OS Command Injection

standard-version is vulnerable to OS command injection. An attacker is able to inject and execute arbitrary OS commands on the system due to passing of untrusted user input without validation through the exec function...

kernel: perf_event_open() and execve() race in setuid programs allows a data leak

A race condition in perfeventopen allows local attackers to leak sensitive data from setuid programs. As no relevant locks in particular the credguardmutex are held during the ptracemayaccess call, it is possible for the specified target task to perform an execve syscall with setuid execution...

CVE-2020-7688

The issue occurs because tagName user input is formatted inside the exec function is executed without any checks...

CVE-2020-7688

The issue occurs because tagName user input is formatted inside the exec function is executed without any checks...

Code injection

php/exec/escapeshellarg in Locutus PHP through 2.0.11 allows an attacker to achieve code execution...

Design/Logic Flaw

The issue occurs because tagName user input is formatted inside the exec function is executed without any checks...

CVE-2020-13619

php/exec/escapeshellarg in Locutus PHP through 2.0.11 allows an attacker to achieve code execution...

CVE-2020-13619

CVE-2020-13619 affects Locutus PHP before or through 2.0.11, where the php/exec/escapeshellarg call can be abused to achieve code execution. The vulnerability impacts Locutus PHP 2.0.11 and earlier. Root cause is improper handling of shell arguments in escapeshellarg within Locutus. Documents ide...

CVE-2020-7688 Command Injection

The issue occurs because tagName user input is formatted inside the exec function is executed without any checks...

CVE-2020-7688

The CVE-2020-7688 issue affects the npm package mversion . The vulnerability arises because the value of the input field tagName is formatted into a call to exec() without validation, enabling potential command injection. A proof-of-concept demonstrates injecting shell commands via tagName, illus...

CVE-2020-7688

The issue occurs because tagName user input is formatted inside the exec function is executed without any checks...

PT-2020-19711

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided descriptions. Description The issue arises due to the execution of user input, specifically tagName, within an exec function without proper checks. This lack of validation allows...

PT-2020-22248

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a crash type of Use-of-uninitialized-value. The crash state involves several functions: ht copy, mrb hash dup, and mrb vm exec. No...

CVE-2020-7688: Improper Neutralization of Special Elements used in an OS Command

The issue occurs because tagName user input is formatted inside the exec function is executed without any checks...

CVE-2020-13619: Improper Neutralization of Special Elements used in an OS Command

php/exec/escapeshellarg in Locutus PHP through 2.0.11 allows an attacker to achieve code execution...

The vulnerability of the exec function in the npm-programmatic package manager NPM allows a hacker to execute arbitrary code.

The vulnerability of the exec function in the npm-programmatic package manager NPM is related to the lack of security measures for handling web page structures. Exploiting this vulnerability allows an attacker to execute arbitrary code by sending a specially crafted malicious package...

CVE-2020-9656

CVE-2020-9656 affects Adobe Premiere Rush

Command Injection

Overview mversion is a cross packaging manager module version handler/bumper. Affected versions of this package are vulnerable to Command Injection. The issue occurs because tagName user input is formatted inside the exec function is executed without any checks. PoC: var mversion =...

Command Injection in umount

All versions of umount are vulnerable to Command Injection. The package fails to sanitize input rules and passes it directly to an exec call on the umount function . This may allow attackers to execute arbitrary code in the system if the device value passed to the function is user-controlled...

CVE-2020-13978

Monstra CMS 3.0.4 allows an attacker, who already has administrative access to modify .chunk.php files on the Edit Chunk screen, to execute arbitrary OS commands via the Theme Module by visiting the admin/index.php?id=themes&action=editchunk URI. NOTE: there is no indication that the Edit Chunk...