CVE-2021-20198

A flaw was found in the OpenShift Installer. During installation of OpenShift Container Platform 4 clusters, bootstrap nodes are provisioned with anonymous authentication enabled on kubelet port 10250. A remote attacker able to reach this port during installation can make unauthenticated /exec...

PT-2021-28300

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a crash caused by a negative-size-param, which occurs in the mrb str format function, called by mrb f sprintf and mrb vm exec...

PT-2021-24439

Name of the Vulnerable Software and Affected Versions: Singularity versions prior to 3.7.4 Description: The issue arises from the incorrect use of a default URL in singularity action commands, specifically run, shell, and exec, when a container is specified using a library:// URI. This causes the...

PT-2021-24848

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions v5.10 through v5.10.36 Description: The issue is related to a use-after-free in the zynqmp qspi exec op function. This problem was introduced in version v5.10 and is fixed in version v5.10.37. The actual impact and attac...

PT-2021-24751

Name of the Vulnerable Software and Affected Versions Linux Kernel versions v5.10 through v5.12.3 Description The issue is related to a use-after-free in the zynqmp qspi exec op function. This problem was introduced in version v5.10 and is fixed in Linux Kernel version v5.12.4. The actual impact...

PT-2021-28842

Name of the Vulnerable Software and Affected Versions Linux Kernel versions v5.10 through v5.10.36 Description The issue is related to a use-after-free in the zynqmp qspi exec op function. This problem was introduced in version v5.10 and is fixed in version v5.10.37. The actual impact and attack...

CVE-2021-32635

Singularity is an open source container platform. In verions 3.7.2 and 3.7.3, Dde to incorrect use of a default URL, "singularity" action commands "run"/"shell"/"exec" specifying a container using a "library://" URI will always attempt to retrieve the container from the default remote endpoint...

CVE-2021-32635: Improper Restriction of Communication Channel to Intended Endpoints

Singularity is an open source container platform. In verions 3.7.2 and 3.7.3, Dde to incorrect use of a default URL, singularity action commands run/shell/exec specifying a container using a library:// URI will always attempt to retrieve the container from the default remote endpoint...

PT-2021-28277

Name of the Vulnerable Software and Affected Versions: MRuby affected versions not specified Description: The issue is related to a crash caused by an unknown read. Technical details about the crash include the involvement of specific functions such as mrb ary shift m, mrb vm exec, and mrb vm run...

Fuzzing iOS code on macOS at native speed

Or how iOS apps on macOS work under the hood Posted by Samuel Groß, Project Zero This short post explains how code compiled for iOS can be run natively on Apple Silicon Macs. With the introduction of Apple Silicon Macs, Apple also made it possible to run iOS apps natively on these Macs. This is...

PT-2021-6126

Name of the Vulnerable Software and Affected Versions Linux kernel versions through 5.16.10 Description The issue is related to a buffer overflow in the Linux kernel, which can be exploited by a remote attacker to execute arbitrary code. Certain binary files built around 2003, for example with GC...

OS Command Injection in mversion

The issue occurs because tagName user input is formatted inside the exec function is executed without any checks...

GHSA-6M8P-4FXJ-PGC2 OS Command Injection in mversion

The issue occurs because tagName user input is formatted inside the exec function is executed without any checks...

Microweber CMS 1.1.20 Remote Code Execution

Exploit Title: Microweber CMS 1.1.20 - Remote Code Execution Authenticated Date: 2020-10-31 Exploit Author: sl1nki Vendor Homepage: https://microweber.org/ Software Link: https://github.com/microweber/microweber/tree/1.1.20 Version: " . shellexec$REQUEST"fexec" . ""; ?' Notes: SSL verification is...

OS Command Injection in pulverizr

pulverizr through 0.7.0 allows execution of arbitrary commands. Within lib/job.js, the variable filename can be controlled by the attacker. This function uses the variable "filename" to construct the argument of the exec call without any sanitization. In order to successfully exploit this...

GHSA-F8FH-8RGM-227H OS Command Injection in node-prompt-here

node-prompt-here through 1.0.1 allows execution of arbitrary commands. The runCommand is called by getDevices function in file linux/manager.js, which is required by the index. process.env.NMCLI in the file linux/manager.js. This function is used to construct the argument of function execSync,...

GHSA-G4HJ-R7R3-9RWV OS Command Injection in gulp-scss-lint

gulp-scss-lint through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands to the "exec" function located in "src/command.js" via the provided options...

OS Command Injection in docker-compose-remote-api

docker-compose-remote-api through 0.1.4 allows execution of arbitrary commands. Within index.js of the package, the function execserviceName, cmd, fnStdout, fnStderr, fnExit uses the variable serviceName which can be controlled by users without any sanitization...

Command Injection in ps-visitor

This affects all versions up to and including version 0.0.2 of package ps-visitor. If attacker-controlled user input is given to the kill function, it is possible for an attacker to execute arbitrary commands. This is due to use of the childprocess exec function without input sanitization...

GHSA-V2JV-33GH-XX29 Command Injection in ps-visitor

This affects all versions up to and including version 0.0.2 of package ps-visitor. If attacker-controlled user input is given to the kill function, it is possible for an attacker to execute arbitrary commands. This is due to use of the childprocess exec function without input sanitization...