MAL-2025-6369 Malicious code in proc-log-cmd (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ef3082ede726543b5e19f768b9c6630da020446b5902205ab679184c0cac0c03 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in proc-log-cmd (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ef3082ede726543b5e19f768b9c6630da020446b5902205ab679184c0cac0c03 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-54414

Anubis is a Web AI Firewall Utility that weighs the soul of users' connections using one or more challenges in order to protect upstream resources from scraper bots. In versions 1.21.2 and below, attackers can craft malicious pass-challenge pages that cause a user to execute arbitrary JavaScript...

Linux kernel Heap Buffer Overflow DoS

The vulnerability of the core.c, fabrics-cmd-auth.c, and fabrics-cmd.c components of the Linux operating system’s kernel is related to a resource leak. Exploiting this vulnerability can allow an attacker to cause service failures...

kernel: dm ioctl: prevent potential spectre v1 gadget

A vulnerability was found in the Linux kernel's dm-ioctl interface in the lookupioctl function, which accepts a user-provided cmd value that is used to index the ioctls array directly. This issue could lead to an out-of-bounds access if the CPU speculatively executes the array access before cmd i...

libshare-0.0.26.so Heap Buffer Overflow DoS

The vulnerability of the bssetCmd function in the libshare-0.0.26.so library of the LB-LINK router software lies in the failure to take data cleaning measures at the control level when processing the cmd parameter. Exploiting this vulnerability allows a remote attacker to execute arbitrary comman...

TOTOLINK EX1200T Router boa Server Command Injection

The vulnerability of the built-in server boa /boafrm/formSysCmd of the TOTOLINK EX1200T router’s microprogramming system lies in the execution of operations beyond the buffer in memory. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and...

kernel: Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix slab-use-after-free Read in l2capsendcmd After the hci sync command releases l2capconn, the hci receive data work queue references the released l2capconn when sending to the upper layer. Add hci dev lock to...

CVE-2025-45988

Blink routers BL-WR9000 V2.4.9 , BL-AC2100AZ3 V1.0.4, BL-X10AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200AT1 v1.0.0, BL-X26AC8 v1.2.8, BLAC450MAE4 v4.0.0 and BL-X26DA3 v1.2.7 were discovered to contain multiple command injection vulnerabilities via the cmd parameter in the bsSetCmd function...

Dell ControlVault3和Dell ControlVault3 Plus 代码问题漏洞

Dell ControlVault3 and Dell ControlVault3 Plus are both hardware-based security solutions from Dell, Inc. A code issue vulnerability exists in Dell ControlVault3 versions prior to 5.15.10.14 and Dell ControlVault3 Plus versions prior to 6.2.26.36, which stems from a deserialization vulnerability ...

CVE-2025-45988: Improper Neutralization of Special Elements used in a Command

Blink routers BL-WR9000 V2.4.9 , BL-AC2100AZ3 V1.0.4, BL-X10AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200AT1 v1.0.0, BL-X26AC8 v1.2.8, BLAC450MAE4 v4.0.0 and BL-X26DA3 v1.2.7 were discovered to contain multiple command injection vulnerabilities via the cmd parameter in the bsSetCmd function...

CVE-2025-45988

Several LB-LINK (Blink) routers are vulnerable to command injection due to a failure to implement proper data cleaning measures when processing the cmd parameter in the bs_SetCmd function within the libshare-0.0.26.so library. Affected products and versions include BL-WR9000 V2.4.9 , BL-AC2100_AZ...

Linux kernel mlx5 DoS

The vulnerability of the net/mlx5 component in the Linux operating system’s kernel is related to incorrect blocking in the cmdworkhandler function in drivers/net/ethernet/mellanox/mlx5/core/cmd.c. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2025-5492

A vulnerability has been found in D-Link DI-500WF-WT up to 20250511 and classified as critical. Affected by this vulnerability is the function sub456DE8 of the file /mspinfo.htm?flag=cmd of the component /usr/sbin/jhttpd. The manipulation of the argument cmd leads to command injection. The attack...

CVE-2025-41650

An unauthenticated remote attacker can exploit input validation in cmd services of the devices, allowing them to disrupt system operations and potentially cause a denial-of-service...

CVE-2025-41650: Improper Validation of Specified Type of Input

An unauthenticated remote attacker can exploit input validation in cmd services of the devices, allowing them to disrupt system operations and potentially cause a denial-of-service...

CVE-2025-5127

A vulnerability was determined in Teledyne FLIR AX8 up to 1.46.16. This issue affects some unknown processing of the file /prod.php. Executing manipulation of the argument cmd can lead to cross site scripting. The attack may be launched remotely. The exploit has been publicly disclosed and may be...

PT-2025-22842 · Flir · Flir Ax8

Name of the Vulnerable Software and Affected Versions: FLIR AX8 versions up to 1.46.16 Description: A problematic issue has been found in the processing of the file /prod.php, where the manipulation of the cmd argument leads to cross-site scripting. This issue can be exploited remotely...

Teledyne FLIR AX8 跨站脚本漏洞

Teledyne FLIR AX8 is a series of thermal surveillance cameras from Teledyne FLIR USA. A cross-site scripting vulnerability exists in Teledyne FLIR AX8 version 1.46.16 and earlier, which stems from a cross-site scripting attack due to the incorrect operation of the parameter cmd in the file...

CVE-2025-5127: Improper Neutralization of Input During Web Page Generation

A vulnerability was determined in Teledyne FLIR AX8 up to 1.46.16. This issue affects some unknown processing of the file /prod.php. Executing manipulation of the argument cmd can lead to cross site scripting. The attack may be launched remotely. The exploit has been publicly disclosed and may be...