CVE Vulnerability Catalog

A remote code execution vulnerability in Microsoft Exchange Server allows an attacker to execute arbitrary code on the server.

Microsoft Exchange Server contains a remote code execution vulnerability. This vulnerability can be exploited by an attacker to execute arbitrary code on the server.

A vulnerability exists in the SHA authentication scheme in Veritas Backup Exec before 21.2. An attacker can gain unauthorized access and execute arbitrary commands with system privileges.

A vulnerability exists in the SHA authentication scheme in Veritas Backup Exec before 21.2, which had not been disabled. An attacker could remotely exploit this scheme to gain unauthorized access to an Agent and execute privileged commands.

A vulnerability exists in the SHA authentication scheme in Veritas Backup Exec before 21.2. An attacker can gain unauthorized access and, using crafted input parameters, access an arbitrary file on the system with System privileges.

A vulnerability in the Win32k component of Windows allows elevation of privilege. An attacker could exploit it to gain higher privileges on the system.

The vSphere Client (HTML5) contains an SSRF (Server Side Request Forgery) vulnerability due to improper validation of URLs in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue by sending a POST request to vCenter Server plugin leading to information disclosure.

The vSphere Client (HTML5) contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server. This affects VMware vCenter Server (7.x before 7.0 U1c, 6.7 before 6.7 U3l and 6.5 before 6.5 U3n) and VMware Cloud Foundation (4.x before 4.2 and 3.x before 3.10.1.2).

Accellion FTA 9_12_370 and earlier is affected by OS command execution via a crafted POST request to various admin endpoints. The fixed version is FTA_9_12_380 and later.

Accellion FTA 9_12_411 and earlier is affected by SSRF via a crafted POST request to wmProgressstat.html. The fixed version is FTA_9_12_416 and later.

Accellion FTA 9_12_411 and earlier is affected by OS command execution via a local web service call. The fixed version is FTA_9_12_416 and later.

Accellion FTA 9_12_370 and earlier is affected by SQL injection via a crafted Host header in a request to document_root.html. The fixed version is FTA_9_12_380 and later.

The systeminformation library for Node.js before version 5.3.1 contains a command injection vulnerability. The issue was fixed in version 5.3.1.

Nagios XI version xi-5.7.5 is affected by OS command injection due to improper sanitization of authenticated user input in the file /usr/local/nagiosxi/html/includes/configwizards/cloud-vm/cloud-vm.inc.php.

A vulnerability in Nagios XI version xi-5.7.5 allows OS command injection. The issue exists in the switch.inc.php file due to improper sanitization of authenticated user input.

Nagios XI version xi-5.7.5 is affected by OS command injection in the file windowswmi.inc.php due to improper sanitization of authenticated user input. This allows execution of arbitrary commands on the server.

Adminer, an open-source database management tool in a single PHP file, versions 4.0.0 through 4.7.9 contain a server-side request forgery (SSRF) vulnerability. This affects versions bundling all drivers (e.g., adminer.php). The vulnerability is fixed in version 4.7.9.

Adobe Acrobat Reader DC versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier), and 2017.011.30188 (and earlier) are affected by a heap-based buffer overflow vulnerability. An unauthenticated attacker could exploit this to achieve arbitrary code execution in the context of the current user. Exploitation requires user interaction, such as opening a malicious file.

McAfee Total Protection (MTP) prior to 16.0.30 contains an arbitrary process execution vulnerability. A local user can gain elevated privileges and execute arbitrary code by bypassing MTP self-defense.

Google Chrome prior to 88.0.4324.150 contains a heap buffer overflow in V8. A remote attacker could potentially exploit heap corruption via a crafted HTML page.