CVE-2020-7596

Codecov npm module before 3.6.2 allows remote attackers to execute arbitrary commands via the "gcov-args" argument...

CVE-2020-7596: Improper Neutralization of Special Elements used in an OS Command

Codecov npm module before 3.6.2 allows remote attackers to execute arbitrary commands via the "gcov-args" argument...

PT-2020-19644

Name of the Vulnerable Software and Affected Versions Codecov npm module versions prior to 3.6.2 Description The issue allows remote attackers to execute arbitrary commands via the gcov-args argument. This enables attackers to potentially gain control over the system. Recommendations For versions...

PT-2020-10255

Name of the Vulnerable Software and Affected Versions Ruckus Unleashed versions through 200.7.10.102.64 Description A stack-based buffer overflow in zap parse args in zap.c allows remote code execution via an unauthenticated HTTP request. Recommendations For versions through 200.7.10.102.64, upda...

Command Injection

Overview codecov is a npm package for uploading reports to Codecov. Affected versions of this package are vulnerable to Command Injection. The value provided as part of the gcov-args argument is executed by the exec function within lib/codecov.js. PoC by JHU System Security Lab var root =...

PT-2019-20255

Name of the Vulnerable Software and Affected Versions OPENAFS versions prior to 1.8.5 Description The issue concerns errors in server RPC args handling and other bugs. It is recommended to update to address these issues. Recommendations For versions prior to 1.8.5, update to security-release 1.8....

OPENSUSE-SU-2019:2607-1 Recommended update for openafs

This update for openafs fixes the following issues: Update to security-release 1.8.5, adresses: OPENAFS-SA-2019-001: Skip server OUT args on error OPENAFS-SA-2019-002: Zero all server RPC args OPENAFS-SA-2019-003: ubik: Avoid unlocked ubikcurrentTrans deref update to official version 1.8.4 suppor...

PT-2019-20104

Name of the Vulnerable Software and Affected Versions openafs versions prior to 1.8.5 Description The issue is related to several security concerns, including skipping server OUT args on error, zeroing all server RPC args, and avoiding unlocked ubik currentTrans deref. These issues are addressed ...

PT-2019-15801

Name of the Vulnerable Software and Affected Versions typed ast versions 1.3.0 through 1.3.1 Description The issue is related to an out-of-bounds read in the handle keywordonly args function. An attacker who can cause a Python interpreter to parse Python source, but not necessarily execute it, ma...

PT-2019-20147

Name of the Vulnerable Software and Affected Versions typed ast versions 1.3.0 through 1.3.1 Description The issue is related to an out-of-bounds read in the handle keywordonly args function. An attacker who can cause a Python interpreter to parse Python source, but not necessarily execute it, ma...

Cross site scripting

In FusionPBX up to v4.5.7, the file resources\paging.php has a paging function called by several pages of the interface, which uses an unsanitized "param" variable constructed partially from the URL args and reflected in HTML, leading to XSS...

CVE-2019-16983: Improper Neutralization of Input During Web Page Generation

In FusionPBX up to v4.5.7, the file resources\paging.php has a paging function called by several pages of the interface, which uses an unsanitized "param" variable constructed partially from the URL args and reflected in HTML, leading to XSS...

The vulnerability of the `parse_arguments` function in the rsyncd server’s Rsync utility allows users to compromise data integrity.

The vulnerability of the parsearguments function in the rsyncd utility’s options.c file of the rsync server is related to the possibility of using multiple protect-args parameters. This allows attackers to circumvent existing security mechanisms. Exploiting this vulnerability could enable a remot...

PT-2018-15095

Name of the Vulnerable Software and Affected Versions jiacrontab version 1.4.5 Description The issue allows remote attackers to execute arbitrary commands. This can be achieved via the crontab/task/edit API endpoint, specifically by manipulating the command and args parameters in the POST data. F...

UBUNTU-CVE-2018-18408

A use-after-free was discovered in the tcpbridge binary of Tcpreplay 4.3.0 beta1. The issue gets triggered in the function postargs at tcpbridge.c, causing a denial of service or possibly unspecified other impact...

PT-2018-14444

Name of the Vulnerable Software and Affected Versions Tcpreplay version 4.3.0 beta1 Description A use-after-free issue was discovered in the tcpbridge binary, specifically in the function post args at tcpbridge.c. This issue can cause a denial of service or possibly other unspecified impacts...

PT-2018-14210

Name of the Vulnerable Software and Affected Versions REDAXO version 5.6.2 Description The issue concerns the $args variable in the addons/mediapool/pages/index.php file, where names are not restricted, allowing an attacker to insert XSS payloads. This can be achieved via the...

CVE-2018-8711

A local file inclusion issue was discovered in the WooCommerce Products Filter aka WOOF plugin before 2.2.0 for WordPress, as demonstrated by the shortcode parameter in a woofredrawwoof action. The vulnerability is due to the lack of args/input validation on renderhtml before allowing it to be...

PT-2018-1905 · Rsync +3 · Rsync +3

Name of the Vulnerable Software and Affected Versions: rsync versions prior to 3.1.3 Description: The issue is related to the parse arguments function in options.c in rsyncd, which does not prevent multiple uses of the --protect-args parameter. This allows remote attackers to bypass an...

gtk-vnc security, bug fix, and enhancement update

0.7.0-2 - Fix reserved data size rhbz 1416783 - Fix inverted args in tests rhbz 1416783 - Avoid sign extension problems rhbz 1416783 - Fix crash with opening via GSocketAddress rhbz 1416783 - Fix crash & error reporting during connection timeout rhbz 1441120 - Fix incompatibility with libvncserve...