PT-2023-5663

Name of the Vulnerable Software and Affected Versions yt-dlp versions 2021.04.11 through 2023.09.23 Description The issue arises from the improper escaping of special characters in shell commands executed through the --exec flag, allowing for remote code execution if used with maliciously crafted...

CVE-2023-40581: Improper Neutralization of Special Elements used in an OS Command

yt-dlp is a youtube-dl fork with additional features and fixes. yt-dlp allows the user to provide shell command lines to be executed at various stages in its download steps through the --exec flag. This flag allows output template expansion in its argument, so that metadata values may be used in...

CVE-2023-40581

yt-dlp is a youtube-dl fork with additional features and fixes. yt-dlp allows the user to provide shell command lines to be executed at various stages in its download steps through the --exec flag. This flag allows output template expansion in its argument, so that metadata values may be used in...

Important: golang

Issue Overview: An out of bounds read vulnerability was found in debug/macho of the Go standard library. When using the debug/macho standard library stdlib and malformed binaries are parsed using Open or OpenFat, it can cause golang to attempt to read outside of a slice array causing a panic when...

CVE-2023-36109

Removed by vendor...

CVE-2023-41887 Remote Code exec in project import with mysql jdbc url attack

OpenRefine is a powerful free, open source tool for working with messy data. Prior to version 3.7.5, a remote code execution vulnerability allows any unauthenticated user to execute code on the server. Version 3.7.5 has a patch for this issue...

CVE-2023-41887 Remote Code exec in project import with mysql jdbc url attack

OpenRefine is a powerful free, open source tool for working with messy data. Prior to version 3.7.5, a remote code execution vulnerability allows any unauthenticated user to execute code on the server. Version 3.7.5 has a patch for this issue...

DEBIAN-CVE-2023-36479

Eclipse Jetty Canonical Repository is the canonical repository for the Jetty project. Users of the CgiServlet with a very specific command structure may have the wrong command executed. If a user sends a request to a org.eclipse.jetty.servlets.CGI Servlet for a binary with a space in its name, th...

UBUNTU-CVE-2023-36479

Eclipse Jetty Canonical Repository is the canonical repository for the Jetty project. Users of the CgiServlet with a very specific command structure may have the wrong command executed. If a user sends a request to a org.eclipse.jetty.servlets.CGI Servlet for a binary with a space in its name, th...

Sql injection

A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0 and classified as critical. This issue affects the function exec of the file booking.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been...

Command Injection Vulnerability in find-exec

Older versions of the package are vulnerable to Command Injection as an attacker controlled parameter. As a result, attackers may run malicious commands. For example: const find = require"find-exec"; find"mplayer; touch hacked" This creates a file named "hacked" on the filesystem. You should neve...

currentrequest (>=1.0.0, <=1.0.6), daichainai-moi (>=1.0.0, <=1.0.2) +5 more potentially affected by CVE-2023-40582 via find-exec (>=1.0.0, <=1.0.2)

find-exec NPM version =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.15, =1.1.2, =1.1.5 Source cves: CVE-2023-40582 Source advisory: OSV:GHSA-95RP-6GQP-6622...

CVE-2023-40582

find-exec is a utility to discover available shell commands. Versions prior to 1.0.3 did not properly escape user input and are vulnerable to Command Injection via an attacker controlled parameter. As a result, attackers may run malicious shell commands in the context of the running process. This...

CVE-2023-40582

The CVE pertains to the find-exec utility, where earlier versions (prior to 1.0.3) fail to properly escape user input, enabling Command Injection via attacker-controlled parameters. This could allow an attacker to run arbitrary shell commands with the privileges of the running process. The issue ...

CVE-2023-40582 Command Injection Vulnerability in find-exec

find-exec is a utility to discover available shell commands. Versions prior to 1.0.3 did not properly escape user input and are vulnerable to Command Injection via an attacker controlled parameter. As a result, attackers may run malicious shell commands in the context of the running process. This...

CVE-2023-40582 Command Injection Vulnerability in find-exec

find-exec is a utility to discover available shell commands. Versions prior to 1.0.3 did not properly escape user input and are vulnerable to Command Injection via an attacker controlled parameter. As a result, attackers may run malicious shell commands in the context of the running process. This...

find-exec 操作系统命令注入漏洞

find-exec is a shime personal developer that takes a list of shell commands and returns the first available command. An operating system command injection vulnerability exists in find-exec versions prior to 1.0.3, which stems from the inability to properly escape user input and the ease with whic...

CVE-2023-40582: Improper Neutralization of Special Elements used in an OS Command

find-exec is a utility to discover available shell commands. Versions prior to 1.0.3 did not properly escape user input and are vulnerable to Command Injection via an attacker controlled parameter. As a result, attackers may run malicious shell commands in the context of the running process. This...

PT-2023-27519

Name of the Vulnerable Software and Affected Versions find-exec versions prior to 1.0.3 Description The issue is related to Command Injection, where attackers may run malicious shell commands in the context of the running process due to improper escaping of user input. This can be achieved via an...

Arbitrary Code Execution

llama-index is vulnerable to Arbitrary Code Execution. The vulnerability exists because of the improper handling of user input in the PandasQueryEngine function of the library, which allows an attacker to inject and execute malicious code due to the usage of the exec function...