The web interface on FASTGate Fastweb devices with firmware through 0.00.47_FW_200_Askey 2017-05-17 (software through 1.0.1b) exposed a CGI binary that is vulnerable to a command injection vulnerability that can be exploited to achieve remote code execution with root privileges. No authentication is required in order to trigger the vulnerability.


An OS command injection vulnerability in the web administration component of Micro Focus Secure Messaging Gateway (SMG) allows a remote attacker authenticated as a privileged user to execute arbitrary OS commands on the SMG server. This can be exploited in conjunction with CVE-2018-12464 to achieve unauthenticated remote code execution. Affects Micro Focus Secure Messaging Gateway versions prior to 471. It does not affect previous versions of the product that used GWAVA product name (i.e. GWAVA 6.5).


Crestron TSW-1060 TSW-760 TSW-560 TSW-1060-NC TSW-760-NC and TSW-560-NC devices before 2.001.0037.001 allow unauthenticated remote code execution via command injection in Crestron Toolbox Protocol (CTP).


NetGain Enterprise Manager (EM) is affected by OS Command Injection vulnerabilities in versions before 10.0.57. These vulnerabilities could allow remote authenticated attackers to inject arbitrary code resulting in remote code execution.


VMware NSX SD-WAN Edge by VeloCloud prior to version 3.1.0 contains a command injection vulnerability in the local web UI component. This component is disabled by default and should not be enabled on untrusted networks. VeloCloud by VMware will be removing this service from the product in future releases. Successful exploitation of this issue could result in remote code execution.


A remote code execution issue was discovered in Zoho ManageEngine Applications Manager before 13.6 (build 13640). The publicly accessible testCredential.do endpoint takes multiple user inputs and validates supplied credentials by accessing a specified system. This endpoint calls several internal classes and then executes a PowerShell script. If the specified system is OfficeSharePointServer then the username and password parameters to this script are not validated leading to Command Injection.


A remote code execution vulnerability occurs in OpenTSDB through 2.4.0 via command injection in the yrange parameter. The yrange value is written to a gnuplot file in the /tmp directory. This file is then executed via the mygnuplot.sh shell script. (tsd/GraphHandler.java attempted to prevent command injections by blocking backticks but this is insufficient.)


We have recently released new version of AirMax AirOS firmware v6.3.0 for TI XW and XM boards that fixes vulnerabilities found on AirMax AirOS v6.2.0 and prior TI XW and XM boards according to the description below:There are certain end-points containing functionalities that are vulnerable to command injection. It is possible to craft an input string that passes the filter check but still contains commands resulting in remote code execution.Mitigation:Update to the latest AirMax AirOS firmware version available at the AirMax download page.


ssh2 is client and server modules written in pure JavaScript for node.js. In ssh2 before version 1.4.0 there is a command injection vulnerability. The issue only exists on Windows. This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. This is fixed in version 1.4.0.


The NDN-210 has a web administration panel which is made available over https. There is a command injection issue that will allow authenticated users to the administration panel to perform authenticated remote code execution. An issue exists in ngpsystemcmd.php in which the http parameters \x_modules\ and \y_modules\ are not properly handled. The NDN-210 is part of Barco TransForm N solution and this vulnerability is patched from TransForm N version 3.8 onwards.


Barco TransForm NDN-210 Lite NDN-210 Pro NDN-211 Lite and NDN-211 Pro before 3.8 allows Command Injection (issue 1 of 4). The NDN-210 has a web administration panel which is made available over https. The logon method is basic authentication. There is a command injection issue that will result in unauthenticated remote code execution in the username and password fields of the logon prompt. The NDN-210 is part of Barco TransForm N solution and includes the patch from TransForm N version 3.8 onwards.


The NDN-210 has a web administration panel which is made available over https. There is a command injection issue that will allow authenticated users to the administration panel to perform authenticated remote code execution. An issue exists in split_card_cmd.php in which the http parameter \locking\ is not properly handled. The NDN-210 is part of Barco TransForm N solution and this vulnerability is patched from TransForm N version 3.8 onwards.


Barco TransForm N before 3.8 allows Command Injection (issue 2 of 4). The NDN-210 has a web administration panel which is made available over https. There is a command injection issue that will allow authenticated users of the administration panel to perform authenticated remote code execution. An issue exists in split_card_cmd.php in which the http parameters xmodules ymodules and savelocking are not properly handled. The NDN-210 is part of Barco TransForm N solution and includes the patch from TransForm N version 3.8 onwards.


In mversion before 2.0.0 there is a command injection vulnerability. This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. This vulnerability is patched by version 2.0.0. Previous releases are deprecated in npm. As a workaround make sure to escape git commit messages when using the commitMessage option for the update function.


There is an OS Command Injection in Mida eFramework through 2.9.0 that allows an attacker to achieve Remote Code Execution (RCE) with administrative (root) privileges. No authentication is required.


There is an OS Command Injection in Mida eFramework 2.9.0 that allows an attacker to achieve Remote Code Execution (RCE) with administrative (root) privileges. Authentication is required.


Remote Code Execution (RCE) in Alexander Stokmann's Code Snippets Extended plugin <= 1.4.7 on WordPress via Cross-Site Request Forgery.

remote code execution
cross site request forgery


A Cross-Site Request Forgery (CSRF) issue in the NextGEN Gallery plugin before 3.5.0 for WordPress allows File Upload and Local File Inclusion via settings modification leading to Remote Code Execution and XSS. (It is possible to bypass CSRF protection by simply not including a nonce parameter.)


The SOY Inquiry component of SOY CMS is affected by Cross-site Request Forgery (CSRF) and Remote Code Execution (RCE). The vulnerability affects versions 2.0.0.3 and earlier of SOY Inquiry. This allows remote attackers to force the administrator to edit files once the administrator loads a specially crafted webpage. An administrator must be logged in for exploitation to be possible. This issue is fixed in SOY Inquiry version 2.0.0.4 and included in SOY CMS 3.0.2.328.


AntSword 2.1.8.1 contains a cross-site scripting (XSS) vulnerability in the View Site funtion. When viewing an added site an XSS payload can be injected in cookies view which can lead to remote code execution.

remote code execution
cross site scripting


A Cross-Site Scripting issue was discovered in Certec EDV GmbH atvise scada prior to Version 3.0. This may allow remote code execution.


A cross-site scripting vulnerability has been identified in Geutebruck G-Cam/EFD-2250 Version 1.12.0.4 and Topline TopFD-2125 Version 3.15.1 IP cameras which may allow remote code execution.


A mutation cross-site scripting (XSS) issue in Typora through 0.9.9.31.2 on macOS and through 0.9.81 on Linux leads to Remote Code Execution through Mermaid code blocks. To exploit this vulnerability one must open a file in Typora. The XSS vulnerability is then triggered due to improper HTML sanitization. Given that the application is based on the Electron framework the XSS leads to remote code execution in an unsandboxed environment.


InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 do not have a filter or signature check to detect or prevent an upload of malicious files to the server which may allow an attacker acting as an administrator to upload malicious files. This could result in cross-site scripting deletion of system files and remote code execution.


Question2Answer Q2A Ultimate SEO Version 1.3 is affected by cross-site scripting (XSS) which may lead to arbitrary remote code execution.


Poddycast is a podcast app made with Electron. Prior to version 0.8.1 an attacker can create a podcast or episode with malicious characters and execute commands on the client machine. The application does not clean the HTML characters of the podcast information obtained from the Feed which allows the injection of HTML and JS code (cross-site scripting). Being an application made in electron cross-site scripting can be scaled to remote code execution making it possible to execute commands on the machine where the application is running. The vulnerability is patched in Poddycast version 0.8.1.


No filtering of cross-site scripting (XSS) payloads in the markdown-editor in Zettlr 1.8.7 allows attackers to perform remote code execution via a crafted file.


The Ad Injection WordPress plugin through 1.2.0.19 does not properly sanitize the body of the adverts injected into the pages allowing a high privileged user (Admin+) to inject arbitrary HTML or javascript even with unfiltered_html disallowed leading to a stored cross-site scripting (XSS) vulnerability. Further it is also possible to inject PHP code leading to a Remote Code execution (RCE) vulnerability even if the DISALLOW_FILE_EDIT and DISALLOW_FILE_MOD constants are both set.


MarkText through 0.16.3 does not sanitize the input of a mermaid block before rendering. This could lead to Remote Code Execution via a .md file containing a mutation Cross-Site Scripting (XSS) payload.


Mark Text v0.16.3 was discovered to contain a DOM-based cross-site scripting (XSS) vulnerability which allows attackers to perform remote code execution (RCE) via injecting a crafted payload into /lib/contentState/pasteCtrl.js.


A Cross-site Scripting issue was discovered in PHOENIX CONTACT FL COMSERVER BASIC 232/422/485 FL COMSERVER UNI 232/422/485 FL COMSERVER BAS 232/422/485-T FL COMSERVER UNI 232/422/485-T FL COM SERVER RS232 FL COM SERVER RS485 and PSI-MODEM/ETH (running firmware versions prior to 1.99 2.20 or 2.40). The cross-site scripting vulnerability has been identified which may allow remote code execution.


A vulnerability in Cisco Jabber Client Framework (JCF) could allow an unauthenticated remote attacker to conduct a cross-site scripting (XSS) attack against a user of an affected device. The vulnerability is due to improper neutralization of script in attributes in a web page. An attacker could exploit this vulnerability by executing arbitrary JavaScript in the Jabber client of the recipient. An exploit could allow the attacker to perform remote code execution. Cisco Bug IDs: CSCve53989.


SOY CMS 3.0.2 and earlier is affected by Remote Code Execution (RCE) using Unrestricted File Upload. Cross-Site Scripting(XSS) vulnerability that was used in CVE-2020-15183 can be used to increase impact by redirecting the administrator to access a specially crafted page. This vulnerability is caused by insecure configuration in elFinder. This is fixed in version 3.0.2.328.


SoyCMS 3.0.2 and earlier is affected by Reflected Cross-Site Scripting (XSS) which leads to Remote Code Execution (RCE) from a known vulnerability. This allows remote attackers to force the administrator to edit files once the adminsitrator loads a specially crafted webpage.


Unspecified vulnerability in the Management Interface in VMware ESX Server 2.x up to 2.5.x before 24 December 2005 allows \remote code execution in the Web browser\ via unspecified attack vectors probably related to cross-site scripting (XSS).


** DISPUTED ** wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not ensure that the specified MySQL database service is appropriate which allows remote attackers to configure an arbitrary database via the dbhost and dbname parameters and subsequently conduct static code injection and cross-site scripting (XSS) attacks via (1) an HTTP request or (2) a MySQL query. NOTE: the vendor disputes the significance of this issue; however remote code execution makes the issue important in many realistic environments.

remote code execution
cross site scripting
code injection


An issue was found in GE S2020/S2020G Fast Switch 61850 S2020/S2020G Fast Switch 61850 Versions 07A03 and prior. An attacker can inject arbitrary Javascript in a specially crafted HTTP request that may be reflected back in the HTTP response. The device is also vulnerable to a stored cross-site scripting vulnerability that may allow session hijacking disclosure of sensitive data cross-site request forgery (CSRF) attacks and remote code execution.


Stack overflow in the parse_tag function in libass/ass_parse.c in libass before 0.15.0 allows remote attackers to cause a denial of service or remote code execution via a crafted file.


Prototype pollution vulnerability in 'set-getter' version 0.1.0 allows an attacker to cause a denial of service and may lead to remote code execution.


Prototype pollution vulnerability in 'deep-override' versions 1.0.0 through 1.0.1 allows an attacker to cause a denial of service and may lead to remote code execution.


Prototype pollution vulnerability in 'dotty' versions 0.0.1 through 0.1.0 allows attackers to cause a denial of service and may lead to remote code execution.


Prototype pollution vulnerability in 'js-extend' versions 0.0.1 through 1.0.1 allows attacker to cause a denial of service and may lead to remote code execution.


Prototype pollution vulnerability in 'patchmerge' versions 1.0.0 through 1.0.1 allows an attacker to cause a denial of service and may lead to remote code execution.


Prototype pollution vulnerability in 'safe-flat' versions 2.0.0 through 2.0.1 allows an attacker to cause a denial of service and may lead to remote code execution.


Prototype pollution vulnerability in 'set-or-get' version 1.0.0 through 1.2.10 allows an attacker to cause a denial of service and may lead to remote code execution.


Prototype pollution vulnerability in 'deep-defaults' versions 1.0.0 through 1.0.5 allows attacker to cause a denial of service and may lead to remote code execution.


Prototype pollution vulnerability in 'expand-hash' versions 0.1.0 through 1.0.1 allows an attacker to cause a denial of service and may lead to remote code execution.


Prototype pollution vulnerability in `nconf-toml` versions 0.0.1 through 0.0.2 allows an attacker to cause a denial of service and may lead to remote code execution.


Prototype pollution vulnerability in 'changeset' versions 0.0.1 through 0.2.5 allows an attacker to cause a denial of service and may lead to remote code execution.


Prototype pollution vulnerability in 'safe-obj' versions 1.0.0 through 1.0.2 allows an attacker to cause a denial of service and may lead to remote code execution.


Prototype pollution vulnerability in 'putil-merge' versions1.0.0 through 3.6.6 allows attacker to cause a denial of service and may lead to remote code execution.


Prototype pollution vulnerability in '101' versions 1.0.0 through 1.6.3 allows an attacker to cause a denial of service and may lead to remote code execution.


Prototype pollution vulnerability in 'nestie' versions 0.0.0 through 1.0.0 allows an attacker to cause a denial of service and may lead to remote code execution.


Prototype pollution vulnerability in 'object-collider' versions 1.0.0 through 1.0.3 allows attacker to cause a denial of service and may lead to remote code execution.


Prototype pollution vulnerability in 'deep-set' versions 1.0.0 through 1.0.1 allows attacker to cause a denial of service and may lead to remote code execution.


Prototype pollution vulnerability in 'libnested' versions 0.0.0 through 1.5.0 allows an attacker to cause a denial of service and may lead to remote code execution.


Prototype pollution vulnerability in 'keyget' versions 1.0.0 through 2.2.0 allows attacker to cause a denial of service and may lead to remote code execution.


Prototype pollution vulnerability in 'dset' versions 1.0.0 through 2.0.1 allows attacker to cause a denial of service and may lead to remote code execution.


Prototype pollution vulnerability in 'getobject' version 0.1.0 allows an attacker to cause a denial of service and may lead to remote code execution.


Prototype pollution vulnerability in 'set-in' versions 1.0.0 through 2.0.0 allows attacker to cause a denial of service and may lead to remote code execution.


Prototype pollution vulnerability in '@strikeentco/set' version 1.0.0 allows attacker to cause a denial of service and may lead to remote code execution.


Prototype pollution vulnerability in 'field' versions 0.0.1 through 1.0.1 allows attacker to cause a denial of service and may lead to remote code execution.


Prototype pollution vulnerability in 'predefine' versions 0.0.0 through 0.1.2 allows an attacker to cause a denial of service and may lead to remote code execution.


Prototype pollution vulnerability in 'deephas' versions 1.0.0 through 1.0.5 allows attacker to cause a denial of service and may lead to remote code execution.


Prototype pollution vulnerability in 'flattenizer' versions 0.0.5 through 1.0.5 allows an attacker to cause a denial of service and may lead to remote code execution.


Prototype pollution vulnerability in 'shvl' versions 1.0.0 through 2.0.1 allows an attacker to cause a denial of service and may lead to remote code execution.


Prototype pollution vulnerability in 'deepref' versions 1.1.1 through 1.2.1 allows attacker to cause a denial of service and may lead to remote code execution.


Prototype pollution vulnerability in 'controlled-merge' versions 1.0.0 through 1.2.0 allows attacker to cause a denial of service and may lead to remote code execution.


Prototype pollution vulnerability in 'set-object-value' versions 0.0.0 through 0.0.5 allows an attacker to cause a denial of service and may lead to remote code execution.


Prototype pollution vulnerability in 'object-hierarchy-access' versions 0.2.0 through 0.32.0 allows attacker to cause a denial of service and may lead to remote code execution.


A Denial of Service issue has been discovered in the Gecko component of KaiOS 2.5 10.05 (platform 48.0.a2) on Nokia 8810 4G devices. When a crafted web page is visited with the internal browser the Gecko process crashes with a segfault. Successful exploitation could lead to the remote code execution on the device.


In FreeBSD 12.0-STABLE before r349622 12.0-RELEASE before 12.0-RELEASE-p7 11.3-PRERELEASE before r349624 11.3-RC3 before 11.3-RC3-p1 and 11.2-RELEASE before 11.2-RELEASE-p11 a bug in iconv implementation may allow an attacker to write past the end of an output buffer. Depending on the implementation an attacker may be able to create a denial of service provoke incorrect program behavior or induce a remote code execution.


The slub_events (aka SLUB: Event Registration) extension through 3.0.2 for TYPO3 allows uploading of arbitrary files to the webserver. For versions 1.2.2 and below this results in Remote Code Execution. In versions later than 1.2.2 this can result in Denial of Service since the web space can be filled up with arbitrary files.


SciLexer.dll in Scintilla in Notepad++ (x64) before 7.7 allows remote code execution or denial of service via Unicode characters in a crafted .ml file.


This

affects

the

package

@strikeentco/set

before

It

allows

an

attacker

to

cause

a

denial

of

service

and

may

lead

to

remote

code

execution.

**Note:**

This

vulnerability

derives

from

an

incomplete

fix

in


The

package

keyget

from

are

vulnerable

to

Prototype

Pollution

via

the

methods

set

push

and

at

which

could

allow

an

attacker

to

cause

a

denial

of

service

and

may

lead

to

remote

code

execution.

**Note:**

This

vulnerability

derives

from

an

incomplete

fix

to


** UNSUPPORTED WHEN ASSIGNED ** Emerson Dixell XWEB-500 products are affected by arbitrary file write vulnerability in /cgi-bin/logo_extra_upload.cgi /cgi-bin/cal_save.cgi and /cgi-bin/lo_utils.cgi. An attacker will be able to write any file on the target system without any kind of authentication mechanism and this can lead to denial of service and potentially remote code execution. Note: the product has not been supported since 2018 and should be removed or replaced.


** UNSUPPORTED WHEN ASSIGNED ** A CWE-20: Improper Input Validation vulnerability exists in PowerLogic EGX100 (Versions 3.0.0 and newer) and PowerLogic EGX300 (All Versions) that could cause denial of service or remote code execution via a specially crafted HTTP packet.


** UNSUPPORTED WHEN ASSIGNED ** A CWE-20: Improper Input Validation vulnerability exists in PowerLogic EGX100 (Versions 3.0.0 and newer) and PowerLogic EGX300 (All Versions) that could cause denial of service or remote code execution via a specially crafted HTTP packet.This CVE ID is unique from CVE-2021-22767.


** UNSUPPORTED WHEN ASSIGNED ** A CWE-20: Improper Input Validation vulnerability exists in PowerLogic EGX100 (Versions 3.0.0 and newer) and PowerLogic EGX300 (All Versions) that could cause denial of service or remote code execution via a specially crafted HTTP packet.This CVE ID is unique from CVE-2021-22768


ZStack is open source IaaS(infrastructure as a service) software. In ZStack before versions 3.10.12 and 4.1.6 there is a pre-auth unsafe deserialization vulnerability in the REST API. An attacker in control of the request body will be able to provide both the class name and the data to be deserialized and therefore will be able to instantiate an arbitrary type and assign arbitrary values to its fields. This issue may lead to a Denial Of Service. If a suitable gadget is available then an attacker may also be able to exploit this vulnerability to gain pre-auth remote code execution. For additional details see the referenced GHSL-2021-087.


An attacker-controlled pointer free in Busybox's hush applet leads to denial of service and possible code execution when processing a crafted shell command due to the shell mishandling the &&& string. This may be used for remote code execution under rare conditions of filtered command input.


An arbitrary memory write vulnerability exists in the dual_onsrv.exe module in Honeywell Experion PKS R40x before R400.6 R41x before R410.6 and R43x before R430.2 that could lead to possible remote code execution or denial of service. Honeywell strongly encourages and recommends all customers running unsupported versions of EKPS prior to R400 to upgrade to a supported version.


On Junos OS devices with SNMP enabled a network based attacker with unfiltered access to the RE can cause the Junos OS snmpd daemon to crash and restart by sending a crafted SNMP packet. Repeated crashes of the snmpd daemon can result in a partial denial of service condition. Additionally it may be possible to craft a malicious SNMP packet in a way that can result in remote code execution. SNMP is disabled in Junos OS by default. Junos OS devices with SNMP disabled are not affected by this issue. No other Juniper Networks products or platforms are affected by this issue. NOTE: This is a different issue than Cisco CVE-2017-6736 CVE-2017-6737 and CVE-2017-6738. Affected releases are Juniper Networks Junos OS 12.1X46 prior to 12.1X46-D67; 12.3X48 prior to 12.3X48-D51 12.3X48-D55; 13.3 prior to 13.3R10-S2; 14.1 prior to 14.1R2-S10 14.1R8-S4 14.1R9; 14.1X50 prior to 14.1X50-D185; 14.1X53 prior to 14.1X53-D122 14.1X53-D44 14.1X53-D50; 14.2 prior to 14.2R4-S9 14.2R7-S7 14.2R8; 15.1 prior to 15.1F2-S18 15.1F6-S7 15.1R4-S8 15.1R5-S5 15.1R6-S1 15.1R7; 15.1X49 prior to 15.1X49-D100 15.1X49-D110; 15.1X53 prior to 15.1X53-D231 15.1X53-D47 15.1X53-D48 15.1X53-D57 15.1X53-D64 15.1X53-D70; 16.1 prior to 16.1R3-S4 16.1R4-S3 16.1R4-S4 16.1R5; 16.2 prior to 16.2R2 16.2R3; 17.1 prior to 17.1R1-S3 17.1R2 17.1R3; 17.2 prior to 17.2R1-S1 17.2R2; 17.2X75 prior to 17.2X75-D30. Junos releases prior to 10.2 are not affected.


A specially crafted x509 certificate can cause a single out of bounds byte overwrite in wolfSSL through 3.10.2 resulting in potential certificate validation vulnerabilities denial of service and possible remote code execution. In order to trigger this vulnerability the attacker needs to supply a malicious x509 certificate to either a server or a client application using this library.


Use After Free vulnerability in the Zephyr shell allows a serial or telnet connected user to cause denial of service and possibly remote code execution. This issue affects: Zephyr shell versions prior to 1.14.0 on all.


The baseband modules of Mate 10 Mate 10 Pro Mate 9 Mate 9 Pro Huawei smart phones with software before ALP-AL00 8.0.0.120(SP2C00) before BLA-AL00 8.0.0.120(SP2C00) before MHA-AL00B 8.0.0.334(C00) and before LON-AL00B 8.0.0.334(C00) have a stack overflow vulnerability due to the lack of parameter validation. An attacker could send malicious packets to the smart phones within radio range by special wireless device which leads stack overflow when the baseband module handles these packets. The attacker could exploit this vulnerability to perform a denial of service attack or remote code execution in baseband module.


AndroidSVG version 1.2.2 is vulnerable to XXE attacks in the SVG parsing component resulting in denial of service and possibly remote code execution


Pepperminty-Wiki version 0.15 is vulnerable to XXE attacks in the getsvgsize function resulting in denial of service and possibly remote code execution


In Veritas Backup Exec 2014 before build 14.1.1187.1126 15 before build 14.2.1180.3160 and 16 before FP1 there is a use-after-free vulnerability in multiple agents that can lead to a denial of service or remote code execution. An unauthenticated attacker can use this vulnerability to crash the agent or potentially take control of the agent process and then the system it is running on.


An issue was discovered on Shenzhen Skyworth DT741 Converged Intelligent Terminal (G/EPON+IPTV) SDOTBGN1 DT721-cb SDOTBGN1 and DT741-cb SDOTBGN1 devices. A long password to the Web_passwd function allows remote attackers to cause a denial of service (segmentation fault) or achieve unauthenticated remote code execution because of control of registers S0 through S4 and T4 through T7.


An invalid write of 8 bytes due to a use-after-free vulnerability in the mg_http_free_proto_data_cgi function call in mongoose.c in Cesanta Mongoose Embedded Web Server Library 6.13 and earlier allows a denial of service (application crash) or remote code execution.


An invalid read of 8 bytes due to a use-after-free vulnerability during a \return\ in the mg_http_get_proto_data function in mongoose.c in Cesanta Mongoose Embedded Web Server Library 6.13 and earlier allows a denial of service (application crash) or remote code execution.


An invalid read of 8 bytes due to a use-after-free vulnerability in the mg_http_free_proto_data_cgi function call in mongoose.c in Cesanta Mongoose Embedded Web Server Library 6.13 and earlier allows a denial of service (application crash) or remote code execution.


An invalid read of 8 bytes due to a use-after-free vulnerability during a \NULL test\ in the mg_http_get_proto_data function in mongoose.c in Cesanta Mongoose Embedded Web Server Library 6.13 and earlier allows a denial of service (application crash) or remote code execution.


Receipt of a specific Draft-Rosen MVPN control packet may cause the routing protocol daemon (RPD) process to crash and restart or may lead to remote code execution. By continuously sending the same specific Draft-Rosen MVPN control packet an attacker can repeatedly crash the RPD process causing a prolonged denial of service. This issue may occur when the Junos OS device is configured for Draft-Rosen multicast virtual private network (MVPN). The VPN is multicast-enabled and configured to use Protocol Independent Multicast (PIM) protocol within the VPN. This issue can only be exploited from the PE device within the MPLS domain which is capable of forwarding IP multicast traffic in core. End-users connected to the CE device cannot cause this crash. Affected releases are Juniper Networks Junos OS: 12.1X46 versions prior to 12.1X46-D77 on SRX Series; 12.3 versions prior to 12.3R12-S10; 12.3X48 versions prior to 12.3X48-D70 on SRX Series; 15.1 versions prior to 15.1R4-S9 15.1R6-S6 15.1R7; 15.1F6; 15.1X49 versions prior to 15.1X49-D140 on SRX Series; 15.1X53 versions prior to 15.1X53-D59 on EX2300/EX3400 Series; 15.1X53 versions prior to 15.1X53-D67 on QFX10K Series; 15.1X53 versions prior to 15.1X53-D233 on QFX5200/QFX5110 Series; 15.1X53 versions prior to 15.1X53-D471 15.1X53-D490 on NFX Series; 16.1 versions prior to 16.1R4-S9 16.1R5-S4 16.1R6-S3 16.1R7; 16.2 versions prior to 16.2R1-S6 16.2R2-S6 16.2R3; 17.1 versions prior to 17.1R1-S7 17.1R2-S7 17.1R3; 17.2 versions prior to 17.2R2-S4 17.2R3; 17.3 versions prior to 17.3R2-S2 17.3R3; 17.4 versions prior to 17.4R1-S3 17.4R2; 18.1 versions prior to 18.1R2. No other Juniper Networks products or platforms are affected by this issue.


Junos OS routing protocol daemon (RPD) process may crash and restart or may lead to remote code execution while processing specific BGP NOTIFICATION messages. By continuously sending crafted BGP NOTIFICATION messages an attacker can repeatedly crash the RPD process causing a sustained Denial of Service. Due to design improvements this issue does not affect Junos OS 16.1R1 and all subsequent releases. This issue only affects the receiving BGP device and is non-transitive in nature. Affected releases are Juniper Networks Junos OS: 15.1F5 versions starting from 15.1F5-S7 and all subsequent releases; 15.1F6 versions starting from 15.1F6-S3 and later releases prior to 15.1F6-S10; 15.1F7 versions 15.1 versions starting from 15.1R5 and later releases including the Service Releases based on 15.1R5 and on 15.1R6 prior to 15.1R6-S6 and 15.1R7;


Receipt of a specific MPLS packet may cause the routing protocol daemon (RPD) process to crash and restart or may lead to remote code execution. By continuously sending specific MPLS packets an attacker can repeatedly crash the RPD process causing a sustained Denial of Service. This issue affects both IPv4 and IPv6. This issue can only be exploited from within the MPLS domain. End-users connected to the CE device cannot cause this crash. Affected releases are Juniper Networks Junos OS: 12.1X46 versions prior to 12.1X46-D77 on SRX Series; 12.3 versions prior to 12.3R12-S10; 12.3X48 versions prior to 12.3X48-D75 on SRX Series; 14.1X53 versions prior to 14.1X53-D47 on QFX/EX Series; 14.1X53 versions prior to 14.1X53-D130 on QFabric Series; 15.1F6 versions prior to 15.1F6-S10; 15.1 versions prior to 15.1R4-S9 15.1R7; 15.1X49 versions prior to 15.1X49-D140 on SRX Series; 15.1X53 versions prior to 15.1X53-D59 on EX2300/EX3400 Series; 15.1X53 versions prior to 15.1X53-D67 on QFX10K Series; 15.1X53 versions prior to 15.1X53-D233 on QFX5200/QFX5110 Series; 15.1X53 versions prior to 15.1X53-D471 15.1X53-D490 on NFX Series; 16.1 versions prior to 16.1R3-S8 16.1R4-S8 16.1R5-S4 16.1R6-S4 16.1R7; 16.1X65 versions prior to 16.1X65-D48; 16.2 versions prior to 16.2R1-S6 16.2R3; 17.1 versions prior to 17.1R1-S7 17.1R2-S6 17.1R3; 17.2 versions prior to 17.2R1-S6 17.2R2-S3 17.2R3; 17.2X75 versions prior to 17.2X75-D100 17.2X75-D42 17.2X75-D91; 17.3 versions prior to 17.3R1-S4 17.3R2-S2 17.3R3; 17.4 versions prior to 17.4R1-S3 17.4R2 . No other Juniper Networks products or platforms are affected by this issue.


In Lizard v1.0 and LZ5 v2.0 (the prior release before the product was renamed) there is an unchecked buffer size during a memcpy in the Lizard_decompress_LIZv1 function (lib/lizard_decompress_liz.h). Remote attackers can leverage this vulnerability to cause a denial of service via a crafted input file as well as achieve remote code execution.


MegaMek version < v0.45.1 contains a Other/Unknown vulnerability in Object Stream Connection that can result in Disclosure of confidential data denial of service SSRF remote code execution.


Ubilling version <= 0.9.2 contains a Other/Unknown vulnerability in user-controlled parameter that can result in Disclosure of confidential data denial of service SSRF remote code execution.


ZoneMinder version <= 1.32.2 contains a Other/Unknown vulnerability in User-controlled parameter that can result in Disclosure of confidential data denial of service SSRF remote code execution.


Python Cryptographic Authority pyopenssl version prior to version 17.5.0 contains a CWE-416: Use After Free vulnerability in X509 object handling that can result in Use after free can lead to possible denial of service or remote code execution.. This attack appear to be exploitable via Depends on the calling application and if it retains a reference to the memory.. This vulnerability appears to have been fixed in 17.5.0.


Use After Free in Remote logging (which is disabled by default) in McAfee McAfee Agent (MA) 5.x prior to 5.6.0 allows remote unauthenticated attackers to cause a Denial of Service and potentially a remote code execution via a specially crafted HTTP header sent to the logging service.


An issue was discovered in Amazon Web Services (AWS) FreeRTOS through 1.3.1 FreeRTOS up to V10.0.1 (with FreeRTOS+TCP) and WITTENSTEIN WHIS Connect middleware TCP/IP component. A crafted IP header triggers a full memory space copy in prvProcessIPPacket leading to denial of service and possibly remote code execution.


An issue was discovered in the prost crate before 0.6.1 for Rust. There is stack consumption via a crafted message causing a denial of service (e.g. x86) or possibly remote code execution (e.g. ARM).


Flaw in input validation in npm package utils-extend version 1.0.8 and earlier may allow prototype pollution attack that may result in remote code execution or denial of service of applications using utils-extend.


Flaw in input validation in npm package klona version 1.1.0 and earlier may allow prototype pollution attack that may result in remote code execution or denial of service of applications using klona.


is_blog_installed in wp-includes/functions.php in WordPress before 5.5.2 improperly determines whether WordPress is already installed which might allow an attacker to perform a new installation leading to remote code execution (as well as a denial of service for the old installation).


A vulnerability in Siemens SICAM PAS (all versions before V8.09) could allow a remote attacker to cause a Denial of Service condition and potentially lead to unauthenticated remote code execution by sending specially crafted packets to port 19234/TCP.


BadBlue 2.72 Personal Edition stores multiple programs in the web document root with insufficient access control which allows remote attackers to (1) cause a denial of service via multiple invocations of uninst.exe and have an unknown impact via (2) badblue.exe and (3) dyndns.exe. NOTE: this can be leveraged for arbitrary remote code execution in conjunction with CVE-2007-6378.


SAP NetWeaver 7.0 allows Remote Code Execution and Denial of Service caused by an error in the DiagTraceHex() function. By sending a specially-crafted packet an attacker could exploit this vulnerability to cause the application to crash.


XML Core Services (aka MSXML) 3.0 in Microsoft Windows Server 2003 SP2 Windows Vista SP2 Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8 Windows 8.1 Windows Server 2012 Gold and R2 and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code or cause a denial of service (system-state corruption) via crafted XML content aka \MSXML Remote Code Execution Vulnerability.\

remote code execution
denial of service
arbitrary code execution


Microsoft Silverlight 5 before 5.1.41212.0 mishandles negative offsets during decoding which allows remote attackers to execute arbitrary code or cause a denial of service (object-header corruption) via a crafted web site aka \Silverlight Runtime Remote Code Execution Vulnerability.\


There is a heap-based buffer overflow that causes a more than two thousand bytes out-of-bounds write in Liblouis 3.2.0 triggered in the function resolveSubtable() in compileTranslationTable.c. It will lead to denial of service or remote code execution.

remote code execution
denial of service
buffer overflow


On Netis WF2411 with firmware 2.1.36123 and other Netis WF2xxx devices (possibly WF2411 through WF2880) there is a stack-based buffer overflow that does not require authentication. This can cause denial of service (device restart) or remote code execution. This vulnerability can be triggered by a GET request with a long HTTP \Authorization: Basic\ header that is mishandled by user_auth->user_ok in /bin/boa.


A potential security vulnerability has been identified in the HPE Moonshot Provisioning Manager v1.20. The HPE Moonshot Provisioning Manager is an application that is installed in a VMWare or Microsoft Hyper-V environment that is used to setup and configure an HPE Moonshot 1500 chassis. This vulnerability could be remotely exploited by an unauthenticated user to cause a stack based buffer overflow using user supplied input to the `khuploadfile.cgi` CGI ELF. The stack based buffer overflow could lead to Remote Code Execution Denial of Service and/or compromise system integrity. **Note:** HPE recommends that customers discontinue the use of the HPE Moonshot Provisioning Manager. The HPE Moonshot Provisioning Manager application is discontinued no longer supported is not available to download from the HPE Support Center and no patch is available.


Multiple heap-based buffer overflow vulnerabilities exist in Honeywell Experion PKS all versions prior to R400.6 all versions prior to R410.6 and all versions prior to R430.2 modules which could lead to possible remote code execution or denial of service. Honeywell strongly encourages and recommends all customers running unsupported versions of EKPS prior to R400 to upgrade to a supported version.


In modules/imgcodecs/src/grfmt_pxm.cpp the length of buffer AutoBuffer _src is small than expected which will cause copy buffer overflow later. If the image is from remote may lead to remote code execution or denial of service. This affects Opencv 3.3 and earlier.


A mishandled zero case was discovered in opj_j2k_set_cinema_parameters in lib/openjp2/j2k.c in OpenJPEG 2.2.0. The vulnerability causes an out-of-bounds write which may lead to remote denial of service (heap-based buffer overflow affecting opj_write_bytes_LE in lib/openjp2/cio.c and opj_j2k_write_sot in lib/openjp2/j2k.c) or possibly remote code execution.


A size-validation issue was discovered in opj_j2k_write_sot in lib/openjp2/j2k.c in OpenJPEG 2.2.0. The vulnerability causes an out-of-bounds write which may lead to remote denial of service (heap-based buffer overflow affecting opj_write_bytes_LE in lib/openjp2/cio.c) or possibly remote code execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-14152.


An off-by-one error was discovered in opj_tcd_code_block_enc_allocate_data in lib/openjp2/tcd.c in OpenJPEG 2.2.0. The vulnerability causes an out-of-bounds write which may lead to remote denial of service (heap-based buffer overflow affecting opj_mqc_flush in lib/openjp2/mqc.c and opj_t1_encode_cblk in lib/openjp2/t1.c) or possibly remote code execution.


LightFTP version 1.1 is vulnerable to a buffer overflow in the \writelogentry\ function resulting a denial of services or a remote code execution.


A buffer overflow was discovered in the URL-authentication backend of the Icecast before 2.4.4. If the backend is enabled then any malicious HTTP client can send a request for that specific resource including a crafted header leading to denial of service and potentially remote code execution.


In FreeBSD before 11.2-STABLE(r348229) 11.2-RELEASE-p7 12.0-STABLE(r342228) and 12.0-RELEASE-p1 insufficient validation of network-provided data in bootpd may make it possible for a malicious attacker to craft a bootp packet which could cause a stack buffer overflow. It is possible that the buffer overflow could lead to a Denial of Service or remote code execution.


The function DecWPA2KeyData() in the Realtek RTL8195A Wi-Fi Module prior to versions released in April 2020 (up to and excluding 2.08) does not validate the size parameter for an rtl_memcpy() operation resulting in a stack buffer overflow which can be exploited for remote code execution or denial of service. An attacker can impersonate an Access Point and attack a vulnerable Wi-Fi client by injecting a crafted packet into the WPA2 handshake. The attacker needs to know the network's PSK in order to exploit this.


The function DecWPA2KeyData() in the Realtek RTL8195A Wi-Fi Module prior to versions released in April 2020 (up to and excluding 2.08) does not validate the size parameter for an internal function rt_arc4_crypt_veneer() or _AES_UnWRAP_veneer() resulting in a stack buffer overflow which can be exploited for remote code execution or denial of service. An attacker can impersonate an Access Point and attack a vulnerable Wi-Fi client by injecting a crafted packet into the WPA2 handshake. The attacker needs to know the network's PSK in order to exploit this.


The function AES_UnWRAP() in the Realtek RTL8195A Wi-Fi Module prior to versions released in April 2020 (up to and excluding 2.08) does not validate the size parameter for a memcpy() operation resulting in a stack buffer overflow which can be exploited for remote code execution or denial of service. An attacker can impersonate an Access Point and attack a vulnerable Wi-Fi client by injecting a crafted packet into the WPA2 handshake. The attacker needs to know the network's PSK in order to exploit this.


TRENDnet ProView Wireless camera TV-IP512WN 1.0R 1.0.4 is vulnerable to an unauthenticated stack-based buffer overflow in handling RTSP packets. This may result in remote code execution or denial of service. The issue is in the binary rtspd (in /sbin) when parsing a long \Authorization: Basic\ RTSP header.


A stack-based buffer overflow in the processPrivilage() function in IOS/process-general.c in nipper-ng 0.11.10 allows remote attackers (serving firewall configuration files) to achieve Remote Code Execution or Denial Of Service via a crafted file.


A stack-based buffer overflow was discovered in the pgxtoimage function in bin/jp2/convert.c in OpenJPEG 2.2.0. The vulnerability causes an out-of-bounds write which may lead to remote denial of service or possibly remote code execution.


A vulnerability in the Universal Plug-and-Play (UPnP) implementation in the Cisco CVR100W Wireless-N VPN Router could allow an unauthenticated Layer 2-adjacent attacker to execute arbitrary code or cause a denial of service (DoS) condition. The remote code execution could occur with root privileges. The vulnerability is due to incomplete range checks of the UPnP input data which could result in a buffer overflow. An attacker could exploit this vulnerability by sending a malicious request to the UPnP listening port of the targeted device. An exploit could allow the attacker to cause the device to reload or potentially execute arbitrary code with root privileges. This vulnerability affects all firmware releases of the Cisco CVR100W Wireless-N VPN Router prior to Firmware Release 1.0.1.22. Cisco Bug IDs: CSCuz72642.

remote code execution
denial of service
buffer overflow
arbitrary code execution
dos


A vulnerability in the Cisco Discovery Protocol feature of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthenticated adjacent attacker to execute arbitrary code as root or cause a denial of service (DoS) condition on an affected device. The vulnerability exists because of insufficiently validated Cisco Discovery Protocol packet headers. An attacker could exploit this vulnerability by sending a crafted Cisco Discovery Protocol packet to a Layer 2-adjacent affected device. A successful exploit could allow the attacker to cause a buffer overflow that could allow the attacker to execute arbitrary code as root or cause a DoS condition on the affected device. Note: Cisco Discovery Protocol is a Layer 2 protocol. To exploit this vulnerability an attacker must be in the same broadcast domain as the affected device (Layer 2 adjacent). Note: This vulnerability is different from the following Cisco FXOS and NX-OS Software Cisco Discovery Protocol vulnerabilities that Cisco announced on Feb. 5 2020: Cisco FXOS IOS XR and NX-OS Software Cisco Discovery Protocol Denial of Service Vulnerability and Cisco NX-OS Software Cisco Discovery Protocol Remote Code Execution Vulnerability.


A stack-based Buffer Overflow vulnerability in Juniper Networks SBR Carrier with EAP (Extensible Authentication Protocol) authentication configured allows an attacker sending specific packets causing the radius daemon to crash resulting with a Denial of Service (DoS) or leading to remote code execution (RCE). By continuously sending this specific packets an attacker can repeatedly crash the radius daemon causing a sustained Denial of Service (DoS). This issue affects Juniper Networks SBR Carrier: 8.4.1 versions prior to 8.4.1R19; 8.5.0 versions prior to 8.5.0R10; 8.6.0 versions prior to 8.6.0R4.

remote code execution
denial of service
buffer overflow
dos


A buffer size validation vulnerability in the overlayd service of Juniper Networks Junos OS may allow an unauthenticated remote attacker to send specially crafted packets to the device triggering a partial Denial of Service (DoS) condition or leading to remote code execution (RCE). Continued receipt and processing of these packets will sustain the partial DoS. The overlayd daemon handles Overlay OAM packets such as ping and traceroute sent to the overlay. The service runs as root by default and listens for UDP connections on port 4789. This issue results from improper buffer size validation which can lead to a buffer overflow. Unauthenticated attackers can send specially crafted packets to trigger this vulnerability resulting in possible remote code execution. overlayd runs by default in MX Series ACX Series and QFX Series platforms. The SRX Series does not support VXLAN and is therefore not vulnerable to this issue. Other platforms are also vulnerable if a Virtual Extensible LAN (VXLAN) overlay network is configured. This issue affects Juniper Networks Junos OS: 15.1 versions prior to 15.1R7-S9; 17.3 versions prior to 17.3R3-S11; 17.4 versions prior to 17.4R2-S13 17.4R3-S4; 18.1 versions prior to 18.1R3-S12; 18.2 versions prior to 18.2R2-S8 18.2R3-S7; 18.3 versions prior to 18.3R3-S4; 18.4 versions prior to 18.4R1-S8 18.4R2-S7 18.4R3-S7; 19.1 versions prior to 19.1R2-S2 19.1R3-S4; 19.2 versions prior to 19.2R1-S6 19.2R3-S2; 19.3 versions prior to 19.3R3-S1; 19.4 versions prior to 19.4R2-S4 19.4R3-S1; 20.1 versions prior to 20.1R2-S1 20.1R3; 20.2 versions prior to 20.2R2 20.2R2-S1 20.2R3; 20.3 versions prior to 20.3R1-S1.


Multiple stack-based buffer overflow vulnerabilities were found in Honeywell Experion PKS all versions prior to R400.6 all versions prior to R410.6 and all versions prior to R430.2 modules that could lead to possible remote code execution dynamic memory corruption or denial of service. Honeywell strongly encourages and recommends all customers running unsupported versions of EKPS prior to R400 to upgrade to a supported version.

remote code execution
denial of service
buffer overflow
memory corruption


A potential security vulnerability has been identified in the HPE Moonshot Provisioning Manager v1.20. The HPE Moonshot Provisioning Manager is an application that is installed in a VMWare or Microsoft Hyper-V environment that is used to setup and configure an HPE Moonshot 1500 chassis. This vulnerability could be remotely exploited by an unauthenticated user to cause a directory traversal in user supplied input to the `khuploadfile.cgi` CGI ELF. The directory traversal could lead to Remote Code Execution Denial of Service and/or compromise system integrity. **Note:** HPE recommends that customers discontinue the use of the HPE Moonshot Provisioning Manager. The HPE Moonshot Provisioning Manager application is discontinued no longer supported is not available to download from the HPE Support Center and no patch is available.

remote code execution
denial of service
directory traversal


An issue was discovered in Jamf Pro 9.x and 10.x before 10.15.1. Deserialization of untrusted data when parsing JSON in several APIs may cause Denial of Service (DoS) remote code execution (RCE) and/or deletion of files on the Jamf Pro server.

remote code execution
denial of service
dos


A potential vulnerability in the Oracle Talent Acquisition Cloud - Taleo Enterprise Edition. This high severity potential vulnerability allows attackers to perform remote code execution on Taleo Enterprise Edition system. Successful attacks of this vulnerability can result in unauthorized remote code execution within Taleo Enterprise Edition and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Talent Acquisition Cloud - Taleo Enterprise Edition. All affected customers were notified of CVE-2021-35689 by Oracle.


An Out Of Bounds (OOB) access vulnerability in the handling of responses by a Juniper Agile License (JAL) Client in Juniper Networks Junos OS and Junos OS Evolved configured in Network Mode (to use Juniper Agile License Manager) may allow an attacker to cause a partial Denial of Service (DoS) or lead to remote code execution (RCE). The vulnerability exists in the packet parsing logic on the client that processes the response from the server using a custom protocol. An attacker with control of a JAL License Manager or with access to the local broadcast domain may be able to spoof a new JAL License Manager and/or craft a response to the Junos OS License Client leading to exploitation of this vulnerability. This issue only affects Junos systems configured in Network Mode. Systems that are configured in Standalone Mode (the default mode of operation for all systems) are not vulnerable to this issue. This issue affects: Juniper Networks Junos OS: 19.2 versions prior to 19.2R3-S3; 19.3 versions prior to 19.3R3-S3; 20.1 versions prior to 20.1R2-S2 20.1R3-S1; 20.2 versions prior to 20.2R3-S2; 20.3 versions prior to 20.3R3; 20.4 versions prior to 20.4R3; 21.1 versions prior to 21.1R2. Juniper Networks Junos OS Evolved: version 20.1R1-EVO and later versions prior to 21.2R2-EVO. This issue does not affect Juniper Networks Junos OS versions prior to 19.2R1.


Prototype pollution vulnerability via .parse() in Plist before v3.0.4 allows attackers to cause a Denial of Service (DoS) and may lead to remote code execution.


This affects the package total.js before 3.4.7. The set function can be used to set a value into the object according to the path. However the keys of the path being set are not properly sanitized leading to a prototype pollution vulnerability. The impact depends on the application. In some cases it is possible to achieve Denial of service (DoS) Remote Code Execution or Property Injection.


On Juniper Networks SRX Series with ICAP (Internet Content Adaptation Protocol) redirect service enabled a double free vulnerability can lead to a Denial of Service (DoS) or Remote Code Execution (RCE) due to processing of a specific HTTP message. Continued processing of this specific HTTP message may result in an extended Denial of Service (DoS). The offending HTTP message that causes this issue may originate both from the HTTP server or the client. This issue affects Juniper Networks Junos OS on SRX Series: 18.1 versions prior to 18.1R3-S9; 18.2 versions prior to 18.2R3-S3; 18.3 versions prior to 18.3R2-S4 18.3R3-S1; 18.4 versions prior to 18.4R2-S5 18.4R3; 19.1 versions prior to 19.1R2; 19.2 versions prior to 19.2R1-S2 19.2R2; 19.3 versions prior to 19.3R2. This issue does not affect Juniper Networks Junos OS prior to 18.1R1.


The DHCPv6 Relay-Agent service part of the Juniper Enhanced jdhcpd daemon shipped with Juniper Networks Junos OS has an Improper Input Validation vulnerability which will result in a Denial of Service (DoS) condition when a DHCPv6 client sends a specific DHPCv6 message allowing an attacker to potentially perform a Remote Code Execution (RCE) attack on the target device. Continuous receipt of the specific DHCPv6 client message will result in an extended Denial of Service (DoS) condition. If adjacent devices are also configured to relay DHCP packets and are not affected by this issue and simply transparently forward unprocessed client DHCPv6 messages then the attack vector can be a Network-based attack instead of an Adjacent-device attack. No other DHCP services are affected. Receipt of the packet without configuration of the DHCPv6 Relay-Agent service will not result in exploitability of this issue. This issue affects Juniper Networks Junos OS: 12.3 versions prior to 12.3R12-S15; 12.3X48 versions prior to 12.3X48-D95; 14.1X53 versions prior to 14.1X53-D53; 15.1 versions prior to 15.1R7-S6; 15.1X49 versions prior to 15.1X49-D200; 15.1X53 versions prior to 15.1X53-D593; 16.1 versions prior to 16.1R7-S7; 16.2 versions prior to 16.2R2-S11; 17.1 versions prior to 17.1R2-S11 17.1R3-S2; 17.2 versions prior to 17.2R3-S3; 17.2X75 versions prior to 17.2X75-D44; 17.3 versions prior to 17.3R3-S7; 17.4 versions prior to 17.4R2-S9 17.4R3; 18.1 versions prior to 18.1R3-S9; 18.2 versions prior to 18.2R2-S6 18.2R3-S2; 18.2X75 versions prior to 18.2X75-D12 18.2X75-D33 18.2X75-D435 18.2X75-D60; 18.3 versions prior to 18.3R1-S7 18.3R2-S3 18.3R3-S1; 18.4 versions prior to 18.4R1-S5 18.4R2-S3 18.4R3; 19.1 versions prior to 19.1R1-S4 19.1R2; 19.2 versions prior to 19.2R1-S3 19.2R2; 19.3 versions prior to 19.3R2.


On Juniper Networks SRX Series with ICAP (Internet Content Adaptation Protocol) redirect service enabled processing a malformed HTTP message can lead to a Denial of Service (DoS) or Remote Code Execution (RCE) Continued processing of this malformed HTTP message may result in an extended Denial of Service (DoS) condition. The offending HTTP message that causes this issue may originate both from the HTTP server or the HTTP client. This issue affects Juniper Networks Junos OS on SRX Series: 18.1 versions prior to 18.1R3-S9 ; 18.2 versions prior to 18.2R2-S7 18.2R3-S3; 18.3 versions prior to 18.3R1-S7 18.3R2-S4 18.3R3-S1; 18.4 versions prior to 18.4R1-S7 18.4R2-S4 18.4R3; 19.1 versions prior to 19.1R1-S5 19.1R2; 19.2 versions prior to 19.2R1-S2 19.2R2; 19.3 versions prior to 19.3R2. This issue does not affect Juniper Networks Junos OS prior to 18.1R1.


A vulnerability in the Cisco Discovery Protocol implementation for the Cisco Video Surveillance 8000 Series IP Cameras could allow an unauthenticated adjacent attacker to execute code remotely or cause a reload of an affected IP Camera. The vulnerability is due to missing checks when processing Cisco Discovery Protocol messages. An attacker could exploit this vulnerability by sending a malicious Cisco Discovery Protocol packet to the targeted IP Camera. A successful exploit could allow the attacker to expose the affected IP Camera for remote code execution or cause it to reload unexpectedly resulting in a denial of service (DoS) condition. Cisco Discovery Protocol is a Layer 2 protocol. To exploit this vulnerability an attacker must be in the same broadcast domain as the affected device (Layer 2 adjacent). This vulnerability is fixed in Video Surveillance 8000 Series IP Camera Firmware Release 1.0.7 and later.


Multiple vulnerabilities in the Cisco ATA 190 Series Analog Telephone Adapter Software could allow an attacker to perform a command injection attack resulting in remote code execution or cause a denial of service (DoS) condition on an affected device. For more information about these vulnerabilities see the Details section of this advisory.

remote code execution
denial of service
dos
command injection


There is a Integer Overflow or Wraparound vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to remote denial of service and potential remote code execution.

remote code execution
denial of service
integer overflow


Redis is an open source in-memory database that persists on disk. An integer overflow bug in the underlying string library can be used to corrupt the heap and potentially result with denial of service or remote code execution. The vulnerability involves changing the default proto-max-bulk-len configuration parameter to a very large value and constructing specially crafted network payloads or commands. The problem is fixed in Redis versions 6.2.6 6.0.16 and 5.0.14. An additional workaround to mitigate the problem without patching the redis-server executable is to prevent users from modifying the proto-max-bulk-len configuration parameter. This can be done using ACL to restrict unprivileged users from using the CONFIG SET command.


NVIDIA CUDA Toolkit SDK contains an integer overflow vulnerability in cuobjdump.To exploit this vulnerability a remote attacker would require a local user to download a specially crafted corrupted file and locally execute cuobjdump against the file. Such an attack may lead to remote code execution that causes complete denial of service and an impact on data confidentiality and integrity.


In

function

ReadNumber

did

not

checkout

the

input

length

which

lead

to

integer

overflow.

If

the

image

is

from

remote

may

lead

to

remote

code

execution

or

denial

of

service.

This

affects

Opencv

and

earlier.


In

function

PxMDecoder::readData

has

an

integer

overflow

when

calculate

If

the

image

is

from

remote

may

lead

to

remote

code

execution

or

denial

of

service.

This

affects

Opencv

and

earlier.


In opencv/modules/imgcodecs/src/utils.cpp functions FillUniColor and FillUniGray do not check the input length which can lead to integer overflow. If the image is from remote may lead to remote code execution or denial of service. This affects Opencv 3.3 and earlier.


An integer overflow vulnerability in the ptp_unpack_EOS_CustomFuncEx function of the ptp-pack.c file of libmtp (version 1.1.12 and below) allows attackers to cause a denial of service (out-of-bounds memory access) or maybe remote code execution by inserting a mobile device into a personal computer through a USB cable.


An integer overflow vulnerability in ptp-pack.c (ptp_unpack_OPL function) of libmtp (version 1.1.12 and below) allows attackers to cause a denial of service (out-of-bounds memory access) or maybe remote code execution by inserting a mobile device into a personal computer through a USB cable.


On Samsung Galaxy S4 through S7 devices an integer overflow condition exists within libomacp.so when parsing OMACP messages (within WAP Push SMS messages) leading to a heap corruption that can result in Denial of Service and potentially remote code execution a subset of SVE-2016-6542.


A CWE-190: Integer Overflow or Wraparound vulnerability exists that could cause heap-based buffer overflow leading to denial of service and potentially remote code execution when an attacker sends multiple specially crafted messages. Affected Product: Interactive Graphical SCADA System Data Server (V15.0.0.22020 and prior)

remote code execution
denial of service
integer overflow
buffer overflow


The Mitel MiVoice 5330e VoIP device is affected by memory corruption flaws in the SIP/SDP packet handling functionality. An attacker can exploit this issue remotely by sending a particular pattern of SIP/SDP packets to cause a denial of service state in the affected devices and probably remote code execution.

remote code execution
denial of service
memory corruption


Microsoft .NET Framework 2.0 SP2 3.5 3.5.1 4 4.5 4.5.1 and 4.5.2 does not properly parse internationalized resource identifiers which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted request to a .NET web application aka \.NET Framework Remote Code Execution Vulnerability.\

remote code execution
denial of service
memory corruption
arbitrary code execution


Microsoft Word 2007 SP3 Word Viewer and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document aka \Microsoft Office Bad Index Remote Code Execution Vulnerability.\


Microsoft Word 2007 SP3 Word Viewer and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document aka \Microsoft Office Invalid Pointer Remote Code Execution Vulnerability.\


Microsoft Word 2007 SP3 Office 2010 SP2 Word 2010 SP2 Word Automation Services in SharePoint Server 2010 Web Applications 2010 SP2 Word Viewer and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document aka \Office Remote Code Execution Vulnerability.\


Microsoft Word 2007 SP3 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document aka \OneTableDocumentStream Remote Code Execution Vulnerability.\


Microsoft Excel 2007 SP3; the proofing tools in Office 2010 SP2; Excel 2010 SP2; Excel 2013 Gold SP1 and RT; Excel Viewer; and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document aka \Excel Remote Code Execution Vulnerability.\


Microsoft Word 2003 SP3 2007 SP2 and SP3 and 2010 SP1; Word Viewer; Office Compatibility Pack SP2 and SP3; and Office Web Apps 2010 SP1 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted RTF data aka \Word RTF 'listoverridecount' Remote Code Execution Vulnerability.\


An Out-of-bounds Read vulnerability in the processing of specially crafted LLDP frames by the Layer 2 Control Protocol Daemon (l2cpd) of Juniper Networks Junos OS and Junos OS Evolved may allow an attacker to cause a Denial of Service (DoS) or may lead to remote code execution (RCE). Continued receipt and processing of these frames sent from the local broadcast domain will repeatedly crash the l2cpd process and sustain the Denial of Service (DoS) condition. This issue affects: Juniper Networks Junos OS: 12.3 versions prior to 12.3R12-S18; 15.1 versions prior to 15.1R7-S9; 17.3 versions prior to 17.3R3-S12; 17.4 versions prior to 17.4R2-S13 17.4R3-S5; 18.1 versions prior to 18.1R3-S13; 18.2 versions prior to 18.2R3-S8; 18.3 versions prior to 18.3R3-S5; 18.4 versions prior to 18.4R2-S8 18.4R3-S8; 19.1 versions prior to 19.1R3-S5; 19.2 versions prior to 19.2R3-S3; 19.3 versions prior to 19.3R2-S6 19.3R3-S2; 19.4 versions prior to 19.4R1-S4 19.4R2-S4 19.4R3-S3; 20.1 versions prior to 20.1R2-S2 20.1R3; 20.2 versions prior to 20.2R3-S1; 20.3 versions prior to 20.3R2-S1 20.3R3; 20.4 versions prior to 20.4R2. Juniper Networks Junos OS Evolved versions prior to 20.4R2-EVO.

remote code execution
denial of service
out of bound read
dos


GitLab Community and Enterprise Edition before 10.7.7 10.8.x before 10.8.6 and 11.x before 11.0.4 allows Directory Traversal with write access and resultant remote code execution via the GitLab projects import component.

remote code execution
directory traversal


Simple Machines Forum (SMF) 2.0.4 allows local file inclusion with resultant remote code execution in install.php via ../ directory traversal in the db_type parameter if install.php remains present after installation.


A directory traversal and local file inclusion vulnerability in FPProducerInternetServer.exe in Ricoh MarcomCentral formerly PTI Marketing FusionPro VDP before 10.0 allows a remote attacker to list or enumerate sensitive contents of files. Furthermore this could allow for privilege escalation by dumping the local machine's SAM and SYSTEM database files and possibly remote code execution.


Trend Micro OfficeScan versions 11.0 and XG (12.0) could be exploited by an attacker utilizing a directory traversal vulnerability to extract files from an arbitrary zip file to a specific folder on the OfficeScan server which could potentially lead to remote code execution (RCE). The remote process execution is bound to a web service account which depending on the web platform used may have restricted permissions. An attempted attack requires user authentication.


The Camera Upload functionality in Plex Media Server through 1.18.2.2029 allows remote authenticated users to write files anywhere the user account running the Plex Media Server has permissions. This allows remote code execution via a variety of methods such as (on a default Ubuntu installation) creating a .ssh folder in the plex user's home directory via directory traversal uploading an SSH authorized_keys file there and logging into the host as the Plex user via SSH.


ATutor

allows

Arbitrary

File

Upload

and

Directory

Traversal

resulting

in

remote

code

execution

via

a

pathname

in

a

ZIP

archive

to

the

(aka

Import

New

Language)

or

(aka

Patcher)

component.


BlogEngine.NET 3.3.7.0 and earlier allows Directory Traversal and Remote Code Execution via the theme cookie to the File Manager. NOTE: this issue exists because of an incomplete fix for CVE-2019-6714.


BlogEngine.NET

and

earlier

allows

Directory

Traversal

and

Remote

Code

Execution

because

file

creation

is

mishandled

related

to

and

NOTE:

this

issue

exists

because

of

an

incomplete

fix

for


A directory traversal vulnerability was discovered in RepetierServer.exe in Repetier-Server 0.8 through 0.91 that allows for the creation of a user controlled XML file at an unintended location. When this is combined with CVE-2019-14451 an attacker can upload an \external command\ configuration as a printer configuration and achieve remote code execution. After exploitation loading of the external command configuration is dependent on a system reboot or service restart.


Directory Traversal in the function http_verify in nostromo nhttpd through 1.9.6 allows an attacker to achieve remote code execution via a crafted HTTP request.


An issue was discovered in Thomson Reuters Desktop Extensions 1.9.0.358. An unauthenticated directory traversal and local file inclusion vulnerability in the ThomsonReuters.Desktop.Service.exe and ThomsonReuters.Desktop.exe allows a remote attacker to list or enumerate sensitive contents of files via a \\.. to port 6677. Additionally this could allow for privilege escalation by dumping the affected machine's SAM and SYSTEM database files as well as remote code execution.


Zoho ManageEngine Eventlog Analyzer through 12147 is vulnerable to unauthenticated directory traversal via an entry in a ZIP archive. This leads to remote code execution.


Deutsche Post Mailoptimizer 4.3 before 2020-11-09 allows Directory Traversal via a crafted ZIP archive to the Upload feature or the MO Connect component. This can lead to remote code execution.


Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3 when JWT is used via a /.. sequence in an image upload parameter.


A directory traversal vulnerability was found in the ClairCore engine of Clair. An attacker can exploit this by supplying a crafted container image which when scanned by Clair allows for arbitrary file write on the filesystem potentially allowing for remote code execution.


In Citrix XenMobile Server through 10.12 RP9 there is an Authenticated Directory Traversal vulnerability leading to remote code execution.


An

issue

was

discovered

in

Echo

ShareCare

The

file-upload

feature

in

is

susceptible

to

an

unrestricted

upload

vulnerability

via

the

parameter

when

processing

remote

input

from

an

authenticated

user

leading

to

the

ability

for

arbitrary

files

to

be

written

to

arbitrary

filesystem

locations

via

Directory

Traversal

on

the

Z:

drive

(a

hard-coded

drive

letter

where

ShareCare

application

files

reside)

and

remote

code

execution

as

the

ShareCare

service

user

(NT

AUTHORITY\\SYSTEM).


A remote code execution vulnerability exists in Chamilo through 1.11.14 due to improper input sanitization of a parameter used for file uploads and improper file-extension filtering for certain filenames (e.g. .phar or .pht). A remote authenticated administrator is able to upload a file containing arbitrary PHP code into specific directories via main/inc/lib/fileUpload.lib.php directory traversal to achieve PHP code execution.


Gridpro Request Management for Windows Azure Pack before 2.0.7912 allows Directory Traversal for remote code execution as demonstrated by ..\\\\ in a scriptName JSON value to ServiceManagerTenant/GetVisibilityMap.


Certain

products

allow

unrestricted

file

upload

with

resultant

remote

code

execution.

The

attacker

must

use

a

/fileupload

endpoint

with

a

Content-Disposition

directory

traversal

sequence

to

reach

a

directory

under

the

web

root

such

as

a

directory.

This

affects

API

Manager

and

above

through

Identity

Server

and

above

through

Identity

Server

Analytics

and

Identity

Server

as

Key

Manager

and

above

through

and

Enterprise

Integrator

and

above

through


ImpressCMS before 1.4.2 allows unauthenticated remote code execution via ...../// directory traversal in origName or imageName leading to unsafe interaction with the CKEditor processImage.php script. The payload may be placed in PHP_SESSION_UPLOAD_PROGRESS when the PHP installation supports upload_progress.


Multiple directory traversal vulnerabilities in FCKeditor before 2.6.4.1 allow remote attackers to create executable files in arbitrary directories via directory traversal sequences in the input to unspecified connector modules as exploited in the wild for remote code execution in July 2009 related to the file browser and the editor/filemanager/connectors/ directory.


Directory traversal vulnerability in common.php in SIR GNUBoard 4.31.03 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the g4_path parameter. NOTE: in some environments this can be leveraged for remote code execution via a data: URI or a UNC share pathname.


kittoframework kitto 0.5.1 is vulnerable to directory traversal in the router resulting in remote code execution


Winmail Server 6.1 allows remote code execution by authenticated users who leverage directory traversal in a netdisk.php move_folder_file call to move a .php file from the FTP folder into a web folder.


In Go Doc Dot Org (gddo) through 2018-06-27 an attacker could use specially crafted <go-import> tags in packages being fetched by gddo to cause a directory traversal and remote code execution.


In Git before 2.13.7 2.14.x before 2.14.4 2.15.x before 2.15.2 2.16.x before 2.16.4 and 2.17.x before 2.17.1 remote code execution can occur. With a crafted .gitmodules file a malicious project can execute an arbitrary script on a machine that runs \git clone --recurse-submodules\ because submodule \names\ are obtained from this file and then appended to $GIT_DIR/modules leading to directory traversal with \../\ in a name. Finally post-checkout hooks from a submodule are executed bypassing the intended design in which hooks are not obtained from a remote server.


JFrog JFrog Artifactory version Prior to version 6.0.3 since version 4.0.0 contains a Directory Traversal vulnerability in The \Import Repository from Zip\ feature available through the Admin menu -> Import & Export -> Repositories triggers a vulnerable UI REST endpoint (/ui/artifactimport/upload) that can result in Directory traversal / file overwrite and remote code execution. This attack appear to be exploitable via An attacker with Admin privileges may use the aforementioned UI endpoint and exploit the publicly known \Zip Slip\ vulnerability to add/overwrite files outside the target directory. This vulnerability appears to have been fixed in 6.0.3.


LimeSurvey

version

and

earlier

contains

a

directory

traversal

in

file

upload

that

allows

upload

of

webshell

vulnerability

in

file

upload

functionality

that

can

result

in

remote

code

execution

as

authenticated

user.

This

attack

appear

to

be

exploitable

via

An

authenticated

user

can

upload

a

specially

crafted

zip

file

to

get

remote

code

execution.

This

vulnerability

appears

to

have

been

fixed

in

after

commit

version


Winmail Server through 6.2 allows remote code execution by authenticated users who leverage directory traversal in a netdisk.php copy_folder_file call (in inc/class.ftpfolder.php) to move a .php file from the FTP folder into a web folder.


An \Unrestricted Upload of File with Dangerous Type\ issue with directory traversal in navigate_upload.php in Naviwebs Navigate CMS 2.8 allows authenticated attackers to achieve remote code execution via a POST request with engine=picnik and id=../../../navigate_info.php.


Directory Traversal / Arbitrary File Write / Remote Code Execution in the User.setLanguage method in eQ-3 AG Homematic CCU2 2.29.2 and earlier allows remote attackers to write arbitrary files to the device's filesystem. This vulnerability can be exploited by unauthenticated attackers with access to the web interface.


A directory traversal vulnerability with remote code execution in Prim'X Zed! FREE through 1.0 build 186 and Zed! Limited Edition through 6.1 build 2208 allows creation of arbitrary files on a user's workstation using crafted ZED! containers because the watermark loading function can place an executable file into a Startup folder.


There are multiple unauthenticated directory traversal vulnerabilities in different FTP commands in uftpd FTP server versions 2.7 to 2.10 due to improper implementation of a chroot jail in common.c's compose_abspath function that can be abused to read or write to arbitrary files on the filesystem leak process memory or potentially lead to remote code execution.


Unathenticated directory traversal in the ReceiverServlet class doPost() method can lead to arbitrary remote code execution in HPE Pay Per Use (PPU) Utility Computing Service (UCS) Meter version 1.9.


An issue was discovered in Observium Professional Enterprise & Community 20.8.10631. It is vulnerable to directory traversal and local file inclusion due to the fact that there is an unrestricted possibility of loading any file with an inc.php extension. Inclusion of other files (even though limited to the mentioned extension) can lead to Remote Code Execution. This can occur via /settings/?format=../ URIs to pages/settings.inc.php.


The cache action in action/cache.py in MoinMoin through 1.9.10 allows directory traversal through a crafted HTTP request. An attacker who can upload attachments to the wiki can use this to achieve remote code execution.


An issue was discovered in Observium Professional Enterprise & Community 20.8.10631. It is vulnerable to directory traversal and local file inclusion due to the fact that there is an unrestricted possibility of loading any file with an inc.php extension. Inclusion of other files (even though limited to the mentioned extension) can lead to Remote Code Execution. This can occur via /ports/?format=../ URIs to pages/ports.inc.php.


An

issue

was

discovered

in

Observium

Professional

Enterprise

Community

It

is

vulnerable

to

directory

traversal

and

local

file

inclusion

due

to

the

fact

that

there

is

an

unrestricted

possibility

of

loading

any

file

with

an

inc.php

extension.

Inclusion

of

other

files

(even

though

limited

to

the

mentioned

extension)

can

lead

to

Remote

Code

Execution.

This

can

occur

via

/device/device=345/?tab=health&metric=../

because

of

device/health.inc.php.


An issue was discovered in Observium Professional Enterprise & Community 20.8.10631. It is vulnerable to directory traversal and local file inclusion due to the fact that there is an unrestricted possibility of loading any file with an inc.php extension. Inclusion of other files (even though limited to the mentioned extension) can lead to Remote Code Execution. This can occur via /device/device=345/?tab=ports&view=../ URIs because of device/port.inc.php.


An issue was discovered in Observium Professional Enterprise & Community 20.8.10631. It is vulnerable to directory traversal and local file inclusion due to the fact that there is an unrestricted possibility of loading any file with an inc.php extension. Inclusion of other files (even though limited to the mentioned extension) can lead to Remote Code Execution. This can occur via /apps/?app=../ URIs.


An

issue

was

discovered

in

Observium

Professional

Enterprise

Community

It

is

vulnerable

to

directory

traversal

and

local

file

inclusion

due

to

the

fact

that

there

is

an

unrestricted

possibility

of

loading

any

file

with

an

inc.php

extension.

Inclusion

of

other

files

(even

though

limited

to

the

mentioned

extension)

can

lead

to

Remote

Code

Execution.

This

can

occur

via

/device/device=345/?tab=routing&proto=../

URIs

to

device/routing.inc.php.


admin/file.do in ObjectPlanet Opinio before 7.15 allows Unrestricted File Upload of executable JSP files resulting in remote code execution because filePath can have directory traversal and fileContent can be valid JSP code.


MX Player Android App versions prior to v1.24.5 are vulnerable to a directory traversal vulnerability when user is using the MX Transfer feature in \Receive\ mode. An attacker can exploit this by connecting to the MX Transfer session as a \sender\ and sending a MessageType of \FILE_LIST\ with a \name\ field containing directory traversal characters (../). This will result in the file being transferred to the victim's phone but being saved outside of the intended \/sdcard/MXshare\ directory. In some instances an attacker can achieve remote code execution by writing \.odex\ and \.vdex\ files in the \oat\ directory of the MX Player application.


A directory traversal issue in the Utils/Unzip module in Microweber through 1.1.20 allows an authenticated attacker to gain remote code execution via the backup restore feature. To exploit the vulnerability an attacker must have the credentials of an administrative user upload a maliciously constructed ZIP file with file paths including relative paths (i.e. ../../) move this file into the backup directory and execute a restore on this file.


An issue was discovered in the File Upload plugin before 4.13.0 for WordPress. A directory traversal can lead to remote code execution by uploading a crafted txt file into the lib directory because of a wfu_include_lib call.


Directory traversal vulnerability in Trend Micro Control Manager 6.0 allows remote code execution by attackers able to drop arbitrary files in a web-facing directory. Formerly ZDI-CAN-4684.


An issue was discovered on Alcatel-Lucent OmniVista 4760 devices. A remote unauthenticated attacker can chain a directory traversal (which helps to bypass authentication) with an insecure file upload to achieve Remote Code Execution as SYSTEM. The directory traversal is in the __construct() whereas the insecure file upload is in SetSkinImages().

remote code execution
directory traversal
bypass authentication


JFrog Artifactory before 7.36.1 and 6.23.41 is vulnerable to Insecure Deserialization of untrusted data which can lead to DoS Privilege Escalation and Remote Code Execution when a specially crafted request is sent by a low privileged authenticated user due to insufficient validation of a user-provided serialized object.


The Skyoftech So Listing Tabs module 2.2.0 for OpenCart allows a remote attacker to inject a serialized PHP object via the setting parameter potentially resulting in the ability to write to files on the server cause DoS and achieve remote code execution because of deserialization of untrusted data.


An issue was discovered in libX11 through 1.6.5. The function XListExtensions in ListExt.c interprets a variable as signed instead of unsigned resulting in an out-of-bounds write (of up to 128 bytes) leading to DoS or remote code execution.


In some circumstances the Traffic Management Microkernel (TMM) does not properly handle certain malformed Websockets requests/responses which allows remote attackers to cause a denial-of-service (DoS) or possible remote code execution on the F5 BIG-IP system running versions 13.0.0 - 13.1.0.3 or 12.1.0 - 12.1.3.1.


An elevation of privilege vulnerability in the NVIDIA Libnvparser component due to a memcpy into a fixed sized buffer with a user-controlled size could lead to a memory corruption and possible remote code execution. This issue is rated as High. Product: Android. Version: N/A. Android ID: A-33968204. References: N-CVE-2017-0340.

remote code execution
elevated privilege vulnerability
memory corruption


The internal feed reader APIs that crossed the sandbox barrier allowed for a sandbox escape and escalation of privilege if combined with another vulnerability that resulted in remote code execution inside the sandboxed process. This vulnerability affects Firefox ESR < 52.1 and Firefox < 53.

remote code execution
escalated privilege


In CollectValuesOrEntriesImpl of elements.cc there is possible remote code execution due to type confusion. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9.0 Android ID: A-111274046


DLL injection vulnerability in the installation executables (Autorun.exe and Setup.exe) for Intel's wireless drivers and related software in Intel Dual Band Wireless-AC Tri-Band Wireless-AC and Wireless-AC family of products allows a local attacker to cause escalation of privilege via remote code execution.


An issue was discovered on Western Digital My Cloud NAS devices before 5.04.114. They allow remote code execution with resultant escalation of privileges.


A CWE-284: Improper Access Control vulnerability exists in all versions of the Modicon M580 Modicon M340 Modicon Quantum and Modicon Premium which could cause a remote code execution by overwriting configuration settings of the controller over Modbus.

remote code execution
improper access control


Improper Access Control Tampering Vulnerability using ImportAlert function which can lead to a Remote Code Execution (RCE) from the Alerts Settings page.


ManageEngine Log360 Builds < 5235 are affected by an improper access control vulnerability allowing database configuration overwrite. An unauthenticated remote attacker can send a specially crafted message to Log360 to change its backend database to an attacker-controlled database and to force Log360 to restart. An attacker can leverage this vulnerability to achieve remote code execution by replacing files executed by Log360 on startup.


Improper Access Control to Remote Code Execution in GitHub repository webmin/webmin prior to 1.990.


Improper access controls on several Android components in the Lenovo Service Framework application can be exploited to enable remote code execution.


A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0889 CVE-2019-0891 CVE-2019-0893 CVE-2019-0894 CVE-2019-0895 CVE-2019-0896 CVE-2019-0897 CVE-2019-0898 CVE-2019-0899 CVE-2019-0900 CVE-2019-0901 CVE-2019-0902.

remote code execution
improper memory object handle


A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0846 CVE-2019-0847 CVE-2019-0851 CVE-2019-0877.


A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0889 CVE-2019-0890 CVE-2019-0891 CVE-2019-0893 CVE-2019-0894 CVE-2019-0895 CVE-2019-0896 CVE-2019-0897 CVE-2019-0898 CVE-2019-0899 CVE-2019-0900 CVE-2019-0902.


A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory aka 'Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0671 CVE-2019-0672 CVE-2019-0674 CVE-2019-0675.


A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0889 CVE-2019-0890 CVE-2019-0891 CVE-2019-0893 CVE-2019-0894 CVE-2019-0895 CVE-2019-0896 CVE-2019-0897 CVE-2019-0899 CVE-2019-0900 CVE-2019-0901 CVE-2019-0902.


A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory aka \Jet Database Engine Remote Code Execution Vulnerability.\ This affects Windows 7 Windows Server 2012 R2 Windows RT 8.1 Windows Server 2008 Windows Server 2019 Windows Server 2012 Windows 8.1 Windows Server 2016 Windows Server 2008 R2 Windows 10 Windows 10 Servers. This CVE ID is unique from CVE-2019-0538 CVE-2019-0575 CVE-2019-0576 CVE-2019-0577 CVE-2019-0578 CVE-2019-0579 CVE-2019-0581 CVE-2019-0582 CVE-2019-0583 CVE-2019-0584.


A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory aka 'Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability'.


A remote code execution vulnerability exists when the Microsoft Office Access Connectivity Engine improperly handles objects in memory aka 'Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0945 CVE-2019-0947.


A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0595 CVE-2019-0596 CVE-2019-0597 CVE-2019-0599 CVE-2019-0625.


A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory aka \Jet Database Engine Remote Code Execution Vulnerability.\ This affects Windows 7 Windows Server 2012 R2 Windows RT 8.1 Windows Server 2008 Windows Server 2019 Windows Server 2012 Windows 8.1 Windows Server 2016 Windows Server 2008 R2 Windows 10 Windows 10 Servers. This CVE ID is unique from CVE-2019-0538 CVE-2019-0575 CVE-2019-0576 CVE-2019-0577 CVE-2019-0578 CVE-2019-0579 CVE-2019-0580 CVE-2019-0581 CVE-2019-0582 CVE-2019-0583.


A remote code execution vulnerability exists when OLE automation improperly handles objects in memory aka 'OLE Automation Remote Code Execution Vulnerability'.


A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory aka \Jet Database Engine Remote Code Execution Vulnerability.\ This affects Windows 7 Windows Server 2012 R2 Windows RT 8.1 Windows Server 2008 Windows Server 2019 Windows Server 2012 Windows 8.1 Windows Server 2016 Windows Server 2008 R2 Windows 10 Windows 10 Servers. This CVE ID is unique from CVE-2019-0538 CVE-2019-0576 CVE-2019-0577 CVE-2019-0578 CVE-2019-0579 CVE-2019-0580 CVE-2019-0581 CVE-2019-0582 CVE-2019-0583 CVE-2019-0584.


A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0904 CVE-2019-0905 CVE-2019-0906 CVE-2019-0907 CVE-2019-0908 CVE-2019-0974.


Microsoft Windows PDF Library in Windows Server 2008 R2 SP1 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 Windows 10 Gold 1511 1607 1703 and Windows Server 2016 allows a remote code execution vulnerability when it improperly handles objects in memory aka \Windows PDF Remote Code Execution Vulnerability\.


Windows Search in Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 Windows 10 Gold 1511 1607 and 1703 and Windows Server 2016 allows a remote code execution vulnerability when it improperly handles objects in memory aka \Windows Search Remote Code Execution Vulnerability\.


A remote code execution vulnerability exists when Windows improperly handles objects in memory aka \Windows Remote Code Execution Vulnerability.\ This affects Windows Server 2012 R2 Windows RT 8.1 Windows Server 2012 Windows Server 2016 Windows 8.1 Windows 10 Windows 10 Servers. This CVE ID is unique from CVE-2018-8213.


A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0889 CVE-2020-0953 CVE-2020-0959 CVE-2020-0960 CVE-2020-0988 CVE-2020-0992 CVE-2020-0995 CVE-2020-0999 CVE-2020-1008.


A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0889 CVE-2020-0953 CVE-2020-0959 CVE-2020-0960 CVE-2020-0992 CVE-2020-0994 CVE-2020-0995 CVE-2020-0999 CVE-2020-1008.


A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0889 CVE-2020-0953 CVE-2020-0960 CVE-2020-0988 CVE-2020-0992 CVE-2020-0994 CVE-2020-0995 CVE-2020-0999 CVE-2020-1008.


A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0889 CVE-2020-0953 CVE-2020-0959 CVE-2020-0960 CVE-2020-0988 CVE-2020-0992 CVE-2020-0994 CVE-2020-0995 CVE-2020-1008.


A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0889 CVE-2020-0953 CVE-2020-0959 CVE-2020-0960 CVE-2020-0988 CVE-2020-0992 CVE-2020-0994 CVE-2020-0999 CVE-2020-1008.


A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0889 CVE-2020-0953 CVE-2020-0959 CVE-2020-0988 CVE-2020-0992 CVE-2020-0994 CVE-2020-0995 CVE-2020-0999 CVE-2020-1008.


A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0953 CVE-2020-0959 CVE-2020-0960 CVE-2020-0988 CVE-2020-0992 CVE-2020-0994 CVE-2020-0995 CVE-2020-0999 CVE-2020-1008.


A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0889 CVE-2020-0959 CVE-2020-0960 CVE-2020-0988 CVE-2020-0992 CVE-2020-0994 CVE-2020-0995 CVE-2020-0999 CVE-2020-1008.


A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0889 CVE-2020-0953 CVE-2020-0959 CVE-2020-0960 CVE-2020-0988 CVE-2020-0994 CVE-2020-0995 CVE-2020-0999 CVE-2020-1008.


A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0889 CVE-2020-0953 CVE-2020-0959 CVE-2020-0960 CVE-2020-0988 CVE-2020-0992 CVE-2020-0994 CVE-2020-0995 CVE-2020-0999.


LedgerSMB does not check the origin of HTML fragments merged into the browser's DOM. By sending a specially crafted URL to an authenticated user this flaw can be abused for remote code execution and information disclosure.

remote code execution
information disclosure


An issue was discovered in Squid 2.x 3.x and 4.x through 4.8. Due to incorrect data management it is vulnerable to information disclosure when processing HTTP Digest Authentication. Nonce tokens contain the raw byte value of a pointer that sits within heap memory allocation. This information reduces ASLR protections and may aid attackers isolating memory areas to target for remote code execution attacks.


In Delta Industrial Automation DOPSoft Version 4.00.06.15 and prior processing a specially crafted project file may trigger a use-after-free vulnerability which may allow information disclosure remote code execution or crash of the application.


An arbitrary file copy vulnerability in mod_copy in ProFTPD up to 1.3.5b allows for remote code execution and information disclosure without authentication a related issue to CVE-2015-3306.


An issue was discovered in the Viral Quiz Maker - OnionBuzz plugin before 1.2.7 for WordPress. One could exploit the id parameter in the set_count ajax nopriv handler due to there being no sanitization prior to use in a SQL query in saveQuestionVote. This allows an unauthenticated/unprivileged user to perform a SQL injection attack capable of remote code execution and information disclosure.


An issue was discovered in the Viral Quiz Maker - OnionBuzz plugin before 1.2.2 for WordPress. One could exploit the points parameter in the ob_get_results ajax nopriv handler due to there being no sanitization prior to use in a SQL query in getResultByPointsTrivia. This allows an unauthenticated/unprivileged user to perform a SQL injection attack capable of remote code execution and information disclosure.


LedgerSMB does not sufficiently HTML-encode error messages sent to the browser. By sending a specially crafted URL to an authenticated user this flaw can be abused for remote code execution and information disclosure.


Dell OpenManage Enterprise versions 3.4 through 3.6.1 and Dell OpenManage Enterprise Modular versions 1.20.00 through 1.30.00 contain a remote code execution vulnerability. A malicious attacker with access to the immediate subnet may potentially exploit this vulnerability leading to information disclosure and a possible elevation of privileges.


A file inclusion vulnerability exists in the confd.exe module in Honeywell Experion PKS R40x before R400.6 R41x before R410.6 and R43x before R430.2 which could lead to accepting an arbitrary file into the function and potential information disclosure or remote code execution. Honeywell strongly encourages and recommends all customers running unsupported versions of EKPS prior to R400 to upgrade to a supported version.


A Python format string issue leading to information disclosure and potentially remote code execution in ConsoleMe for all versions prior to 1.2.2


Eleix Openhacker version 0.1.47 is vulnerable to an SQL injection in the account registration and login component resulting in information disclosure and remote code execution


October

CMS

version

prior

to

Build

contains

a

Local

File

Inclusion

vulnerability

in

(makeFileContents

function)

that

can

result

in

Sensitive

information

disclosure

and

remote

code

execution.

This

attack

appear

to

be

exploitable

remotely

if

the

/backend

path

is

accessible.

This

vulnerability

appears

to

have

been

fixed

in

Build


Apache NiFi External XML Entity issue in SplitXML processor. Malicious XML content could cause information disclosure or remote code execution. The fix to disable external general entity parsing and disallow doctype declarations was applied on the Apache NiFi 1.6.0 release. Users running a prior 1.x release should upgrade to the appropriate release.


Triplea version <= 1.9.0.0.10291 contains a XML External Entity (XXE) vulnerability in Importing game data that can result in Possible information disclosure server-side request forgery or remote code execution. This attack appear to be exploitable via Specially crafted game data file (XML).


netbeans-mmd-plugin version <= 1.4.3 contains a XML External Entity (XXE) vulnerability in MMD file import that can result in Possible information disclosure server-side request forgery or remote code execution. This attack appear to be exploitable via Specially crafted MMD file.


openpsa contains a PHP Object Injection vulnerability in Form data passed as GET request variables that can result in Possible information disclosure and remote code execution. This attack appear to be exploitable via Specially crafted GET request variable containing serialised PHP object. This vulnerability appears to have been fixed in after commit 097eae0.


Froxlor version <= 0.9.39.5 contains a PHP Object Injection vulnerability in Domain name form that can result in Possible information disclosure and remote code execution. This attack appear to be exploitable via Passing malicious PHP objection in $_POST'ssl_ipandport'. This vulnerability appears to have been fixed in after commit c1e62e6.


An information disclosure and remote code execution vulnerability in the slinger web server of the BlackBerry QNX Software Development Platform versions 6.4.0 to 6.6.0 could allow an attacker to potentially read arbitrary files and run arbitrary executables in the context of the web server.


Systech Corporation NDS-5000 Terminal Server NDS/5008 (8 Port RJ45) firmware Version 02D.30. Successful exploitation of this vulnerability could allow information disclosure limit system availability and may allow remote code execution.


SQL Injection issues in various ASPX pages of ResourceXpress Meeting Monitor 4.9 could lead to remote code execution and information disclosure.


A potential remote code execution and information disclosure vulnerability exists in Micro Focus Operations Bridge containerized suite versions 2017.11 2018.02 2018.05 2018.08. This vulnerability could allow for information disclosure.


The variable import endpoint was not protected by authentication in Airflow >=2.0.0 <2.1.3. This allowed unauthenticated users to hit that endpoint to add/modify Airflow variables used in DAGs potentially resulting in a denial of service information disclosure or remote code execution. This issue affects Apache Airflow >=2.0.0 <2.1.3.

remote code execution
information disclosure
denial of service