CVE-2019-12132

An issue was discovered in ONAP SDNC before Dublin. By executing sla/dgUpload with a crafted filename parameter, an unauthenticated attacker can execute an arbitrary command. All SDC setups that include admportal are affected...

gulp-tape injection vulnerability

gulp-tape is a package that supports running Tape tests in Gulp. An injection vulnerability exists in gulp-tape 1.0.0 and earlier versions, which can be exploited by an attacker to execute arbitrary commands...

Pulverizr Injection Vulnerability

pulverizr is an image compressor. A security vulnerability exists in pulverizr 0.7.0 and earlier versions, which stems from a failure to perform any cleanup on the 'filename' parameter, which is directly used by the function. The vulnerability can be exploited to execute arbitrary commands...

docker-compose-remote-api injection vulnerability

docker-compose-remote-api is a connection interface between Docker-Compose and the Docker Remote API. An injection vulnerability exists in docker-compose-remote-api 0.1.4 and earlier versions, which stems from the 'execserviceName, cmd, fnStdout, fnStderr, fnExit' function failing to clean up. Th...

node-prompt-here injection vulnerability

node-prompt-here is a package for opening a console window in a given directory. A security vulnerability exists in node-prompt-here 1.0.1 and earlier versions. An attacker can exploit this vulnerability to execute arbitrary commands...

gulp-scss-lint injection vulnerability

gulp-scss-lint is a configurable package of code cleaning tools. A security vulnerability exists in gulp-scss-lint 1.0.0 and earlier versions. An attacker can exploit the vulnerability to inject and execute arbitrary commands...

closure-compiler-stream injection vulnerability

closure-compiler-stream is a stream interface to a closure compiler. A security vulnerability exists in closure-compiler-stream version 0.1.15 and earlier, which stems from the program failing to perform any cleanup operations on the user-controllable 'options' parameter. An attacker could use th...

Mozilla: Devtools' 'Copy as cURL' feature did not fully escape website-controlled data, potentially leading to command injection

The Mozilla Foundation Security Advisory describes this flaw as: The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP method of a request, which can be controlled by the website. If a user used the 'Copy as Curl' feature and pasted the command into a terminal, it...

GLSA-202003-27 : libssh: Arbitrary command execution

The remote host is affected by the vulnerability described in GLSA-202003-27 libssh: Arbitrary command execution It was discovered that libssh incorrectly handled certain scp commands. Impact : A remote attacker could trick a victim into using a specially crafted scp command, possibly resulting i...

CVE-2020-7603

closure-compiler-stream through 0.1.15 allows execution of arbitrary commands. The argument "options" of the exports function in "index.js" can be controlled by users without any sanitization...

CVE-2020-7606

docker-compose-remote-api through 0.1.4 allows execution of arbitrary commands. Within 'index.js' of the package, the function 'execserviceName, cmd, fnStdout, fnStderr, fnExit' uses the variable 'serviceName' which can be controlled by users without any sanitization...

CVE-2020-7604

pulverizr through 0.7.0 allows execution of arbitrary commands. Within "lib/job.js", the variable "filename" can be controlled by the attacker. This function uses the variable "filename" to construct the argument of the exec call without any sanitization. In order to successfully exploit this...

CVE-2020-7601

gulp-scss-lint through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands to the "exec" function located in "src/command.js" via the provided options...

CVE-2020-7602

node-prompt-here through 1.0.1 allows execution of arbitrary commands. The "runCommand" is called by "getDevices" function in file "linux/manager.js", which is required by the "index. process.env.NMCLI" in the file "linux/manager.js". This function is used to construct the argument of function...

CVE-2020-7605

gulp-tape through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands as part of 'gulp-tape' options...

CVE-2020-7604

pulverizr through 0.7.0 allows execution of arbitrary commands. Within "lib/job.js", the variable "filename" can be controlled by the attacker. This function uses the variable "filename" to construct the argument of the exec call without any sanitization. In order to successfully exploit this...

CVE-2020-7606

docker-compose-remote-api through 0.1.4 allows execution of arbitrary commands. Within 'index.js' of the package, the function 'execserviceName, cmd, fnStdout, fnStderr, fnExit' uses the variable 'serviceName' which can be controlled by users without any sanitization...

CVE-2020-7605

CVE-2020-7605 corresponds to a command-injection flaw in gulp-tape up to version 1.0.0. The vulnerability arises from injecting arbitrary commands via gulp-tape options, enabling potential remote code execution if an attacker can influence those options. Multiple connected sources (Red Hat CVE en...

CVE-2020-7601

CVE-2020-7601 affects gulp-scss-lint up to version 1.0.0. The root cause is command injection through the exec function in src/command.js, allowing an attacker to execute arbitrary commands. Documented impact is remote command execution with high severity (NVD CVSS v3.1 base score 9.8; v2 7.5). M...

libssh: Arbitrary command execution

Background libssh is a multiplatform C library implementing the SSHv2 protocol on client and server side. Description It was discovered that libssh incorrectly handled certain scp commands. Impact A remote attacker could trick a victim into using a specially crafted scp command, possibly resultin...