CVE Vulnerability Catalog

On certain Ubiquiti devices, command injection exists via a GET request to stainfo.cgi (Show AP info) because the ifname variable is not sanitized, allowing shell metacharacters. Fixed versions are v4.0.1 for 802.11 ISP products, v5.3.5 for AirMax ISP products, and v5.4.5 for AirSync firmware. For example, Nanostation5 (Air OS) is affected.

A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Improper validation of recipient address in deliver_message() function in /src/deliver.c may lead to remote command execution.

An Improper Authorization vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5.4.1 to 5.4.10 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to modify the password of an SSL VPN web portal user via specially crafted HTTP requests.

An Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal") in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.3 to 5.6.7 and 5.4.6 to 5.4.12 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to download system files via special crafted HTTP resource requests.

Atlassian Crowd and Crowd Data Center had the pdkinstall development plugin incorrectly enabled in release builds. Attackers who can send unauthenticated or authenticated requests to a Crowd or Crowd Data Center instance can exploit this vulnerability to install arbitrary plugins, which permits remote code execution on systems running a vulnerable version of Crowd or Crowd Data Center. All versions of Crowd from version 2.1.0 before 3.0.5, from version 3.1.0 before 3.1.6, from version 3.2.0 before 3.2.8, from version 3.3.0 before 3.3.5, and from version 3.4.0 before 3.4.4 are affected by this vulnerability.

Deserialization of Untrusted Data in the anti CSRF module in Sitecore through 9.1 allows an authenticated attacker to execute arbitrary code by sending a serialized .NET object in an HTTP POST parameter.

Deserialization of Untrusted Data in the Sitecore.Security.AntiCSRF (aka anti CSRF) module in Sitecore CMS 7.0 to 7.2 and Sitecore XP 7.5 to 8.2 allows an unauthenticated attacker to execute arbitrary code by sending a serialized .NET object in the HTTP POST parameter __CSRFTOKEN.

mailboxd component in Synacor Zimbra Collaboration Suite 8.7.x before 8.7.11p10 has an XML External Entity injection (XXE) vulnerability, as demonstrated by Autodiscover/Autodiscover.xml.

A heap buffer overflow in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.10, 5.4.0 through 5.4.12, 5.2.14 and earlier and FortiProxy 2.0.0, 1.2.8 and earlier in the SSL VPN web portal may cause the SSL VPN web service termination for logged in users due to a failure to properly handle javascript href data when proxying webpages.

A SQL Injection (CWE-89) vulnerability exists in U.motion Builder software version 1.3.4 which could cause unwanted code execution when an improper set of characters is entered.

Citrix Workspace App before 1904 for Windows has an incorrect access control vulnerability, potentially allowing unauthorized access to resources.

A remote code execution vulnerability in the Windows GDI+ interface, caused by improper handling of objects in memory. An attacker could exploit this to execute arbitrary code remotely.

An elevation of privilege vulnerability in Windows Error Reporting (WER), due to improper file handling. A local attacker could exploit this to gain elevated privileges.

A remote code execution vulnerability in Remote Desktop Services allows an unauthenticated attacker to execute code by sending specially crafted requests to the target system via RDP.

The LG N1A1 NAS device is vulnerable to remote command execution via HTTP POST requests with specific parameters, allowing arbitrary code execution.

A buffer overflow vulnerability in the WhatsApp VOIP stack allows remote code execution via specially crafted RTCP packets sent to a target phone number.

A vulnerability in Pulse Connect Secure allows an unauthenticated remote attacker to read arbitrary files by sending a specially crafted URI.

A remote code execution vulnerability in the upload.cgi functionality of Sierra Wireless AirLink ES450 (FW 4.9.3). A specially crafted HTTP request can upload a file that can be executed on the webserver.

The ZyXEL P660HN-T1A router has a command injection vulnerability in the Remote System Log forwarding function, accessible by an unauthenticated user via the remote_host parameter on the ViewLog.asp page.

Multiple wireless presentation devices (including Crestron AM-100, Barco wePresent, Extron ShareLink) have a command injection vulnerability in the file_transfer.cgi HTTP endpoint, allowing a remote unauthenticated attacker to execute OS commands as root.