PT-2021-11530

Name of the Vulnerable Software and Affected Versions: wc-cmd versions all Description: The issue concerns command injection via the index.js file in the wc-cmd package. An example of exploitation is provided using the require function to execute a command, such as touch JHU. Recommendations: For...

3di-cmd-client (>=0.0.1a0, <=0.0.3), aboutcode (3.0.0.dev3) +891 more potentially affected by CVE-2020-28493 via jinja2 (>=2.7.2, <=2.11.2)

jinja2 PYPI version =2.7.2, =0.0.1a0, =0.0.0, =0.4.0, =0.0.1, =0.2.0, =0.0.3, =1.0.0, =2022.9.19, =0.2.0, =0.5.1, =0.2.0, =0.5.0 and more Source cves: CVE-2020-28493 Source advisory: MEND:CVE-2020-28493...

PT-2021-7251

Name of the Vulnerable Software and Affected Versions Infiray IRAY-A8Z3 version 1.0.957 Description The issue is related to the webserver of the Infiray IRAY-A8Z3, which contains an endpoint that can execute arbitrary commands. This can be achieved by manipulating the cmd string URL parameter. Th...

CVE-2021-3115

A flaw was found in golang: cmd/go, in which Go can execute arbitrary commands at build time when cgo is in use on Windows OS. On Linux/Unix, only users who have "." listed explicitly in their PATH variable are affected. The highest threat from this vulnerability is to data confidentiality and...

PT-2021-19281

Name of the Vulnerable Software and Affected Versions Open-iSCSI tcmu-runner versions 1.3.x through 1.5.2 Description The issue allows remote attackers to read or write files via directory traversal in an XCOPY request, due to a lack of check for transport-layer restrictions in the xcopy locate...

UBUNTU-CVE-2020-27637

The R programming language’s default package manager CRAN is affected by a path traversal vulnerability that can lead to server compromise. This vulnerability affects packages installed via the R CMD install cli command or the install.packages function from the interpreter. Update to version 4.0....

CVE-2020-27637: Improper Limitation of a Pathname to a Restricted Directory

The R programming language’s default package manager CRAN is affected by a path traversal vulnerability that can lead to server compromise. This vulnerability affects packages installed via the R CMD install cli command or the install.packages function from the interpreter. Update to version 4.0....

CVE-2020-27637

The CVE-2020-27637 entry concerns the R language’s default package manager CRAN, affected by a path traversal vulnerability that can lead to server compromise. Affected are packages installed via the R CMD install CLI or install.packages(), with the underlying issue described as a path traversal ...

Command injection

Barco TransForm N before 3.8 allows Command Injection issue 2 of 4. The NDN-210 has a web administration panel which is made available over https. There is a command injection issue that will allow authenticated users of the administration panel to perform authenticated remote code execution. An...

PT-2021-12999

Name of the Vulnerable Software and Affected Versions: Android versions Android-8.0 through Android-11 Description: The issue is related to a possible out of bounds write in the avrc pars vendor cmd function due to a missing bounds check. This could lead to remote code execution over Bluetooth wi...

CVE-2020-24581

An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU2.31V1.1.47ae55. It contains an executecmd.cgi feature that is not reachable via the web user interface that lets an authenticated user execute Operating System commands...

Pulse Secure VPN Remote Code Execution Exploit

The Pulse Connect Secure appliance versions prior to 9.1R9 suffer from an uncontrolled gzip extraction vulnerability which allows an attacker to overwrite arbitrary files, resulting in remote code execution as root. Admin credentials are required for successful exploitation...

CVE-2020-27036

In phNxpNciHalsendextcmd of phNxpNciHalext.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege in the NFC server with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersion...

PT-2020-16626

Name of the Vulnerable Software and Affected Versions Android versions Android-11 Description In the rw i93 send cmd write multi blocks function of rw i93.cc, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional...

Command Injection

Amendment This was deemed not a vulnerability. Overview Affected versions of this package are vulnerable to Command Injection via the index.js file. PoC: var a =require"wc-cmd"; a"touch JHU" Note: CVE-2020-28431 has been retracted because it was found to be invalid. Remediation There is no fixed...

CVE-2020-25705

A flaw in the way reply ICMP packets are limited in the Linux kernel functionality was found that allows to quickly scan open UDP ports. This flaw allows an off-path remote user to effectively bypassing source port UDP randomization. The highest threat from this vulnerability is to confidentialit...

SUSE SLED15 / SLES15 Security Update : go1.15 (SUSE-SU-2020:3368-1)

This update for go1.15 fixes the following issues : go1.15.5 released 2020-11-12 includes security fixes to the cmd/go and math/big packages. - go42553 math/big: panic during recursive division of very large numbers bsc1178750 CVE-2020-28362 - go42560 cmd/go: arbitrary code can be injected into c...

SUSE SLED15 / SLES15 Security Update : go1.14 (SUSE-SU-2020:3369-1)

This update for go1.14 fixes the following issues : go1.14.12 released 2020-11-12 includes security fixes to the cmd/go and math/big packages. - go42553 math/big: panic during recursive division of very large numbers bsc1178750 CVE-2020-28362 - go42560 cmd/go: arbitrary code can be injected into...

openSUSE Security Update : go1.15 (openSUSE-2020-2139)

This update for go1.15 fixes the following issues : - go1.15.5 released 2020-11-12 includes security fixes to the cmd/go and math/big packages. - go42553 math/big: panic during recursive division of very large numbers bsc1178750 CVE-2020-28362 - go42560 cmd/go: arbitrary code can be injected into...

Security update for go1.15 (moderate)

openSUSE Security Update: Security update for go1.15 Announcement ID: openSUSE-SU-2020:2139-1 Rating: moderate References: 1175132 1178750 1178752 1178753 Cross-References: CVE-2020-28362 CVE-2020-28366 CVE-2020-28367 Affected Products: openSUSE Leap 15.2 An update that solves three vulnerabiliti...