized object in a JMS ObjectMessage that is handled by the getObject function.


Use-after-free vulnerability in Adobe Flash Player before 18.0.0.375 and 19.x through 23.x before 23.0.0.162 on Windows and OS X and before 11.2.202.635 on Linux allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2016-4272 CVE-2016-6921 CVE-2016-6923 CVE-2016-6925 CVE-2016-6926 CVE-2016-6927 CVE-2016-6929 CVE-2016-6930 CVE-2016-6931 and CVE-2016-6932.


Login Window in Apple OS X before 10.11.6 allows attackers to execute arbitrary code in a privileged context or obtain sensitive user information via a crafted app that leverages a \type confusion.\


The getObject method of the javax.jms.ObjectMessage class in the (1) JMS Core client (2) Artemis broker and (3) Artemis REST component in Apache ActiveMQ Artemis before 1.4.0 might allow remote authenticated users with permission to send messages to the Artemis broker to deserialize arbitrary objects and execute arbitrary code by leveraging gadget classes being present on the Artemis classpath.


Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2016-4173 CVE-2016-4174 CVE-2016-4222 CVE-2016-4226 CVE-2016-4227 CVE-2016-4228 CVE-2016-4229 CVE-2016-4230 and CVE-2016-4231.


Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2016-4174 CVE-2016-4222 CVE-2016-4226 CVE-2016-4227 CVE-2016-4228 CVE-2016-4229 CVE-2016-4230 CVE-2016-4231 and CVE-2016-4248.


An unspecified ActiveX control in Schneider Electric SoMachine HVAC Programming Software for M171/M172 Controllers before 2.1.0 allows remote attackers to execute arbitrary code via unknown vectors related to the INTERFACESAFE_FOR_UNTRUSTED_CALLER (aka safe for scripting) flag.


Apache Struts 2.x before 2.3.29 allows remote attackers to execute arbitrary code via a \%{}\ sequence in a tag attribute aka forced double OGNL evaluation. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-0785.


An issue was discovered in certain Apple products. iOS before 10.1 is affected. macOS before 10.12.1 is affected. tvOS before 10.0.1 is affected. watchOS before 3.1 is affected. The issue involves the \libxpc\ component. It allows attackers to execute arbitrary code in a privileged context via a crafted app.


The printfDx function in Takumi Yamada DX Library for Borland C++ 3.13f through 3.16b DX Library for Gnu C++ 3.13f through 3.16b and DX Library for Visual C++ 3.13f through 3.16b allows remote attackers to execute arbitrary code via a crafted string.


Use-after-free vulnerability in Adobe Reader and Acrobat before 11.0.17 Acrobat and Acrobat Reader DC Classic before 15.006.30198 and Acrobat and Acrobat Reader DC Continuous before 15.017.20050 on Windows and OS X allows attackers to execute arbitrary code via unspecified vectors.


Use-after-free vulnerability in Adobe Flash Player before 18.0.0.352 and 19.x through 21.x before 21.0.0.242 on Windows and OS X and before 11.2.202.621 on Linux allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2016-1097 CVE-2016-1106 CVE-2016-1107 CVE-2016-1108 CVE-2016-1109 CVE-2016-1110 CVE-2016-4108 and CVE-2016-4110.


ManageIQ in CloudForms before 4.1 allows remote authenticated users to execute arbitrary code.


Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code by leveraging an unspecified \type confusion \ a different vulnerability than CVE-2016-4224 and CVE-2016-4225.


An issue was discovered in certain Apple products. iOS before 10.2 is affected. The issue involves the \Image Capture\ component which allows attackers to execute arbitrary code via a crafted USB HID device.


The Filter SDK in HPE KeyView 10.18 through 10.24 allows remote attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2016-4388 CVE-2016-4389 and CVE-2016-4390.


Schneider Electric Pelco Digital Sentry Video Management System with firmware before 7.14 has hardcoded credentials which allows remote attackers to obtain access and consequently execute arbitrary code via unspecified vectors.


Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to execute arbitrary code via unspecified vectors a different vulnerability than CVE-2016-4173 CVE-2016-4174 CVE-2016-4222 CVE-2016-4226 CVE-2016-4228 CVE-2016-4229 CVE-2016-4230 CVE-2016-4231 and CVE-2016-4248.


VMware vRealize Automation 7.0.x before 7.1 allows remote attackers to execute arbitrary code via unspecified vectors.


The nsDisplayList::HitTest function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 mishandles rendering display transformation which allows remote attackers to execute arbitrary code via a crafted web site that leverages \type confusion.\


drivers/net/ethernet/msm/rndis_ipa.c in the Qualcomm networking driver in Android allows remote attackers to execute arbitrary code via a crafted application compromising a privileged process.


fontconfig before 2.12.1 does not validate offsets which allows local users to trigger arbitrary free calls and consequently conduct double free attacks and execute arbitrary code via a crafted cache file.


The

mozilla::a11y::HyperTextAccessible::GetChildOffset

function

in

the

accessibility

implementation

in

Mozilla

Firefox

before

allows

remote

attackers

to

execute

arbitrary

code

via

a

crafted

web

site.


An XXE issue was discovered in Automated Logic Corporation (ALC) Liebert SiteScan Web Version 6.5 and prior ALC WebCTRL Version 6.5 and prior and Carrier i-Vu Version 6.5 and prior. An attacker could enter malicious input to WebCTRL i-Vu or SiteScan Web through a weakly configured XML parser causing the application to execute arbitrary code or disclose file contents from a server or connected network.


hotfix_upload.cgi in Trend Micro Deep Discovery Inspector (DDI) 3.7 3.8 SP1 (3.81) and 3.8 SP2 (3.82) allows remote administrators to execute arbitrary code via shell metacharacters in the filename parameter of the Content-Disposition header.


The nsImageGeometryMixin class in Mozilla Firefox before 49.0 Firefox ESR 45.x before 45.4 and Thunderbird < 45.4 does not properly perform a cast of an unspecified variable during handling of INPUT elements which allows remote attackers to execute arbitrary code via a crafted web site.


IBM Tivoli Storage Manager FastBack installer could allow a remote attacker to execute arbitrary code on the system. By placing a specially-crafted DLL in the victim's path an attacker could exploit this vulnerability when the installer is executed to run arbitrary code on the system with privileges of the victim.


OXID eShop before 2016-06-13 allows remote attackers to execute arbitrary code via a GET or POST request to the oxuser class. Fixed versions are Enterprise Edition v5.1.12 Enterprise Edition v5.2.9 Professional Edition v4.8.12 Professional Edition v4.9.9 Community Edition v4.8.12 Community Edition v4.9.9.


Atlassian Bamboo before 5.11.4.1 and 5.12.x before 5.12.3.1 does not properly restrict permitted deserialized classes which allows remote attackers to execute arbitrary code via vectors related to XStream Serialization.


Use-after-free vulnerability in the nsFrameManager::CaptureFrameState function in Mozilla Firefox before 49.0 Firefox ESR 45.x before 45.4 and Thunderbird < 45.4 allows remote attackers to execute arbitrary code by leveraging improper interaction between restyling and the Web Animations model implementation.


The web UI in Red Hat CloudForms 4.1 allows remote authenticated users to execute arbitrary code via vectors involving \Lack of field filters.\


The OpenBlob function in blob.c in GraphicsMagick before 1.3.24 and ImageMagick allows remote attackers to execute arbitrary code via a | (pipe) character at the start of a filename.


Extbase in TYPO3 4.3.0 before 6.2.24 7.x before 7.6.8 and 8.1.1 allows remote attackers to obtain sensitive information or possibly execute arbitrary code via a crafted Extbase action.


Use-after-free vulnerability in the CanonicalizeXPCOMParticipant function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code via a script that closes its own Service Worker within a nested sync event loop.


Accela Civic Platform Citizen Access portal relies on the client to restrict file types for uploads which allows remote authenticated users to execute arbitrary code via modified _EventArgument and filename parameters.


An issue was discovered in Fatek Automation PM Designer V3 Version 2.1.2.2 and Automation FV Designer Version 1.2.8.0. Sending additional valid packets could allow the attacker to cause a crash or to execute arbitrary code because of Improper Restriction of Operations within the Bounds of a Memory Buffer.


Use-after-free vulnerability in the DOMSVGLength class in Mozilla Firefox before 49.0 Firefox ESR 45.x before 45.4 and Thunderbird < 45.4 allows remote attackers to execute arbitrary code by leveraging improper interaction between JavaScript code and an SVG document.


Multiple untrusted search path vulnerabilities in Microsoft Skype allow local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse (1) msi.dll (2) dpapi.dll or (3) cryptui.dll that is located in the current working directory.


Lenovo Solution Center (LSC) before 3.3.003 allows local users to execute arbitrary code with LocalSystem privileges via vectors involving the LSC.Services.SystemService StartProxy command with a named pipe created in advance and crafted .NET assembly.


Siemens SIMATIC WinCC before 7.3 Update 10 and 7.4 before Update 1 SIMATIC BATCH before 8.1 SP1 Update 9 as distributed in SIMATIC PCS 7 through 8.1 SP1 SIMATIC OpenPCS 7 before 8.1 Update 3 as distributed in SIMATIC PCS 7 through 8.1 SP1 SIMATIC OpenPCS 7 before 8.2 Update 1 as distributed in SIMATIC PCS 7 8.2 and SIMATIC WinCC Runtime Professional before 13 SP1 Update 9 allow remote attackers to execute arbitrary code via crafted packets.


Puppet Enterprise 2015.3.3 and 2016.x before 2016.4.0 and Puppet Agent 1.3.6 through 1.7.0 allow remote attackers to bypass a host whitelist protection mechanism and execute arbitrary code on Puppet nodes via vectors related to command validation aka \Puppet Execution Protocol (PXP) Command Whitelist Validation Vulnerability.\


The Qualcomm SPCom driver in Android before 7.0 allows local users to execute arbitrary code within the context of the kernel via a crafted application aka Android internal bug 34386529 and Qualcomm internal bug CR#1094140.


Lenovo BIOS EFI Driver allows local administrators to execute arbitrary code with System Management Mode (SMM) privileges via unspecified vectors.


Virtual servers in F5 BIG-IP systems 11.5.0 11.5.1 before HF11 11.5.2 11.5.3 11.5.4 before HF2 11.6.0 before HF8 11.6.1 before HF1 12.0.0 before HF4 and 12.1.0 before HF2 when configured with the HTTP Explicit Proxy functionality or SOCKS profile allow remote attackers to modify the system configuration read system files and possibly execute arbitrary code via unspecified vectors.


Use-after-free vulnerability in the WebRTC socket thread in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code by leveraging incorrect free operations on DTLS objects during the shutdown of a WebRTC session.


The Apache XML-RPC (aka ws-xmlrpc) library 3.1.3 as used in Apache Archiva allows remote attackers to execute arbitrary code via a crafted serialized Java object in an <ex:serializable> element.