4039 matches found
Command Injection in meta-git
All versions of meta-git are vulnerable to Command Injection. The package fails to sanitize input and passes it directly to an exec call, which may allow attackers to execute arbitrary code in the system. The clone command is vulnerable through the branch name. Recommendation No fix is currently...
GHSA-7R9X-HR76-JR96 Command Injection in giting
All versions of gitting are vulnerable to Command Injection. The package fails to sanitize input and passes it directly to an exec call, which may allow attackers to execute arbitrary code in the system. The pull function is vulnerable through the branch variable. Recommendation No fix is current...
OS Command Injection
node-wifi is vulnerable to OS command injection. The vulnerability exists through the unsanitized value of ssid used in exec...
Command Injection in bestzip
Versions of bestzip prior to 2.1.7 are vulnerable to Command Injection. The package fails to sanitize input rules and passes it directly to an exec call on the zip function . This may allow attackers to execute arbitrary code in the system as long as the values of destination is user-controlled...
PT-2020-21026
Name of the Vulnerable Software and Affected Versions bestzip versions prior to 2.1.7 Description The issue arises from the package's failure to sanitize input rules, which are then passed directly to an exec call on the zip function. This may allow attackers to execute arbitrary code in the syst...
PT-2020-21488
Name of the Vulnerable Software and Affected Versions cocos-utils versions affected versions not specified Description The issue allows for Remote Code Execution. It is caused by the unzip function concatenating user input to exec, which may enable attackers to execute arbitrary commands on the...
PT-2020-21568
Name of the Vulnerable Software and Affected Versions tomato affected versions not specified Description The issue concerns Command Injection. The /api/exec endpoint does not validate user input, allowing attackers to run arbitrary commands in the system. Recommendations At the moment, there is n...
OS Command Injection in adrieankhisbe/bundle-phobia-cli
Description BundlePhobia is a tool to help you find the cost of adding a npm package to your bundle. It enables you to query package sizes. The npm-utils.js has a unsanitized exec function which leads to Arbitrary code execution Proof-of-concept const util = require'./npm-utils.js'; let a =...
ASX To MP3 Converter 3.1.3.7.2010.11.05 Buffer Overflow
Exploit Title: ASX to MP3 converter 3.1.3.7.2010.11.05 - '.wax' Local Buffer Overflow DEP,ASLR Bypass PoC Software Link Download: https://github.com/x00x00x00x00/ASXtoMP3Converter3.1.3.7.2010.11.05/blob/master/ASXtoMP3Converter3.1.3.7.2010.11.05.exe?raw=true Exploit Author: Paras Bhatia Discovery...
Arbitrary Code Execution
windows-edge is vulnerable to arbitrary code execution. The vulnerability exists as the value of opts.uri is passed into exec without sanitization...
ALPINE-CVE-2020-24361
SNMPTT before 1.4.2 allows attackers to execute shell code via EXEC, PREXEC, or unknowntrapexec...
Code injection
SNMPTT before 1.4.2 allows attackers to execute shell code via EXEC, PREXEC, or unknowntrapexec...
UBUNTU-CVE-2020-24361
SNMPTT before 1.4.2 allows attackers to execute shell code via EXEC, PREXEC, or unknowntrapexec...
CVE-2020-24361
SNMPTT before 1.4.2 allows attackers to execute shell code via EXEC, PREXEC, or unknowntrapexec...
CVE-2020-24361: Improper Check for Dropped Privileges
SNMPTT before 1.4.2 allows attackers to execute shell code via EXEC, PREXEC, or unknowntrapexec...
OS Command Injection
git-tags-remote is vulnerable to OS command injection. The vulnerability exists as it does not sanitize the value of repo in index.js, whose value is subsequently passed to an exec call...
Command Injection in git-tags-remote
All versions of git-tags-remote are vulnerable to Command Injection. The package fails to sanitize the repository input and passes it directly to an exec call on the get function . This may allow attackers to execute arbitrary code in the system if the repo value passed to the function is...
GHSA-GM9X-Q798-HMR4 Command Injection in git-tags-remote
All versions of git-tags-remote are vulnerable to Command Injection. The package fails to sanitize the repository input and passes it directly to an exec call on the get function . This may allow attackers to execute arbitrary code in the system if the repo value passed to the function is...
PT-2020-21859
Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description A crash has been reported with a type of UNKNOWN READ. The crash state includes cpu arm exec armeb, tcg cpu exec armeb, and tcg exec all armeb. No...
Remote code execution
The WebControl in RaspberryTortoise through 2012-10-28 is vulnerable to remote code execution via shell metacharacters in a URI. The file nodejs/raspberryTortoise.js has no validation on the parameter incomingString before passing it to the childprocess.exec function...