A remote code execution vulnerability exists in the way that Microsoft Graphics Components handle objects in memory aka \Microsoft Graphics Components Remote Code Execution Vulnerability.\ This affects Windows 7 Windows Server 2012 R2 Windows RT 8.1 Windows Server 2008 Windows Server 2012 Windows 8.1 Windows Server 2016 Windows Server 2008 R2 Windows 10.


A remote code execution vulnerability exists when Team Foundation Server (TFS) does not enable basic authorization on the communication between the TFS and Search services aka \Team Foundation Server Remote Code Execution Vulnerability.\ This affects Team.


A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory aka \Microsoft Excel Remote Code Execution Vulnerability.\ This affects Office 365 ProPlus Microsoft Office Microsoft Excel. This CVE ID is unique from CVE-2018-8636.


A remote code execution vulnerability exists in Microsoft Word software when the software fails to properly handle objects in Protected View aka \Microsoft Word Remote Code Execution Vulnerability.\ This affects Microsoft SharePoint Server Office 365 ProPlus Microsoft Office Microsoft Word.


A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest operating system aka \Windows Hyper-V Remote Code Execution Vulnerability.\ This affects Windows 7 Windows Server 2012 R2 Windows RT 8.1 Windows Server 2008 Windows Server 2019 Windows Server 2012 Windows 8.1 Windows Server 2016 Windows Server 2008 R2 Windows 10 Windows 10 Servers. This CVE ID is unique from CVE-2018-8490.


Double free vulnerabilities in Advantech WebAccess HMI Designer 2.1.7.32 and prior caused by processing specially crafted .pm3 files may allow remote code execution.


A remote code execution vulnerability exists when the Windows Host Compute Service Shim (hcsshim) library fails to properly validate input while importing a container image aka \Windows Host Compute Service Shim Remote Code Execution Vulnerability.\ This affects Windows Host Compute.


Apache CouchDB administrative users can configure the database server via HTTP(S). Due to insufficient validation of administrator-supplied configuration settings via the HTTP API it is possible for a CouchDB administrator user to escalate their privileges to that of the operating system's user that CouchDB runs under by bypassing the blacklist of configuration settings that are not allowed to be modified via the HTTP API. This privilege escalation effectively allows an existing CouchDB admin user to gain arbitrary remote code execution bypassing already disclosed CVE-2017-12636. Mitigation: All users should upgrade to CouchDB releases 1.7.2 or 2.1.2.


A remote code execution vulnerability exists when Skype for Business and Microsoft Lync clients fail to properly sanitize specially crafted content aka \Remote Code Execution Vulnerability in Skype For Business and Lync.\ This affects Skype Microsoft Lync.


A remote code execution vulnerability exists in Microsoft Word software when it fails to properly handle objects in memory aka \Microsoft Word Remote Code Execution Vulnerability.\ This affects Microsoft SharePoint Server Microsoft Office. This CVE ID is unique from CVE-2018-8573.


A remote code execution vulnerability exists in Microsoft Outlook software when it fails to properly handle objects in memory aka \Microsoft Outlook Remote Code Execution Vulnerability.\ This affects Office 365 ProPlus Microsoft Office Microsoft Outlook.


A remote code execution vulnerability exists in Microsoft Windows that could allow remote code execution if a .LNK file is processed aka \LNK Remote Code Execution Vulnerability.\ This affects Windows Server 2008 Windows 7 Windows Server 2008 R2. This CVE ID is unique from CVE-2018-8345.


A remote code execution vulnerability exists in Microsoft Outlook software when it fails to properly handle objects in memory aka \Microsoft Outlook Remote Code Execution Vulnerability.\ This affects Office 365 ProPlus Microsoft Office Microsoft Outlook. This CVE ID is unique from CVE-2018-8522 CVE-2018-8524 CVE-2018-8582.


A remote code execution vulnerability exists in the Microsoft JET Database Engine aka \Microsoft JET Database Engine Remote Code Execution Vulnerability.\ This affects Windows 7 Windows Server 2012 R2 Windows RT 8.1 Windows Server 2008 Windows Server 2019 Windows Server 2012 Windows 8.1 Windows Server 2016 Windows Server 2008 R2 Windows 10 Windows 10 Servers.


joyplus-cms 1.6.0 allows Remote Code Execution because of an Arbitrary File Upload issue in manager/editor/upload.php related to manager/admin_vod.php?action=add.


A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in Protected View aka \Microsoft Excel Remote Code Execution Vulnerability.\ This affects Office 365 ProPlus Microsoft Office Microsoft Excel.


A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory aka \Microsoft Excel Remote Code Execution Vulnerability.\ This affects Microsoft Excel. This CVE ID is unique from CVE-2018-8375.


A remote code execution vulnerability exists when PowerShell improperly handles specially crafted files aka \Microsoft PowerShell Remote Code Execution Vulnerability.\ This affects Windows RT 8.1 PowerShell Core 6.0 Microsoft.PowerShell.Archive 1.2.2.0 Windows Server 2016 Windows Server 2012 Windows Server 2008 R2 Windows Server 2019 Windows 7 Windows Server 2012 R2 PowerShell Core 6.1 Windows 10 Servers Windows 10 Windows 8.1.


A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts aka \Win32k Graphics Remote Code Execution Vulnerability.\ This affects Windows 7 Microsoft Office Windows Server 2012 R2 Windows RT 8.1 Windows Server 2008 Windows Server 2008 R2 Windows Server 2012 Windows Server 2016 Windows 8.1 Windows 10 Windows 10 Servers.


A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory aka \Microsoft Office Remote Code Execution Vulnerability.\ This affects Microsoft Office. This CVE ID is unique from CVE-2018-8157 CVE-2018-8161.


Processing specially crafted .pm3 files in Advantech WebAccess HMI Designer 2.1.7.32 and prior may cause the system to write outside the intended buffer area and may allow remote code execution.


A remote code execution vulnerability exists in the way that Windows Deployment Services TFTP Server handles objects in memory aka \Windows Deployment Services TFTP Server Remote Code Execution Vulnerability.\ This affects Windows Server 2012 R2 Windows Server 2008 Windows Server 2012 Windows Server 2019 Windows Server 2016 Windows Server 2008 R2 Windows 10 Servers.


A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory aka \Microsoft Office Remote Code Execution Vulnerability.\ This affects Microsoft Word Word Microsoft Office Microsoft SharePoint. This CVE ID is unique from CVE-2018-8157 CVE-2018-8158.


A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory aka \Microsoft Excel Remote Code Execution Vulnerability.\ This affects Microsoft Office Microsoft Excel. This CVE ID is unique from CVE-2018-8147 CVE-2018-8162.


A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory aka \Microsoft Excel Remote Code Execution Vulnerability.\ This affects Microsoft Excel Viewer Microsoft Office Microsoft Excel. This CVE ID is unique from CVE-2018-8379.


A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest operating system aka \Windows Hyper-V Remote Code Execution Vulnerability.\ This affects Windows Server 2012 R2 Windows RT 8.1 Windows Server 2016 Windows 8.1 Windows 10 Windows 10 Servers. This CVE ID is unique from CVE-2018-0965.


A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts aka \Microsoft Graphics Remote Code Execution Vulnerability.\ This affects Windows 7 Windows Server 2012 R2 Windows RT 8.1 Windows Server 2008 Windows Server 2012 Windows 8.1 Windows Server 2016 Windows Server 2008 R2 Windows 10 Windows 10 Servers.


A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory aka \Microsoft Excel Remote Code Execution Vulnerability.\ This affects Office 365 ProPlus Microsoft Office Microsoft Excel. This CVE ID is unique from CVE-2018-8577.


A remote code execution vulnerability exists in the way that Windows handles objects in memory aka \Windows Remote Code Execution Vulnerability.\ This affects Windows 7 Windows Server 2012 R2 Windows RT 8.1 Windows Server 2008 Windows Server 2012 Windows 8.1 Windows Server 2016 Windows Server 2008 R2 Windows 10 Windows 10 Servers.


A remote code execution vulnerability exists when Microsoft .NET Framework processes untrusted input aka \.NET Framework Remote Code Execution Vulnerability.\ This affects Microsoft .NET Framework 4.6 Microsoft .NET Framework 3.5 Microsoft .NET Framework 4.7/4.7.1/4.7.2 Microsoft .NET Framework 3.0 Microsoft .NET Framework 3.5.1 Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 Microsoft .NET Framework 4.5.2 Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.1/4.7.2 Microsoft .NET Framework 4.7.1/4.7.2 Microsoft .NET Framework 4.7.2 Microsoft .NET Framework 2.0.


A remote attacker could send a carefully crafted packet in InduSoft Web Studio v8.1 and prior versions and/or InTouch Machine Edition 2017 v8.1 and prior versions during a tag alarm or event related action such as read and write which may allow remote code execution.


A remote code execution vulnerability exists in Windows Domain Name System (DNS) DNSAPI.dll when it fails to properly handle DNS responses aka \Windows DNSAPI Remote Code Execution Vulnerability.\ This affects Windows 7 Windows Server 2012 R2 Windows RT 8.1 Windows Server 2008 Windows Server 2012 Windows 8.1 Windows Server 2016 Windows Server 2008 R2 Windows 10 Windows 10 Servers.


A remote code execution vulnerability exists in Microsoft Outlook software when it fails to properly handle objects in memory aka \Microsoft Outlook Remote Code Execution Vulnerability.\ This affects Office 365 ProPlus Microsoft Office Microsoft Outlook. This CVE ID is unique from CVE-2018-8524 CVE-2018-8576 CVE-2018-8582.


A remote code execution vulnerability exists in Windows where Microsoft text-to-speech fails to properly handle objects in the memory aka \Microsoft Text-To-Speech Remote Code Execution Vulnerability.\ This affects Windows Server 2016 Windows 10 Windows Server 2019 Windows 10 Servers.


A remote code execution vulnerability exists in Microsoft PowerPoint software when the software fails to properly handle objects in memory aka \Microsoft PowerPoint Remote Code Execution Vulnerability.\ This affects Microsoft Office Office 365 ProPlus Microsoft PowerPoint Microsoft SharePoint Microsoft PowerPoint Viewer Office Online Server Microsoft SharePoint Server.


A remote code execution vulnerability exists when the Internet Explorer VBScript execution policy does not properly restrict VBScript under specific conditions aka \Internet Explorer Remote Code Execution Vulnerability.\ This affects Internet Explorer 9 Internet Explorer 11 Internet Explorer 10.


A remote code execution vulnerability exists in Microsoft Windows that could allow remote code execution if a .LNK file is processed aka \LNK Remote Code Execution Vulnerability.\ This affects Windows 7 Windows Server 2012 R2 Windows RT 8.1 Windows Server 2008 Windows Server 2012 Windows 8.1 Windows Server 2016 Windows Server 2008 R2 Windows 10 Windows 10 Servers. This CVE ID is unique from CVE-2018-8346.


A remote code execution vulnerability exists in Microsoft Project software when it fails to properly handle objects in memory aka \Microsoft Project Remote Code Execution Vulnerability.\ This affects Microsoft Project Office 365 ProPlus Microsoft Project Server.


A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input aka \MS XML Remote Code Execution Vulnerability.\ This affects Windows 7 Windows Server 2012 R2 Windows RT 8.1 Windows Server 2008 Windows Server 2012 Windows 8.1 Windows Server 2016 Windows Server 2008 R2 Windows 10 Windows 10 Servers.


A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory aka \Windows VBScript Engine Remote Code Execution Vulnerability.\ This affects Windows 7 Windows Server 2012 R2 Windows RT 8.1 Windows Server 2008 Windows Server 2019 Windows Server 2012 Windows 8.1 Windows Server 2016 Windows Server 2008 R2 Windows 10 Windows 10 Servers.


A remote code execution vulnerability exists in \Microsoft COM for Windows\ when it fails to properly handle serialized objects aka \Microsoft COM for Windows Remote Code Execution Vulnerability.\ This affects Windows 7 Windows Server 2012 R2 Windows RT 8.1 Windows Server 2008 Windows Server 2012 Windows 8.1 Windows Server 2016 Windows Server 2008 R2 Windows 10 Windows 10 Servers.


Versions of Superset prior to 0.23 used an unsafe load method from the pickle library to deserialize data leading to possible remote code execution. Note Superset 0.23 was released prior to any Superset release under the Apache Software Foundation.


A remote code execution vulnerability exists in Microsoft Dynamics 365 (on-premises) version 8 when the server fails to properly sanitize web requests to an affected Dynamics server aka \Microsoft Dynamics 365 (on-premises) version 8 Remote Code Execution Vulnerability.\ This affects Microsoft Dynamics 365.


A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory aka \Windows VBScript Engine Remote Code Execution Vulnerability.\ This affects Windows 7 Windows Server 2012 R2 Windows RT 8.1 Windows Server 2008 Windows Server 2012 Windows 8.1 Windows Server 2016 Windows Server 2008 R2 Windows 10 Windows 10 Servers.


Secure/SAService.rem in Deltek Ajera Timesheets 9.10.16 and prior are vulnerable to remote code execution via deserialization of untrusted user input from an authenticated user. The executed code will run as the IIS Application Pool that is running the application.


i-doit open 1.11.2 allows Remote Code Execution because ZIP archives are mishandled. It has an upload feature that allows an authenticated user with the administrator role to upload arbitrary files to the main website directory. Exploitation involves uploading a \.php\ file within a \.zip\ file because a ZIP archive is accepted by /admin/?req=modules&action=add as a plugin and extracted to the main directory. In order for the \.zip\ file to be accepted it must also contain a package.json file.


In the orders section of PrestaShop before 1.7.2.5 an attack is possible after gaining access to a target store with a user role with the rights of at least a Salesman or higher privileges. The attacker can then inject arbitrary PHP objects into the process and abuse an object chain in order to gain Remote Code Execution. This occurs because protection against serialized objects looks for a 0: followed by an integer but does not consider 0:+ followed by an integer.


LibVNC

before

commit

contains

heap

out-of-bound

write

vulnerability

inside

structure

in

VNC

client

code

that

can

result

remote

code

execution


LibVNC

before

commit

contains

multiple

heap

out-of-bound

write

vulnerabilities

in

VNC

client

code

that

can

result

remote

code

execution


Terminology before 1.3.1 allows Remote Code Execution because popmedia is mishandled as demonstrated by an unsafe \cat README.md\ command when \\e}pn is used. A popmedia control sequence can allow the malicious execution of executable file formats registered in the X desktop share MIME types (/usr/share/applications). The control sequence defers unknown file types to the handle_unknown_media() function which executes xdg-open against the filename specified in the sequence. The use of xdg-open for all unknown file types allows executable file formats with a registered shared MIME type to be executed. An attacker can achieve remote code execution by introducing an executable file and a plain text file containing the control sequence through a fake software project (e.g. in Git or a tarball). When the control sequence is rendered (such as with cat) the executable file will be run.


An issue was discovered in Recon-ng before 4.9.5. Lack of validation in the modules/reporting/csv.py file allows CSV injection. More specifically when a Twitter user possesses an Excel macro for a username it will not be properly sanitized when exported to a CSV file. This can result in remote code execution for the attacker.


A Remote Code Execution vulnerability in lmgrd and vendor daemon components of FlexNet Publisher version 11.16.1.0 and earlier could allow a remote attacker to corrupt the memory by allocating / deallocating memory loading lmgrd or the vendor daemon and causing the heartbeat between lmgrd and the vendor daemon to stop. This would force the vendor daemon to shut down. No exploit of this vulnerability has been demonstrated.


** DISPUTED ** An issue was discovered on AXIS M1033-W (IP camera) Firmware version 5.40.5.1 devices. The upload web page doesn't verify the file type and an attacker can upload a webshell by making a fileUpload.shtml request for a custom .shtml file which is interpreted by the Apache HTTP Server mod_include module with \<!--#exec cmd=\ support. The file needs to include a specific string to meet the internal system architecture. After the webshell upload an attacker can use the webshell to perform remote code execution such as running a system command (ls ping cat /etc/passwd etc.). NOTE: the vendor reportedly indicates that this is an intended feature or functionality.


In

impd_parametric_drc_parse_gain_set_params

of

there

is

a

possible

out

of

bounds

write

due

to

missing

bounds

check.

This

could

lead

to

remote

code

execution

with

no

additional

execution

privileges

needed.

User

interaction

is

needed

for

exploitation.

Product:

Android.

Versions:

Android

ID:


Monstra CMS 3.0.4 allows remote code execution via an upload_file request for a .zip file which is automatically extracted and may contain .php files.


In impd_parse_filt_block of impd_drc_dynamic_payload.c there is a possible out of bounds write due to missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-116467350.


In avrc_proc_vendor_command of avrc_api.cc there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-6.0 Android-6.0.1 Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android ID: A-79541338.


In ixheaacd_mps_getstridemap of ixheaacd_mps_parse.c there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-112857941


In ixheaacd_tns_ar_filter_dec of ixheaacd_aac_tns.c there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-112609715


In ixheaacd_over_lap_add1_armv8 of ixheaacd_overlap_add1.s there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-112551721


In bnep_data_ind of bnep_main.c there is a possible remote code execution due to a double free. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-6.0 Android-6.0.1 Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android ID: A-74950468.


In sdp_copy_raw_data of sdp_discovery.cc there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote code execution over bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9.0 Android ID: A-110216176


In ixheaacd_reset_acelp_data_fix of ixheaacd_lpc.c there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-112858010


In AudioSpecificConfig_Parse of tpdec_asc.cpp there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-112661641


In ixheaacd_individual_ch_stream of ixheaacd_channel.c there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-112551874


In MasteringMetadata::Parse of mkvparser.cc there is a possible double free due to an insecure default value. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-116615297.


** DISPUTED ** An issue was discovered on AXIS P1354 (IP camera) Firmware version 5.90.1.1 devices. The upload web page doesn't verify the file type and an attacker can upload a webshell by making a fileUpload.shtml request for a custom .shtml file which is interpreted by the Apache HTTP Server mod_include module with \<!--#exec cmd=\ support. The file needs to include a specific string to meet the internal system architecture. After the webshell upload an attacker can use the webshell to perform remote code execution such as running a system command (ls ping cat /etc/passwd etc.). NOTE: the vendor reportedly indicates that this is an intended feature or functionality.


In impd_parse_parametric_drc_instructions of impd_drc_static_payload.c there is a possible out of bounds write due to missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-116715245.


In bta_ag_parse_cmer of bta_ag_cmd.cc in Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 and Android-9 there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote code execution in the bluetooth server with no additional execution privileges needed. User interaction is not needed for exploitation. Android ID: A-112860487.


In parseMPEGCCData of NuPlayer2CCDecoder.cpp there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote code execution in an unprivileged process with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-111874331


In impd_drc_parse_coeff of impd_drc_static_payload.c there is a possible out of bounds write due to missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-116224432.


In CAacDecoder_DecodeFrame of aacdecode.cpp there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote code execution in the media server with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-112891564


In ixheaacd_dec_data_init of ixheaacd_create.c there is a possible out of write read due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-112766520


In lppTransposer of lpp_tran.cpp there is a possible out of bounds write due to missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-112160868.


In

of

there

is

a

possible

out

of

bounds

write

due

to

missing

bounds

check.

This

could

lead

to

remote

code

execution

with

no

additional

execution

privileges

needed.

User

interaction

is

needed

for

exploitation.

Product:

Android

Versions:

Android

ID:


In CAacDecoder_Init of aacdecoder.cpp there is a possible out-of-bound write due to a missing bounds check. This could lead to remote code execution in the media server with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-112891548.


In vorbis_book_decodev_set of codebook.c there is a possible out of bounds write due to missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-112159345


In impd_parse_split_drc_characteristic of impd_drc_static_payload.c there is a possible out of bounds write due to missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-116619337.


In impd_parse_drc_ext_v1 of impd_drc_dynamic_payload.c there is a possible out-of-bound write due to missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-115375616.


In impd_parse_dwnmix_instructions of impd_drc_static_payload.c there is a possible out of bounds write due to missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-116619387.


In impd_init_drc_decode_post_config of impd_drc_gain_decoder.c there is a possible out-of-bound write due to incorrect bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-113885537.


In impd_parse_loud_eq_instructions of impd_drc_dynamic_payload.c there is a possible out-of-bound write due to missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-116020594.


In bta_dm_sdp_result of bta_dm_act.cc there is a possible out of bounds stack write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-6.0 Android-6.0.1 Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android ID: A-74016921.


In numerous functions of libFDK there are possible out of bounds writes due to incorrect bounds checks. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-112662184


In ixheaacd_extract_frame_info_ld of ixheaacd_env_extr.c there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-112765917


In ixheaacd_real_synth_fft_p3 of ixheaacd_esbr_fft.c there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-9.0 Android ID: A-110769924


In CAacDecoder_Init of aacdecoder.cpp there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-112660981.


Gogs 0.11.66 allows remote code execution because it does not properly validate session IDs as demonstrated by a \..\ session-file forgery in the file session provider in file.go. This is related to session ID handling in the go-macaron/session code for Macaron.


VT-Designer Version 2.1.7.31 is vulnerable by the program populating objects with user supplied input via a file without first checking for validity allowing attacker supplied input to be written to known memory locations. This may cause the program to crash or allow remote code execution.


VT-Designer Version 2.1.7.31 is vulnerable by the program reading the contents of a file (which is already in memory) into another heap-based buffer which may cause the program to crash or allow remote code execution.


The Tightrope Media Carousel digital signage product 7.0.4.104 contains an arbitrary file upload vulnerability in the Manage Bulletins/Upload feature which can be leveraged to gain remote code execution. An authenticated attacker can upload a crafted ZIP file (based on an exported backup of existing \Bulletins\) containing a malicious file. When uploaded the system only checks for the presence of the needed files within the ZIP and as long as the malicious file is named properly will extract all contained files to a new directory on the system named with a random GUID. The attacker can determine this GUID by previewing an image from the uploaded Bulletin within the web UI. Once the GUID is determined the attacker can navigate to the malicious file and execute it. In testing an ASPX web shell was uploaded allowing for remote-code execution in the context of a restricted IIS user.


An

issue

was

discovered

in

Pippo

The

function

SerializationSessionDataTranscoder.decode()

calls

ObjectInputStream.readObject()

to

deserialize

a

SessionData

object

without

checking

the

object

types.

An

attacker

can

create

a

malicious

object

encode

it

and

place

it

in

the

field

of

a

cookie.

Sending

this

cookie

may

lead

to

remote

code

execution.


A hidden backdoor on PATLITE NH-FB Series devices with firmware version 1.45 or earlier NH-FV Series devices with firmware version 1.10 or earlier and NBM Series devices with firmware version 1.09 or earlier allow attackers to enable an SSH daemon via the \kankichi\ or \kamiyo4\ password to the _secret1.htm URI. Subsequently the default password of root for the root account allows an attacker to conduct remote code execution and as a result take over the system.


Vanilla 2.6.x before 2.6.4 allows remote code execution.


Deltek Vision 7.x before 7.6 permits the execution of any attacker supplied SQL statement through a custom RPC over HTTP protocol. The Vision system relies on the client binary to enforce security rules and integrity of SQL statements and other content being sent to the server. Client HTTP calls can be manipulated by one of several means to execute arbitrary SQL statements (similar to SQLi) or possibly have unspecified other impact via this custom protocol. To perform these attacks an authenticated session is first required. In some cases client calls are obfuscated by encryption which can be bypassed due to hard-coded keys and an insecure key rotation protocol. Impacts may include remote code execution in some deployments; however the vendor states that this cannot occur when the installation documentation is heeded.


Gitea before 1.5.4 allows remote code execution because it does not properly validate session IDs. This is related to session ID handling in the go-macaron/session code for Macaron.


An issue was discovered on Tenda AC9 V15.03.05.19(6318)_CN AC15 V15.03.05.19_CN and AC18 V15.03.05.19(6318)_CN devices. They allow remote code execution via shell metacharacters in the usbName field to the __fastcall function with a POST request.


Advanced HRM 1.6 allows Remote Code Execution via PHP code in a .php file to the user/update-user-avatar URI which can be accessed through an \Update Profile\ \Change Picture\ (aka user/edit-profile) action.


Pippo through 1.11.0 allows remote code execution via a command to java.lang.ProcessBuilder because the XstreamEngine component does not use XStream's available protection mechanisms to restrict unmarshalling.


An issue was discovered in the wiki API in GitLab Community and Enterprise Edition before 11.2.7 11.3.x before 11.3.8 and 11.4.x before 11.4.3. It allows for remote code execution.


** DISPUTED *** Xen Mobile through 10.8.0 includes a service listening on port 5001 within its firewall that accepts unauthenticated input. If this service is supplied with raw serialised Java objects it deserialises them back into Java objects in memory giving rise to a remote code execution vulnerability. NOTE: the vendor disputes that this is a vulnerability stating it is \already mitigated by the internal firewall that limits access to configuration services to localhost.\


Remote Code Execution in Moxa ThingsPro IIoT Gateway and Device Management Software Solutions version 2.1.


An exploitable remote code execution vulnerability exists in the ping and tracert functionality of the TP-Link TL-R600VPN HWv3 FRNv1.3.0 and HWv2 FRNv1.2.3 http server. A specially crafted IP address can cause a stack overflow resulting in remote code execution. An attacker can send a single authenticated HTTP request to trigger this vulnerability.


In Antenna House Office Server Document Converter version V6.1 Pro MR2 for Linux64 (6 1 2018 0312) a crafted Microsoft Word (DOC) document can lead to an out-of-bounds write resulting in remote code execution.


An exploitable out-of-bounds write exists in the Microsoft Word document conversion functionality of the Antenna House Office Server Document Converter version V6.1 Pro MR2 for Linux64 (6 1 2018 0312). A crafted Microsoft Word (DOC) document can lead to an out-of-bounds write resulting in remote code execution. This vulnerability occurs in the `vbputanld` method.


An exploitable heap overflow vulnerability exists in the WkbProgramLow function of WibuKey Network server management version 6.40.2402.500. A specially crafted TCP packet can cause a heap overflow potentially leading to remote code execution. An attacker can send a malformed TCP packet to trigger this vulnerability.


In Antenna House Office Server Document Converter version V6.1 Pro MR2 for Linux64 (6 1 2018 0312) a crafted Microsoft Word (DOC) document can lead to an out-of-bounds write resulting in remote code execution. This vulnerability occurs in the `putShapeProperty` method.


An exploitable heap corruption exists in the PowerPoint document conversion functionality of the Antenna House Office Server Document Converter version V6.1 Pro MR2 for Linux64 (6 1 2018 0312). A crafted PowerPoint (PPT) document can lead to heap corruption resulting in remote code execution.


In Antenna House Office Server Document Converter version V6.1 Pro MR2 for Linux64 (6 1 2018 0312) a crafted Microsoft Word (DOC) document can lead to an out-of-bounds write resulting in remote code execution. This vulnerability occurs in the `vbgetfp` method.


joyplus-cms 1.6.0 allows Remote Code Execution because of an Arbitrary SQL command execution issue in manager/index.php involving use of a \/!select/\ substring in place of a select substring.


An issue was discovered in Linaro LAVA before 2018.5.post1. Because of use of yaml.load() instead of yaml.safe_load() when parsing user data remote code execution can occur.


in

LiteCart

before

allows

remote

authenticated

attackers

to

upload

a

malicious

file

(resulting

in

remote

code

execution)

by

using

the

text/xml

or

application/xml

Content-Type

in

a

public_html/admin/?app=vqmods&doc=vqmods

request.


A SQL injection vulnerability in the web administration and quarantine components of Micro Focus Secure Messaging Gateway allows an unauthenticated remote attacker to execute arbitrary SQL statements against the database. This can be exploited to create an administrative account and used in conjunction with CVE-2018-12465 to achieve unauthenticated remote code execution. Affects Micro Focus Secure Messaging Gateway versions prior to 471. It does not affect previous versions of the product that use the GWAVA product name (i.e. GWAVA 6.5).


A vulnerability in the administration console of Micro Focus GroupWise prior to version 18.0.2 may allow a remote attacker authenticated as an administrator to upload files to an arbitrary path on the server. In certain circumstances this could result in remote code execution.


A vulnerability in register allocation in JavaScript can lead to type confusion allowing for an arbitrary read and write. This leads to remote code execution inside the sandboxed content process when triggered. This vulnerability affects Firefox ESR < 60.2.2 and Firefox < 62.0.3.


Arbitrary File Upload and Remote Code Execution exist in PHP Scripts Mall Schools Alert Management Script via $_FILE in /webmasterst/general.php as demonstrated by a .php file with the image/jpeg content type.


The WP Live Chat Support Pro plugin before 8.0.07 for WordPress is vulnerable to unauthenticated Remote Code Execution due to client-side validation of allowed file types as demonstrated by a v1/remote_upload request with a .php filename and the image/jpeg content type.


The websites that were built from Zeta Producer Desktop CMS before 14.2.1 are vulnerable to unauthenticated remote code execution due to a default component that permits arbitrary upload of PHP files because the formmailer widget blocks .php files but not .php5 or .phtml files. This is related to /assets/php/formmailer/SendEmail.php and /assets/php/formmailer/functions.php.


Druide Antidote through 9.5.1 on Windows and Linux allows remote code execution through the update mechanism by leveraging use of HTTP to download installation packages.


Windows Shell in Microsoft Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8.1 and RT 8.1 Windows Server 2012 and R2 Windows 10 Gold 1511 1607 1703 Windows Server 2016 and Windows Server version 1709 allows a remote code execution vulnerability due to how file copy destinations are validated aka \Windows Shell Remote Code Execution Vulnerability\.


Microsoft Outlook 2007 Microsoft Outlook 2010 and Microsoft Outlook 2013 allow a remote code execution vulnerability due to the way email messages are parsed aka \Microsoft Outlook Remote Code Execution Vulnerability\. This CVE is unique from CVE-2018-0791.


StructuredQuery in Windows 7 SP1 Windows 8.1 and RT 8.1 Windows Server 2008 SP2 and R2 SP1 Windows Server 2012 and R2 Windows 10 Gold 1511 1607 1703 and 1709 Windows Server 2016 and Windows Server version 1709 allows a remote code execution vulnerability due to how objects are handled in memory aka \StructuredQuery Remote Code Execution Vulnerability\.


A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest operating system aka \Hyper-V Remote Code Execution Vulnerability.\ This affects Windows 7 Windows Server 2012 R2 Windows RT 8.1 Windows Server 2008 Windows Server 2012 Windows 8.1 Windows Server 2016 Windows Server 2008 R2 Windows 10 Windows 10 Servers.


Equation Editor in Microsoft Office 2003 Microsoft Office 2007 Microsoft Office 2010 Microsoft Office 2013 and Microsoft Office 2016 allows a remote code execution vulnerability due to the way objects are handled in memory aka \Microsoft Word Remote Code Execution Vulnerability\. This CVE is unique from CVE-2018-0805 CVE-2018-0806 and CVE-2018-0807.


Equation Editor in Microsoft Office 2007 Microsoft Office 2010 Microsoft Office 2013 and Microsoft Office 2016 allows a remote code execution vulnerability due to the way objects are handled in memory aka \Microsoft Office Remote Code Execution Vulnerability\.


A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest operating system aka \Windows Hyper-V Remote Code Execution Vulnerability.\ This affects Windows Server 2016 Windows 10 Windows 10 Servers. This CVE ID is unique from CVE-2018-8439.


Receipt of a specially crafted Connectionless Network Protocol (CLNP) datagram destined to an interface of a Junos OS device may result in a kernel crash or lead to remote code execution. Devices are only vulnerable to the specially crafted CLNP datagram if 'clns-routing' or ES-IS is explicitly configured. Devices with without CLNS enabled are not vulnerable to this issue. Devices with IS-IS configured on the interface are not vulnerable to this issue unless CLNS routing is also enabled. This issue only affects devices running Junos OS 15.1. Affected releases are Juniper Networks Junos OS: 15.1 versions prior to 15.1F5-S3 15.1F6-S8 15.1F7 15.1R5; 15.1X49 versions prior to 15.1X49-D60; 15.1X53 versions prior to 15.1X53-D66 15.1X53-D233 15.1X53-D471. Earlier releases are unaffected by this vulnerability and the issue has been resolved in Junos OS 16.1R1 and all subsequent releases.


Equation Editor in Microsoft Office 2003 Microsoft Office 2007 Microsoft Office 2010 Microsoft Office 2013 and Microsoft Office 2016 allows a remote code execution vulnerability due to the way objects are handled in memory aka \Microsoft Word Remote Code Execution Vulnerability\. This CVE is unique from CVE-2018-0804 CVE-2018-0806 and CVE-2018-0807


Microsoft Access 2010 SP2 Microsoft Access 2013 SP1 Microsoft Access 2016 and Microsoft Office 2016 Click-to-Run allow a remote code execution vulnerability due to how objects are handled in memory aka \Microsoft Access Remote Code Execution Vulnerability\.


Microsoft Word 2016 in Microsoft Office 2016 allows a remote code execution vulnerability due to the way objects are handled in memory aka \Microsoft Word Remote Code Execution Vulnerability\. This CVE is unique from CVE-2018-0794.


A vulnerability in the folder permissions of Cisco Webex Meetings client for Windows could allow an authenticated local attacker to modify locally stored files and execute code on a targeted device with the privilege level of the user. The vulnerability is due to folder permissions that grant a user the permission to read write and execute files in the Webex folders. An attacker could exploit this vulnerability to write malicious files to the Webex client directory affecting all other users of the targeted device. A successful exploit could allow a user to execute commands with elevated privileges. Attacks on single-user systems are less likely to occur as the attack must be carried out by the user on the user's own system. Multiuser systems have a higher risk of exploitation because folder permissions have an impact on all users of the device. For an attacker to exploit this vulnerability successfully a second user must execute the locally installed malicious file to allow remote code execution to occur.


A remote code execution vulnerability exists in \Microsoft COM for Windows\ when it fails to properly handle serialized objects aka \Microsoft COM for Windows Remote Code Execution Vulnerability.\ This affects Windows 7 Windows Server 2012 R2 Windows RT 8.1 Windows Server 2008 Windows Server 2012 Windows 8.1 Windows Server 2016 Windows Server 2008 R2 Windows 10 Windows 10 Servers.


The Credential Security Support Provider protocol (CredSSP) in Microsoft Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8.1 and RT 8.1 Windows Server 2012 and R2 Windows 10 Gold 1511 1607 1703 and 1709 Windows Server 2016 and Windows Server version 1709 allows a remote code execution vulnerability due to how CredSSP validates request during the authentication process aka \CredSSP Remote Code Execution Vulnerability\.


Microsoft Excel in Microsoft Office 2007 Microsoft Office 2010 Microsoft Office 2013 and Microsoft Office 2016 allows a remote code execution vulnerability due to the way objects are handled in memory aka \Microsoft Excel Remote Code Execution Vulnerability\.


A vulnerability in Cisco Meeting Server could allow an unauthenticated remote attacker to gain unauthorized access to components of or sensitive information in an affected system leading to Remote Code Execution. The vulnerability is due to incorrect default configuration of the device which can expose internal interfaces and ports on the external interface of the system. A successful exploit could allow the attacker to gain unauthenticated access to configuration and database files as well as sensitive meeting information on an affected system. Additionally if the Traversal Using Relay NAT (TURN) service is enabled and utilizing Transport Layer Security (TLS) connections an attacker could utilize TURN credentials to forward traffic to device daemons allowing for remote exploitation. This vulnerability affects Cisco Meeting Server (CMS) Acano X-series platforms that are running a CMS Software release prior to 2.2.11. Cisco Bug IDs: CSCvg76469.


Equation Editor in Microsoft Office 2003 Microsoft Office 2007 Microsoft Office 2010 Microsoft Office 2013 and Microsoft Office 2016 allows a remote code execution vulnerability due to the way objects are handled in memory aka \Microsoft Word Remote Code Execution Vulnerability\. This CVE is unique from CVE-2018-0804 CVE-2018-0805 and CVE-2018-0806.


Microsoft Word in Microsoft Office 2007 Microsoft Office 2010 Microsoft Office 2013 and Microsoft Office 2016 allows a remote code execution vulnerability due to the way objects are handled in memory aka \Microsoft Word Remote Code Execution Vulnerability\. This CVE is unique from CVE-2018-0792.


A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory aka \Microsoft Excel Remote Code Execution Vulnerability.\ This affects Microsoft Excel. This CVE ID is unique from CVE-2018-1011 CVE-2018-1027 CVE-2018-1029.


Pixelpost v1.7.3 and earlier allows remote code execution via unspecified vectors.


Microsoft Outlook 2007 Microsoft Outlook 2010 Microsoft Outlook 2013 and Microsoft Outlook 2016 allow a remote code execution vulnerability due to the way email messages are parsed aka \Microsoft Outlook Remote Code Execution Vulnerability\. This CVE is unique from CVE-2018-0793.


Microsoft Office 2016 Click-to-Run allows a remote code execution vulnerability due to how objects are handled in memory aka \Office Remote Code Execution Vulnerability\


Microsoft Office 2010 Microsoft Office 2013 and Microsoft Office 2016 allow a remote code execution vulnerability due to the way objects are handled in memory aka \Microsoft Office Remote Code Execution Vulnerability\.


Equation Editor in Microsoft Office 2003 Microsoft Office 2007 Microsoft Office 2010 Microsoft Office 2013 and Microsoft Office 2016 allows a remote code execution vulnerability due to the way objects are handled in memory aka \Microsoft Word Remote Code Execution Vulnerability\. This CVE is unique from CVE-2018-0805 CVE-2018-0806 and CVE-2018-0807.


Equation Editor in Microsoft Office 2003 Microsoft Office 2007 Microsoft Office 2010 Microsoft Office 2013 and Microsoft Office 2016 allows a remote code execution vulnerability due to the way objects are handled in memory aka \Microsoft Word Remote Code Execution Vulnerability\. This CVE is unique from CVE-2018-0804 CVE-2018-0805 and CVE-2018-0807.


Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16 suffer from possible Remote Code Execution when alwaysSelectFullNamespace is true (either by user or a plugin like Convention Plugin) and then: results are used with no namespace and in same time its upper package have no or wildcard namespace and similar to results same possibility when using url tag which doesn't have value and action set and in same time its upper package have no or wildcard namespace.


TP-LINK

IPC

and

devices

allow

authenticated

remote

code

execution

via

crafted

JSON

data

because

does

not

block

various

punctuation

characters.


There is Remote Code Execution in Centreon 3.4.6 including Centreon Web 2.8.23 via the RPN value in the Virtual Metric form in centreonGraph.class.php.


The ASUSTOR ADM 3.1.0.RFQ3 NAS portal suffers from an unauthenticated remote code execution vulnerability in the portal/apis/aggrecate_js.cgi file by embedding OS commands in the 'script' parameter.


Crestron TSW-1060 TSW-760 TSW-560 TSW-1060-NC TSW-760-NC and TSW-560-NC devices before 2.001.0037.001 allow unauthenticated remote code execution via a Bash shell service in Crestron Toolbox Protocol (CTP).


Remote code execution is possible in Cloudera Data Science Workbench version 1.3.0 and prior releases via unspecified attack vectors.


The Publish Service in FlexPaper (later renamed FlowPaper) 2.3.6 allows remote code execution via setup.php and change_config.php.


CouchDB administrative users before 2.2.0 can configure the database server via HTTP(S). Due to insufficient validation of administrator-supplied configuration settings via the HTTP API it is possible for a CouchDB administrator user to escalate their privileges to that of the operating system's user under which CouchDB runs by bypassing the blacklist of configuration settings that are not allowed to be modified via the HTTP API. This privilege escalation effectively allows a CouchDB admin user to gain arbitrary remote code execution bypassing CVE-2017-12636 and CVE-2018-8007.


A potential Remote Code Execution bug exists with the PDFInfo plugin in Apache SpamAssassin before 3.4.2.


AudioCodes IP phone 420HD devices using firmware version 2.2.12.126 allow Remote Code Execution.


AVEVA InTouch 2014 R2 SP1 and prior InTouch 2017 InTouch 2017 Update 1 and InTouch 2017 Update 2 allow an unauthenticated user to send a specially crafted packet that could overflow the buffer on a locale not using a dot floating point separator. Exploitation could allow remote code execution under the privileges of the InTouch View process.


Delta Industrial Automation COMMGR from Delta Electronics versions 1.08 and prior with accompanying PLC Simulators (DVPSimulator EH2 EH3 ES2 SE SS2 and AHSIM_5x0 AHSIM_5x1) utilize a fixed-length stack buffer where an unverified length value can be read from the network packets via a specific network port causing the buffer to be overwritten. This may allow remote code execution cause the application to crash or result in a denial-of-service condition in the application server.


** DISPUTED ** An issue was discovered in WildFly 10.1.2.Final. It is possible for an attacker to access the administration panel on TCP port 9990 without any authentication using \anonymous\ access that is automatically created. Once logged in a misconfiguration present by default (auto-deployment) permits an anonymous user to deploy a malicious .war file leading to remote code execution. NOTE: the vendor indicates that anonymous access is not available in the default installation; however it remains optional because there are several use cases for it including development environments and network architectures that have a proxy server for access control to the WildFly server.


Java remote method invocation (RMI) input port in GE MDS PulseNET and MDS PulseNET Enterprise version 3.2.1 and prior may be exploited to allow unauthenticated users to launch applications and support remote code execution through web services.


Axublog 1.1.0 allows remote Code Execution as demonstrated by injection of PHP code (contained in the webkeywords parameter) into the cmsconfig.php file.


Delta Electronics Delta Industrial Automation DOPSoft version 4.00.04 and prior utilizes a fixed-length stack buffer where a value larger than the buffer can be read from a .dpa file into the buffer causing the buffer to be overwritten. This may allow remote code execution or cause the application to crash.


D-Link DIR-615 2.5.17 devices allow Remote Code Execution via shell metacharacters in the Host field of the System / Traceroute screen.


An issue was discovered on Dongguan Diqee Diqee360 devices. The affected vacuum cleaner suffers from an authenticated remote code execution vulnerability. An authenticated attacker can send a specially crafted UDP packet and execute commands on the vacuum cleaner as root. The bug is in the function REQUEST_SET_WIFIPASSWD (UDP command 153). A crafted UDP packet runs \/mnt/skyeye/mode_switch.sh %s\ with an attacker controlling the %s variable. In some cases authentication can be achieved with the default password of 888888 for the admin account.


redhat-certification does not properly sanitize paths in rhcertStore.py:__saveResultsFile. A remote attacker could use this flaw to overwrite any file potentially gaining remote code execution.


A flaw was found in Jolokia versions from 1.2 to before 1.6.1. Affected versions are vulnerable to a system-wide CSRF. This holds true for properly configured instances with strict checking for origin and referrer headers. This could result in a Remote Code Execution attack.


A SQL injection remote code execution vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to execute arbitrary SQL statements on vulnerable installations due to a flaw in the formRequestDomains class. Authentication is required to exploit this vulnerability.


Delta Electronics Delta Industrial Automation DOPSoft version 4.00.04 and prior performs read operations on a memory buffer where the position can be determined by a value read from a .dpa file. This may cause improper restriction of operations within the bounds of the memory buffer allow remote code execution alter the intended control flow allow reading of sensitive information or cause the application to crash.


Digital Guardian Management Console 7.1.2.0015 allows authenticated remote code execution because of Arbitrary File Upload functionality.


Yokogawa STARDOM FCJ controllers R4.02 and prior FCN-100 controllers R4.02 and prior FCN-RTU controllers R4.02 and prior and FCN-500 controllers R4.02 and prior utilize hard-coded credentials that could allow an attacker to gain unauthorized administrative access to the device which could result in remote code execution.


Delta Electronics Delta Industrial Automation DOPSoft version 4.00.04 and prior utilizes a fixed-length heap buffer where a value larger than the buffer can be read from a .dpa file into the buffer causing the buffer to be overwritten. This may allow remote code execution or cause the application to crash.


A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory aka \Microsoft Office Remote Code Execution Vulnerability.\ This affects Microsoft Office. This CVE ID is unique from CVE-2018-1026.


A remote code execution vulnerability exists when the Office graphics component improperly handles specially crafted embedded fonts aka \Microsoft Office Graphics Remote Code Execution Vulnerability.\ This affects Word Microsoft Office Microsoft SharePoint Excel Microsoft SharePoint Server.


Spring Data Commons versions prior to 1.13 to 1.13.10 2.0 to 2.0.5 and older unsupported versions contain a property binder vulnerability caused by improper neutralization of special elements. An unauthenticated remote malicious user (or attacker) can supply specially crafted request parameters against Spring Data REST backed HTTP resources or using Spring Data's projection-based request payload binding hat can lead to a remote code execution attack.


A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts aka \Microsoft Graphics Remote Code Execution Vulnerability.\ This affects Windows 7 Windows Server 2012 R2 Windows RT 8.1 Windows Server 2008 Windows Server 2012 Windows 8.1 Windows Server 2016 Windows Server 2008 R2 Windows 10 Windows 10 Servers. This CVE ID is unique from CVE-2018-1010 CVE-2018-1012 CVE-2018-1013 CVE-2018-1016.


A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory aka \Microsoft Excel Remote Code Execution Vulnerability.\ This affects Microsoft Excel. This CVE ID is unique from CVE-2018-0920 CVE-2018-1027 CVE-2018-1029.


A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts aka \Microsoft Graphics Remote Code Execution Vulnerability.\ This affects Windows 7 Windows Server 2012 R2 Windows RT 8.1 Windows Server 2008 Windows Server 2012 Windows 8.1 Windows Server 2016 Windows Server 2008 R2 Windows 10 Windows 10 Servers. This CVE ID is unique from CVE-2018-1012 CVE-2018-1013 CVE-2018-1015 CVE-2018-1016.


A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory aka \Windows VBScript Engine Remote Code Execution Vulnerability.\ This affects Windows 7 Windows Server 2012 R2 Internet Explorer 9 Windows RT 8.1 Windows Server 2012 Windows 8.1 Windows Server 2016 Windows Server 2008 R2 Windows 10.


An issue was discovered in Moodle 3.x. A Teacher creating a Calculated question can intentionally cause remote code execution on the server aka eval injection.


A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory aka \Microsoft Excel Remote Code Execution Vulnerability.\ This affects Microsoft Excel Viewer Microsoft Office Microsoft Excel. This CVE ID is unique from CVE-2018-0920 CVE-2018-1011 CVE-2018-1027.


A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts aka \Microsoft Graphics Remote Code Execution Vulnerability.\ This affects Windows 7 Windows Server 2012 R2 Windows RT 8.1 Windows Server 2008 Windows Server 2012 Windows 8.1 Windows Server 2016 Windows Server 2008 R2 Windows 10 Windows 10 Servers. This CVE ID is unique from CVE-2018-1010 CVE-2018-1012 CVE-2018-1013 CVE-2018-1015.


A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in memory aka \Microsoft Excel Remote Code Execution Vulnerability.\ This affects Microsoft Excel Microsoft Office. This CVE ID is unique from CVE-2018-0920 CVE-2018-1011 CVE-2018-1029.


A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts aka \Microsoft Graphics Remote Code Execution Vulnerability.\ This affects Windows 7 Windows Server 2012 R2 Windows RT 8.1 Windows Server 2008 Windows Server 2012 Windows 8.1 Windows Server 2016 Windows Server 2008 R2 Windows 10 Windows 10 Servers. This CVE ID is unique from CVE-2018-1010 CVE-2018-1013 CVE-2018-1015 CVE-2018-1016.


Spring Security OAuth versions 2.3 prior to 2.3.3 2.2 prior to 2.2.2 2.1 prior to 2.1.2 2.0 prior to 2.0.15 and older unsupported versions contains a remote code execution vulnerability. A malicious user or attacker can craft an authorization request to the authorization endpoint that can lead to remote code execution when the resource owner is forwarded to the approval endpoint.


Spring Framework versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.15 and older unsupported versions allow applications to expose STOMP over WebSocket endpoints with a simple in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a remote code execution attack.


Spring Framework versions 5.0 prior to 5.0.5 and versions 4.3 prior to 4.3.16 and older unsupported versions allow applications to expose STOMP over WebSocket endpoints with a simple in-memory STOMP broker through the spring-messaging module. A malicious user (or attacker) can craft a message to the broker that can lead to a remote code execution attack. This CVE addresses the partial fix for CVE-2018-1270 in the 4.3.x branch of the Spring Framework.


A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory aka \Microsoft Office Remote Code Execution Vulnerability.\ This affects Microsoft Office. This CVE ID is unique from CVE-2018-1030.


A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts aka \Microsoft Graphics Remote Code Execution Vulnerability.\ This affects Windows 7 Windows Server 2012 R2 Windows RT 8.1 Windows Server 2008 Windows Server 2012 Windows 8.1 Windows Server 2016 Windows Server 2008 R2 Windows 10 Windows 10 Servers. This CVE ID is unique from CVE-2018-1010 CVE-2018-1012 CVE-2018-1015 CVE-2018-1016.


NASA Singledop version v1.0 contains a CWE-502 vulnerability in NASA Singledop library (Weather data) that can result in remote code execution. This attack appear to be exploitable via Victim opening a specially crafted radar data file. This vulnerability appears to have been fixed in v1.1.


WordPress version 4.9.8 and earlier contains a CWE-20 Input Validation vulnerability in thumbnail processing that can result in remote code execution due to an incomplete fix for CVE-2017-1000600. This attack appears to be exploitable via thumbnail upload by an authenticated user and may require additional plugins in order to be exploited however this has not been confirmed at this time.


LibreHealthIO lh-ehr version REL-2.0.0 contains a Authenticated Unrestricted File Write vulnerability in Patient file letter functions that can result in Write files with malicious content and may lead to remote code execution. This attack appear to be exploitable via User controlled parameters.


Nanopool Claymore Dual Miner version 7.3 and earlier contains a remote code execution vulnerability by abusing the miner API. The flaw can be exploited only if the software is executed with read/write mode enabled.


LibreHealthIO lh-ehr version REL-2.0.0 contains a Authenticated Unrestricted File Write in letter.php (2) vulnerability in Patient file letter functions that can result in Write files with malicious content and may lead to remote code execution. This attack appear to be exploitable via User controlled input.


NASA RtRetrievalFramework version v1.0 contains a CWE-502 vulnerability in Data retrieval functionality of RtRetrieval framework that can result in remote code execution. This attack appear to be exploitable via Victim tries to retrieve and process a weather data file.


OISF

suricata-update

version

contains

an

Insecure

Deserialization

vulnerability

in

the

insecure

yaml.load-Function

as

used

in

the

following

files:

and

The

\list-sources\-command

is

affected

by

this

bug.

that

can

result

in

Remote

Code

Execution(even

as

root

if

suricata-update

is

called

by

root).

This

attack

appears

to

be

exploitable

via

a

specially

crafted

yaml-file

at

This

vulnerability

appears

to

have

been

fixed

in


Libgd

version

contains

a

Double

Free

Vulnerability

vulnerability

in

gdImageBmpPtr

Function

that

can

result

in

Remote

Code

Execution

This

attack

appear

to

be

exploitable

via

Specially

Crafted

Jpeg

Image

can

trigger

double

free.

This

vulnerability

appears

to

have

been

fixed

in

after

commit


CMS Made Simple version 2.2.5 contains a Remote Code Execution vulnerability in File Manager that can result in Allows an authenticated admin that has access to the file manager to execute code on the server. This attack appear to be exploitable via File upload -> copy to any extension.


LH-EHR version REL-2_0_0 contains a Arbitrary File Upload vulnerability in Profile picture upload that can result in Remote Code Execution. This attack appear to be exploitable via Uploading a PHP file with image MIME type.


Electron version 1.7 up to 1.7.12; 1.8 up to 1.8.3 and 2.0.0 up to 2.0.0-beta.3 contains an improper handling of values vulnerability in Webviews that can result in remote code execution. This attack appear to be exploitable via an app which allows execution of 3rd party code AND disallows node integration AND has not specified if webview is enabled/disabled. This vulnerability appears to have been fixed in 1.7.13 1.8.4 2.0.0-beta.4.


NASA Pyblock version v1.0 - v1.3 contains a CWE-502 vulnerability in Radar data parsing library that can result in remote code execution. This attack appear to be exploitable via Victim opening a specially crafted radar data file. This vulnerability appears to have been fixed in v1.4.


Alpine Linux version Versions prior to 2.6.10 2.7.6 and 2.10.1 contains a Other/Unknown vulnerability in apk-tools (Alpine Linux' package manager) that can result in Remote Code Execution. This attack appear to be exploitable via A specially crafted APK-file can cause apk to write arbitrary data to an attacker-specified file due to bugs in handling long link target name and the way a regular file is extracted.. This vulnerability appears to have been fixed in 2.6.10 2.7.6 and 2.10.1.


esigate.org esigate version 5.2 and earlier contains a CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in ESI directive with user specified XSLT that can result in Remote Code Execution. This attack appear to be exploitable via Use of another weakness in backend application to reflect ESI directives. This vulnerability appears to have been fixed in 5.3.


NASA Kodiak version v1.0 contains a CWE-502 vulnerability in Kodiak library's data processing function that can result in remote code execution. This attack appear to be exploitable via Victim opens an untrusted file for optimization using Kodiak library.


LibreHealthIO LH-EHR version REL-2.0.0 contains an Authenticated Unrestricted File Write vulnerability in Import template that can result in write files with malicious content and may lead to remote code execution.


PEAR Archive_Tar version 1.4.3 and earlier contains a CWE-502 CWE-915 vulnerability in the Archive_Tar class. There are several file operations with `$v_header'filename'` as parameter (such as file_exists is_file is_dir etc). When extract is called without a specific prefix path we can trigger unserialization by crafting a tar file with `phar://path_to_malicious_phar_file` as path. Object injection can be used to trigger destruct in the loaded PHP classes e.g. the Archive_Tar class itself. With Archive_Tar object injection arbitrary file deletion can occur because `@unlink($this->_temp_tarname)` is called. If another class with useful gadget is loaded it may possible to cause remote code execution that can result in files being deleted or possibly modified. This vulnerability appears to have been fixed in 1.4.4.


Ovidentia version 8.4.3 and earlier contains a Unsanitized User Input vulnerability in utilit.php bab_getAddonFilePathfromTg that can result in Authenticated Remote Code Execution. This attack appear to be exploitable via The attacker must have permission to upload addons.


moodle before versions 3.5.2 3.4.5 3.3.8 3.1.14 is vulnerable to an XML import of ddwtos could lead to intentional remote code execution. When importing legacy 'drag and drop into text' (ddwtos) type quiz questions it was possible to inject and execute PHP code from within the imported questions either intentionally or by importing questions from an untrusted source.


Foxit Reader before 9.2 and PhantomPDF before 9.2 have a Use-After-Free that leads to Remote Code Execution aka V-88f4smlocs.


Codiad through 2.8.4 allows Remote Code Execution a different vulnerability than CVE-2017-11366 and CVE-2017-15689.


Fuji Electric FRENIC LOADER v3.3 v7.3.4.1a of FRENIC-Mini (C1) FRENIC-Mini (C2) FRENIC-Eco FRENIC-Multi FRENIC-MEGA FRENIC-Ace. The program does not properly check user-supplied comments which may allow for arbitrary remote code execution.


SeaCMS v6.61 allows Remote Code execution by placing PHP code in a movie picture address (aka v_pic) to /admin/admin_video.php (aka /backend/admin_video.php). The code is executed by visiting /details/index.php. This can also be exploited through CSRF.


SeaCMS v6.61 allows Remote Code execution by placing PHP code in an allowed IP address (aka ip) to /admin/admin_ip.php (aka /adm1n/admin_ip.php). The code is executed by visiting adm1n/admin_ip.php or data/admin/ip.php. This can also be exploited through CSRF.


Emerson AMS Device Manager v12.0 to v13.5. A specially crafted script may be run that allows arbitrary remote code execution.


Unrestricted file upload (with remote code execution) in require/mail/NotificationMail.php in Webconsole in OCS Inventory NG OCS Inventory Server through 2.5 allows a privileged user to gain access to the server via a template file containing PHP code because file extensions other than .html are permitted.


In ClickHouse before 18.10.3 unixODBC allowed loading arbitrary shared objects from the file system which led to a Remote Code Execution vulnerability.


An issue was discovered on Tenda AC15 V15.03.1.16_multi devices. A remote unauthenticated attacker can gain remote code execution on the device with a crafted password parameter for the COOKIE header.


NetApp SANtricity Web Services Proxy versions 1.10.x000.0002 through 2.12.X000.0002 and SANtricity Storage Manager 11.30.0X00.0004 through 11.42.0X00.0001 ship with the Java Management Extension Remote Method Invocation (JMX RMI) service bound to the network and are susceptible to unauthenticated remote code execution.


FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 and CVE-2017-17485 deserialization flaws. This is exploitable via two different gadgets that bypass a blacklist.


An issue was discovered on AudioCodes 450HD IP Phone devices with firmware 3.0.0.535.106. The traceroute and ping functionality which uses a parameter in a request to command.cgi from the Monitoring page in the web UI unsafely puts user-alterable data directly into an OS command leading to Remote Code Execution via shell metacharacters in the query string.


A remote unauthenticated attacker can gain remote code execution on the the Tenda AC15 router with a specially crafted password parameter for the COOKIE header.


An issue was discovered in the HTTP Server in RAVPower Filehub 2.000.056. Due to an unrestricted upload feature and a path traversal vulnerability it is possible to upload a file on a filesystem with root privileges: this will lead to remote code execution as root.


The TIBCO Spotfire Client and TIBCO Spotfire Web Player Client components of TIBCO Software Inc.'s TIBCO Spotfire Analyst TIBCO Spotfire Analytics Platform for AWS Marketplace TIBCO Spotfire Deployment Kit TIBCO Spotfire Desktop and TIBCO Spotfire Desktop Language Packs contain multiple vulnerabilities that may allow for remote code execution. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Analyst: versions up to and including 7.8.0; 7.9.0; 7.9.1; 7.10.0; 7.10.1; 7.11.0; 7.12.0 TIBCO Spotfire Analytics Platform for AWS Marketplace: versions up to and including 7.12.0 TIBCO Spotfire Deployment Kit: versions up to and including 7.8.0; 7.9.0;7.9.1;7.10.0;7.10.1;7.11.0; 7.12.0 TIBCO Spotfire Desktop: versions up to and including 7.8.0; 7.9.0; 7.9.1; 7.10.0; 7.10.1; 7.11.0;7.12.0 TIBCO Spotfire Desktop Language Packs: versions up to and including 7.8.0; 7.9.0; 7.9.1; 7.10.0; 7.10.1; 7.11.0.


In browser editing in Atlassian Bitbucket Server from version 4.13.0 before 5.4.8 (the fixed version for 4.13.0 through 5.4.7) 5.5.0 before 5.5.8 (the fixed version for 5.5.x) 5.6.0 before 5.6.5 (the fixed version for 5.6.x) 5.7.0 before 5.7.3 (the fixed version for 5.7.x) and 5.8.0 before 5.8.2 (the fixed version for 5.8.x) allows authenticated users to gain remote code execution using the in browser editing feature via editing a symbolic link within a repository.


NetApp E-Series SANtricity OS Controller Software 11.30 and later version 11.30.5 is susceptible to unauthenticated remote code execution.


An exploitable remote code execution vulnerability exists in the upload.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP request can upload a file resulting in executable code being uploaded and routable to the webserver. An attacker can make an authenticated HTTP request to trigger this vulnerability.


A vulnerability has been identified in RFID 181EIP (All versions) RUGGEDCOM Win (V4.4 V4.5 V5.0 and V5.1) SCALANCE X-200 switch family (incl. SIPLUS NET variants) (All versions < V5.2.3) SCALANCE X-200IRT switch family (incl. SIPLUS NET variants) (All versions < V5.4.1) SCALANCE X-200RNA switch family (All versions < V3.2.6) SCALANCE X-300 switch family (incl. SIPLUS NET variants) (All versions < V4.1.3) SCALANCE X408 (All versions < V4.1.3) SCALANCE X414 (All versions) SIMATIC RF182C (All versions). Unprivileged remote attackers located in the same local network segment (OSI Layer 2) could gain remote code execution on the affected products by sending a specially crafted DHCP response to a client's DHCP request.


LibVNC

before

commit

contains

heap

out-of-bound

write

vulnerability

in

server

code

of

file

transfer

extension

that

can

result

remote

code

execution


In Laravel Framework through 5.5.40 and 5.6.x through 5.6.29 remote code execution might occur as a result of an unserialize call on a potentially untrusted X-XSRF-TOKEN value. This involves the decrypt method in Illuminate/Encryption/Encrypter.php and PendingBroadcast in gadgetchains/Laravel/RCE/3/chain.php in phpggc. The attacker must know the application key which normally would never occur but could happen if the attacker previously had privileged access or successfully accomplished a previous attack.


CeLa Link CLR-M20 devices allow unauthorized users to upload any file (e.g. asp aspx cfm html jhtml jsp or shtml) which causes remote code execution as well. Because of the WebDAV feature it is possible to upload arbitrary files by utilizing the PUT method.


LibVNC

before

commit

contains

heap

use-after-free

vulnerability

in

server

code

of

file

transfer

extension

that

can

result

remote

code

execution


Unrestricted file upload (with remote code execution) in OCS Inventory NG ocsreports allows a privileged user to gain access to the server via crafted HTTP requests.


An issue was discovered in EasyLogin Pro through 1.3.0. Encryptor.php contains an unserialize call that can be exploited for remote code execution in the decrypt function if the attacker knows the key.


A vulnerability in the Web UI component of Avaya Aura System Platform could allow a remote unauthenticated user to perform a targeted deserialization attack that could result in remote code execution. Affected versions of System Platform includes 6.3.0 through 6.3.9 and 6.4.0 through 6.4.2.


GitHub Electron 1.7.15 1.8.7 2.0.7 and 3.0.0-beta.6 in certain scenarios involving IFRAME elements and \nativeWindowOpen: true\ or \sandbox: true\ options is affected by a WebPreferences vulnerability that can be leveraged to perform remote code execution.


An issue was discovered on KONE Group Controller (KGC) devices before 4.6.5. Unauthenticated Remote Code Execution is possible through the open HTTP interface by modifying autoexec.bat aka KONE-01.


Git before 2.14.5 2.15.x before 2.15.3 2.16.x before 2.16.5 2.17.x before 2.17.2 2.18.x before 2.18.1 and 2.19.x before 2.19.1 allows remote code execution during processing of a recursive \git clone\ of a superproject if a .gitmodules file has a URL field beginning with a '-' character.


NUUO CMS all versions 3.1 and prior The application uses a session identification mechanism that could allow attackers to obtain the active session ID which could allow arbitrary remote code execution.


Apache NetBeans (incubating) 9.0 NetBeans Proxy Auto-Configuration (PAC) interpretation is vulnerable for remote command execution (RCE). Using the nashorn script engine the environment of the javascript execution for the Proxy Auto-Configuration leaks privileged objects that can be used to circumvent the execution limits. If a different script engine was used no execution limits were in place. Both vectors allow remote code execution.


In Delta Industrial Automation TPEditor TPEditor Versions 1.90 and prior multiple out-of-bounds write vulnerabilities may be exploited by processing specially crafted project files lacking user input validation which may cause the system to write outside the intended buffer area and may allow remote code execution.


UiPath Orchestrator through 2018.2.4 allows any authenticated user to change the information of arbitrary users (even administrators) leading to privilege escalation and remote code execution.


NUUO CMS All versions 3.3 and prior the application allows the upload of arbitrary files that can modify or overwrite configuration files to the server which could allow remote code execution.


NUUO CMS all versions 3.1 and prior The application implements a method of user account control that causes standard account security features to not be utilized as intended which could allow user account compromise and may allow for remote code execution.


The VMware AirWatch Agent for Android prior to 8.2 and AirWatch Agent for Windows Mobile prior to 6.5.2 contain a remote code execution vulnerability in real time File Manager capabilities. This vulnerability may allow for unauthorized creation and execution of files in the Agent sandbox and other publicly accessible directories such as those on the SD card by a malicious administrator.


Remote Code Execution in the following products Hybrid Cloud Management Containerized Suite HCM2017.11 HCM2018.02 HCM2018.05 Operations Bridge Containerized Suite 2017.11 2018.02 2018.05 Data Center Automation Containerized Suite 2017.01 until 2018.05 Service Management Automation Suite 2017.11 2018.02 2018.05 Service Virtualization (SV) with floating licenses using Any version using APLS older than 10.7 Unified Functional Testing (UFT) with floating licenses using Any version using APLS older than 10.7 Network Virtualization (NV) with floating licenses using Any version using APLS older than 10.7 and Network Operations Management (NOM) Suite CDF 2017.11 2018.02 2018.05 will allow Remote Code Execution.


A /shell?cmd= CSRF issue exists in the HTTPD component of NAT32 v2.2 Build 22284 devices that can be exploited for Remote Code Execution in conjunction with XSS.


An Arbitrary Free (Remote Code Execution) issue was discovered in Design Science MathType 6.9c. Crafted input can overwrite a structure leading to a function call with an invalid parameter and a subsequent free of important data such as a function pointer or list pointer. This is fixed in 6.9d.


A Heap Overflow (Remote Code Execution) issue was discovered in Design Science MathType 6.9c. Crafted input can modify the next pointer of a linked list. This is fixed in 6.9d.


Remote Code Execution in the following products Hybrid Cloud Management Containerized Suite HCM2017.11 HCM2018.02 HCM2018.05 Operations Bridge Containerized Suite 2017.11 2018.02 2018.05 Data Center Automation Containerized Suite 2017.01 until 2018.05 Service Management Automation Suite 2017.11 2018.02 2018.05 and Network Operations Management (NOM) Suite CDF 2017.11 2018.02 2018.05 will allow Remote Code Execution.


A /shell?cmd= XSS issue exists in the HTTPD component of NAT32 v2.2 Build 22284 devices that can be exploited for Remote Code Execution in conjunction with CSRF.


Silex SD-320AN version 2.01 and prior and GE MobileLink(GEH-SD-320AN) version GEH-1.1 and prior have a system call parameter that is not properly sanitized which may allow remote code execution.


Remote Code Execution in Saperion Web Client version 7.5.2 83166.


LibVNC

before

commit

contains

heap

use-after-free

vulnerability

in

server

code

of

file

transfer

extension

that

can

result

remote

code

execution.


Arbitrary File Upload and Remote Code Execution exist in PHP Scripts Mall Schools Alert Management Script 2.0.2 via a profile picture.


** DISPUTED ** In the Admin Package Manager in Open Ticket Request System (OTRS) 5.0.0 through 5.0.24 and 6.0.0 through 6.0.1 authenticated admins are able to exploit a Blind Remote Code Execution vulnerability by loading a crafted opm file with an embedded CodeInstall element to execute a command on the server during package installation. NOTE: the vendor disputes this issue stating \the behaviour is as designed and needed for different packages to be installed\ \there is a security warning if the package is not verified by OTRS Group\ and \there is the possibility and responsibility of an admin to check packages before installation which is possible as they are not binary.\


WPLSoft in Delta Electronics versions 2.45.0 and prior utilizes a fixed length stack buffer where a value larger than the buffer can be read from a file into the buffer causing the buffer to be overwritten which may allow remote code execution or cause the application to crash.


Remote Code Execution in the addon installation process in eQ-3 AG Homematic CCU2 2.29.2 and earlier allows authenticated attackers to create or overwrite arbitrary files or install malicious software on the device.


A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site which could result in the site being compromised. This vulnerability is related to Drupal core - Highly critical - Remote Code Execution - SA-CORE-2018-002. Both SA-CORE-2018-002 and this vulnerability are being exploited in the wild.


FasterXML jackson-databind before 2.7.9.3 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper bypassing a blacklist that is ineffective if the c3p0 libraries are available in the classpath.


The Milestone XProtect Video Management Software (Corporate Expert Professional+ Express+ Essential+) 2016 R1 (10.0.a) to 2018 R1 (12.1a) contains .NET Remoting endpoints that are vulnerable to deserialization attacks resulting in remote code execution.


WPLSoft in Delta Electronics versions 2.45.0 and prior utilizes a fixed length heap buffer where a value larger than the buffer can be read from a file into the buffer causing the buffer to be overwritten which may allow remote code execution or cause the application to crash.


An issue was discovered in the MBeans Server in Wowza Streaming Engine before 4.7.1. The file system may be read and written to via JMX using the default JMX credentials (remote code execution may be possible as well).


Remote Code Execution in the TCL script interpreter in eQ-3 AG Homematic CCU2 2.29.2 and earlier allows remote attackers to obtain read/write access and execute system commands on the device. This vulnerability can be exploited by unauthenticated attackers with access to the web interface.


A Use After Free (CWE-416) vulnerability exists in Zelio Soft 2 v5.1 and prior versions which could cause remote code execution when opening a specially crafted Zelio Soft project file.


The Node.js inspector in 6.x and later is vulnerable to a DNS rebinding attack which could be exploited to perform remote code execution. An attack is possible from malicious websites open in a web browser on the same computer or another computer with network access to the computer running the Node.js process. A malicious website could use a DNS rebinding attack to trick the web browser to bypass same-origin-policy checks and to allow HTTP connections to localhost or to hosts on the local network. If a Node.js process with the debug port active is running on localhost or on a host on the local network the malicious website could connect to it as a debugger and get full code execution access.


An issue was discovered in damiCMS V6.0.1. Remote code execution can occur via PHP code in a multipart/form-data POST to the admin.php?s=/Tpl/Update.html URI. For example this can update the Web/Tpl/default/head.html file.


DedeCMS 5.7 SP2 allows XML injection and resultant remote code execution via a \<file type='file' name='../\ substring.


A serialization vulnerability in Zoho ManageEngine Applications Manager before build 13740 allows for remote code execution on Windows via a payload on an SMB share.


LINK-NET LW-N605R devices with firmware 12.20.2.1486 allow Remote Code Execution via shell metacharacters in the HOST field of the ping feature at adm/systools.asp. Authentication is needed but the default password of admin for the admin account may be used in some cases.


FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This can lead to Pre-Auth Remote Code Execution.


In

Go

before

and

before

the

\go

get\

command

is

vulnerable

to

remote

code

execution

when

executed

with

the

-u

flag

and

the

import

path

of

a

malicious

Go

package

or

a

package

that

imports

it

directly

or

indirectly.

Specifically

it

is

only

vulnerable

in

GOPATH

mode

but

not

in

module

mode

(the

distinction

is

documented

at

Using

custom

domains

it's

possible

to

arrange

things

so

that

a

Git

repository

is

cloned

to

a

folder

named

\.git\

by

using

a

vanity

import

path

that

ends

with

\/.git\.

If

the

Git

repository

root

contains

a

\HEAD\

file

a

\config\

file

an

\objects\

directory

a

\refs\

directory

with

some

work

to

ensure

the

proper

ordering

of

operations

\go

get

-u\

can

be

tricked

into

considering

the

parent

directory

as

a

repository

root

and

running

Git

commands

on

it.

That

will

use

the

\config\

file

in

the

original

Git

repository

root

for

its

configuration

and

if

that

config

file

contains

malicious

commands

they

will

execute

on

the

system

running

\go

get

-u\.


In Jspxcms 9.0.0 a vulnerable URL routing implementation allows remote code execution after logging in as web admin.


** DISPUTED ** jsonpickle through 1.4.1 allows remote code execution during deserialization of a malicious payload through the decode() function. Note: It has been argued that this is expected and clearly documented behaviour. pickle is known to be capable of causing arbitrary code execution and must not be used with un-trusted data.


Feehi CMS 2.1.0 is affected by an arbitrary file upload vulnerability potentially resulting in remote code execution. After an administrator logs in open the administrator image upload page to potentially upload malicious files.


** DISPUTED ** NagiosXI 5.6.11 is affected by a remote code execution (RCE) vulnerability. An authenticated nagiosadmin user can inject additional commands into a request. NOTE: the vendor disputes whether the CVE and its references are actionable because all technical details are omitted and the only option is to pay for a subscription service where technical details may be disclosed at an unspecified later time.


Remote Code Execution vulnerability in phplist 3.5.1. The application does not check any file extensions stored in the plugin zip file Uploading a malicious plugin which contains the php files with extensions like PHP phtml php7 will be copied to the plugins directory which would lead to the remote code execution


The contact-form-7 (aka Contact Form 7) plugin before 5.3.2 for WordPress allows Unrestricted File Upload and remote code execution because a filename may contain special characters.


An issue was discovered in the Quiz and Survey Master plugin before 7.0.1 for WordPress. It made it possible for unauthenticated attackers to upload arbitrary files and achieve remote code execution. If a quiz question could be answered by uploading a file only the Content-Type header was checked during the upload and thus the attacker could use text/plain for a .php file.


An issue was discovered in Cacti 1.2.x through 1.2.16. A SQL injection vulnerability in data_debug.php allows remote authenticated attackers to execute arbitrary SQL commands via the site_id parameter. This can lead to remote code execution.


An issue was discovered in the hyper crate before 0.12.34 for Rust. HTTP request smuggling can occur. Remote code execution can occur in certain situations with an HTTP server on the loopback interface.


An issue was discovered in the XCloner Backup and Restore plugin before 4.2.13 for WordPress. It gave authenticated attackers the ability to modify arbitrary files including PHP files. Doing so would allow an attacker to achieve remote code execution. The xcloner_restore.php write_file_action could overwrite wp-config.php for example. Alternatively an attacker could create an exploit chain to obtain a database dump.


A RCE vulnerability exists in Raysync below 3.3.3.8. An unauthenticated unauthorized attacker sending a specifically crafted request to override the specific file in server with malicious content can login as \admin\ then to modify specific shell file to achieve remote code execution(RCE) on the hosting server.


UNSUPPORTED

WHEN

ASSIGNED

in

the

secure-file-manager

plugin

through

for

WordPress

loads

elFinder

code

without

proper

access

control.

Thus

any

authenticated

user

can

run

the

elFinder

upload

command

to

achieve

remote

code

execution.

NOTE:

This

vulnerability

only

affects

products

that

are

no

longer

supported

by

the

maintainer.


zonote through 0.4.0 allows XSS via a crafted note with resultant Remote Code Execution (because nodeIntegration in webPreferences is true).


Dolibarr 12.0.3 is vulnerable to authenticated Remote Code Execution. An attacker who has the access the admin dashboard can manipulate the backup function by inserting a payload into the filename for the zipfilename_template parameter to admin/tools/dolibarr_export.php.


imcat 5.2 allows an authenticated file upload and consequently remote code execution via the picture functionality.


A

File

Upload

vulnerability

in

SourceCodester

Online

Course

Registration

allows

remote

attackers

to

achieve

Remote

Code

Execution

(RCE)

on

the

hosting

webserver

by

uploading

a

crafted

PHP

web-shell

that

bypasses

the

image

upload

filters.

An

attack

uses

with

the

POST

parameter

photo.


in

LibreHealth

EHR

suffers

from

an

authenticated

file

upload

vulnerability

allowing

remote

attackers

to

achieve

remote

code

execution

(RCE)

on

the

hosting

webserver

by

uploading

a

maliciously

crafted

image.


An insecure unserialize vulnerability was discovered in ThinkAdmin versions 4.x through 6.x in app/admin/controller/api/Update.php and app/wechat/controller/api/Push.php which may lead to arbitrary remote code execution.


Myucms v2.2.1 contains a remote code execution (RCE) vulnerability in the component \\controller\\point.php which can be exploited via the add() method.


Myucms v2.2.1 contains a remote code execution (RCE) vulnerability in the component \\controller\\Config.php which can be exploited via the add() method.


ThinkPHP50-CMS v1.0 contains a remote code execution (RCE) vulnerability in the component /public/?s=captcha.


Myucms v2.2.1 contains a remote code execution (RCE) vulnerability in the component \\controller\\Config.php which can be exploited via the addqq() method.


** DISPUTED ** Zenphoto through 1.5.7 is affected by authenticated arbitrary file upload leading to remote code execution. The attacker must navigate to the uploader plugin check the elFinder box and then drag and drop files into the Files(elFinder) portion of the UI. This can for example place a .php file in the server's uploaded/ directory. NOTE: the vendor disputes this because exploitation can only be performed by an admin who has \lots of other possibilities to harm a site.\


JYaml through 1.3 allows remote code execution during deserialization of a malicious payload through the load() function. NOTE: this is a discontinued product.


A vulnerability in the management consoles of Trend Micro Deep Security 10.0-12.0 and Trend Micro Vulnerability Protection 2.0 SP2 may allow an authenticated attacker with full control privileges to bypass file integrity checks leading to remote code execution.


A vulnerability in the Pulse Secure Desktop Client < 9.1R9 has Remote Code Execution (RCE) if users can be convinced to connect to a malicious server. This vulnerability only affects Windows PDC.To improve the security of connections between Pulse clients and Pulse Connect Secure see below recommendation(s):Disable Dynamic certificate trust for PDC.


Horde Groupware Webmail Edition 5.2.22 allows injection of arbitrary PHP code via CSV data leading to remote code execution.


Unauthenticated RPC server on ALEOS before 4.4.9 4.9.5 and 4.14.0 allows remote code execution.


Backblaze for Windows before 7.0.1.433 and Backblaze for macOS before 7.0.1.434 suffer from improper certificate validation in `bztransmit` helper due to hardcoded whitelist of strings in URLs where validation is disabled leading to possible remote code execution via client update functionality.


An issue was discovered in OpServices OpMon 9.3.2 that allows Remote Code Execution .


DrayTek Vigor2960 1.3.1_Beta Vigor3900 1.4.4_Beta and Vigor300B 1.3.3_Beta 1.4.2.1_Beta and 1.4.4_Beta devices allow remote code execution as root (without authentication) via shell metacharacters to the cgi-bin/mainfunction.cgi URI. This issue has been fixed in Vigor3900/2960/300B v1.5.1.


Biscom Secure File Transfer (SFT) before 5.1.1071 and 6.0.1xxx before 6.0.1005 allows Remote Code Execution on the server.


controllers/page_apply.php in Simplejobscript.com SJS through 1.66 is prone to unauthenticated Remote Code Execution by uploading a PHP script as a resume.


massCode 1.0.0-alpha.6 allows XSS via crafted Markdown text with resultant remote code execution (because nodeIntegration in webPreferences is true).


An arbitrary file write issue exists in all versions of Citrix ShareFile StorageZones (aka storage zones) Controller including the most recent 5.10.x releases as of May 2020 which allows remote code execution. RCE and file access is granted to everything hosted by ShareFile be it on-premise or inside Citrix Cloud itself (both are internet facing). NOTE: unlike most CVEs exploitability depends on the product version that was in use when a particular setup step was performed NOT the product version that is in use during a current assessment of a CVE consumer's product inventory. Specifically the vulnerability can be exploited if a storage zone was created by one of these product versions: 5.9.0 5.8.0 5.7.0 5.6.0 5.5.0 or earlier. This CVE differs from CVE-2020-7473 and CVE-2020-8982.


Pi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard users via a crafted DHCP static lease.


BIND servers are vulnerable if they are running an affected version and are configured to use GSS-TSIG features. In a configuration which uses BIND's default settings the vulnerable code path is not exposed but a server can be rendered vulnerable by explicitly setting valid values for the tkey-gssapi-keytab or tkey-gssapi-credentialconfiguration options. Although the default configuration is not vulnerable GSS-TSIG is frequently used in networks where BIND is integrated with Samba as well as in mixed-server environments that combine BIND servers with Active Directory domain controllers. The most likely outcome of a successful exploitation of the vulnerability is a crash of the named process. However remote code execution while unproven is theoretically possible. Affects: BIND 9.5.0 -> 9.11.27 9.12.0 -> 9.16.11 and versions BIND 9.11.3-S1 -> 9.11.27-S1 and 9.16.8-S1 -> 9.16.11-S1 of BIND Supported Preview Edition. Also release versions 9.17.0 -> 9.17.1 of the BIND 9.17 development branch


An issue was discovered on Askey AP4000W TDC_V1.01.003 devices. An attacker can perform Remote Code Execution (RCE) by sending a specially crafted network packer to the bd_svr service listening on TCP port 54188.


Blacklist bypass issue exists in WUZHI CMS up to and including 4.1.0 in common.func.php which when uploaded can cause remote code executiong.


An issue was discovered in Typora 0.9.67. There is an XSS vulnerability that causes Remote Code Execution.


In ProFTPD 1.3.7 it is possible to corrupt the memory pool by interrupting the data transfer channel. This triggers a use-after-free in alloc_pool in pool.c and possible remote code execution.


Umbraco CMS 8.5.3 allows an authenticated file upload (and consequently Remote Code Execution) via the Install Package functionality.