Dotkliwość: Krytyczna

Kentico contains a failure to validate security headers. This deserialization can led to unauthenticated remote code execution.

Kibana contain an arbitrary code execution flaw in the Timelion visualizer.

Atlassian Confluence Server and Data Center contain a server-side template injection vulnerability that may allow an attacker to achieve path traversal and remote code execution.

Sonatype Nexus Repository Manager before 3.15.0 has an incorrect access control vulnerability. Exploitation allows for remote code execution.

Jenkins Script Security Plugin contains a protection mechanism failure, allowing an attacker to bypass the sandbox.

Jenkins Matrix Project plugin contains a vulnerability which can allow users to escape the sandbox, opening opportunity to perform remote code execution.

Microsoft SharePoint fails to check the source markup of an application package. An attacker who successfully exploits the vulnerability could run remote code in the context of the SharePoint application pool and the SharePoint server farm account.

Luka w integracji ConnectWise ManagedITSync umożliwia zdalne wykonanie poleceń bez uwierzytelnienia.

W Kaseya VSA RMM występuje luka umożliwiająca zdalne wykonanie kodu na zarządzanych urządzeniach.

Niewłaściwe zarządzanie rejestrami w GIGABYTE APP Center umożliwia nieautoryzowany dostęp do MSR.

ThinkPHP "noneCms" contains an unspecified vulnerability that allows for remote code execution through crafted use of the filter parameter.

A code execution vulnerability exists in the Stapler web framework used by Jenkins

Paessler PRTG Network Monitor contains a local file inclusion vulnerability that allows a remote, unauthenticated attacker to create users with read-write privileges (including administrator).

Red Hat JBoss RichFaces Framework contains an expression language injection vulnerability via the UserResource resource. A remote, unauthenticated attacker could exploit this vulnerability to execute malicious code using a chain of Java serialized objects via…

Tenda AC7, AC9, and AC10 devices contain a command injection vulnerability due to the "formsetUsbUnload" function executes a dosystemCmd function with untrusted input. Successful exploitation allows an attacker to execute OS commands via a crafted goform/setUsbUnload request.

Adobe ColdFusion contains an unrestricted file upload vulnerability that could allow for code execution.

NUUO NVRmini devices contain an OS command injection vulnerability. This vulnerability allows remote command execution via shell metacharacters in the uploaddir parameter for a writeuploaddir command.

MikroTik RouterOS through 6.42 allows unauthenticated remote attackers to read arbitrary files and remote authenticated attackers to write arbitrary files due to a directory traversal vulnerability in the WinBox interface.

Wykonanie zdalnego kodu w Drupal 7.x i 8.x może prowadzić do kompromitacji strony.

Dostęp do skryptu w Quest KACE umożliwia anonimowym użytkownikom wykonanie dowolnych poleceń.

Adobe ColdFusion contains a deserialization of untrusted data vulnerability that could allow for code execution.

Dasan GPON Routers contain an authentication bypass vulnerability. When combined with CVE-2018-10562, exploitation can allow an attacker to perform remote code execution.

Dasan GPON Routers contain an authentication bypass vulnerability. When combined with CVE-2018-10561, exploitation can allow an attacker to perform remote code execution.

Oracle WebLogic Server contains an unspecified vulnerability which can allow an unauthenticated attacker with T3 network access to compromise the server.

Luka w Spring Data Commons pozwala na zdalne wykonanie kodu przez nieautoryzowanego użytkownika.