Updated firefox packages fix security vulnerabilities

Updated firefox packages fix security vulnerabilities: The inputs to sctploadaddressesfrominit are verified by sctparethereunrecognizedparameters; however, the two functions handled parameter bounds differently, resulting in out of bounds reads when parameters are partially outside a chunk...

[ASA-202003-10] okular: arbitrary command execution

Arch Linux Security Advisory ASA-202003-10 ========================================== Severity: Low Date : 2020-03-13 CVE-ID : CVE-2020-9359 Package : okular Type : arbitrary command execution Remote : Yes Link : https://security.archlinux.org/AVG-1113 Summary ======= The package okular before...

The vulnerability of the diagnostic script of the microprogramming software for wireless access points in industrial systems, Moxa AWK-3131A, allows a intruder to execute arbitrary commands.

The vulnerability of the diagnostic script of the microprogramming software for wireless access points in Moxa AWK-3131A systems exists due to the lack of measures taken to neutralize the special elements used in the operating system commands. Exploiting this vulnerability allows a malicious acto...

Design/Logic Flaw

Blamer versions prior to 1.0.1 allows execution of arbitrary commands. It is possible to inject arbitrary commands as part of the arguments provided to blamer...

CVE-2020-6811

The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP method of a request, which can be controlled by the website. If a user used the 'Copy as Curl' feature and pasted the command into a terminal, it could have resulted in command injection and arbitrary command...

Mozilla Firefox/Firefox ESR Command Injection Vulnerability

Mozilla Firefox is a free, open-source browser for Windows, Linux, and MacOSX. firefox ESR refers to the Extended Support Release of Firefox, which was created by mozilla specifically for organizations that can't or don't want to upgrade their browser every six weeks. A command injection...

CVE-2020-6811

The Mozilla Foundation Security Advisory describes this flaw as: The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP method of a request, which can be controlled by the website. If a user used the 'Copy as Curl' feature and pasted the command into a terminal, it...

UBUNTU-CVE-2020-1734

A flaw was found in the pipe lookup plugin of ansible. Arbitrary commands can be run, when the pipe lookup plugin uses subprocess.Popen with shell=True, by overwriting ansible facts and the variable is not escaped by quote plugin. An attacker could take advantage and run arbitrary commands by...

CVE-2020-1734

CVE-2020-1734 affects the ansible pipe lookup plugin, where subprocess.Popen() with shell=True could allow an attacker to overwrite ansible facts and run arbitrary commands. The public advisories in connected documents confirm this issue and show mitigations in openSUSE/SUSE updates (e.g., ansibl...

[ASA-202002-13] opensmtpd: arbitrary command execution

Arch Linux Security Advisory ASA-202002-13 ========================================== Severity: Critical Date : 2020-02-29 CVE-ID : CVE-2020-8794 Package : opensmtpd Type : arbitrary command execution Remote : Yes Link : https://security.archlinux.org/AVG-1105 Summary ======= The package opensmtp...

CVE-2019-10803

push-dir through 0.4.1 allows execution of arbritary commands. Arguments provided as part of the variable "opt.branch" is not validated before being provided to the "git" command within "index.jsL139". This could be abused by an attacker to inject arbitrary commands...

CVE-2019-10802

giting version prior to 0.0.8 allows execution of arbritary commands. The first argument "repo" of function "pull" is executed by the package without any validation...

CVE-2019-10801

enpeem through 2.2.0 allows execution of arbitrary commands. The "options.dir" argument is provided to the "exec" function without any sanitization...

CVE-2019-10803

CVE-2019-10803 affects push-dir up to version 0.4.1, enabling OS command injection via unsafely passed argument opt.branch to the git command in index.js (line ~139). Connected sources (Red Hat, OSV, Snyk, Veracode, GHSA) consistently describe arbitrary command execution stemming from lack of val...

Sandbox Escape

Overview safe-eval is a Safer version of eval Affected versions of this package are vulnerable to Sandbox Escape. It is possible for an attacker to run an arbitrary command on the host machine. POC by Anirudh Anand for node 12.13.0 const safeEval = require'safe-eval'; const theFunction = function...

CVE-2020-5332

RSA Archer, versions prior to 6.7 P3 6.7.0.3, contain a command injection vulnerability. AN authenticated malicious user with administrator privileges could potentially exploit this vulnerability to execute arbitrary commands on the system where the vulnerable application is deployed...

Cisco UCS Manager Software Operating System Command Injection Vulnerability

The Cisco UCS 6400 Series Fabric Interconnects is a 6400 series switching matrix device from Cisco USA. An operating system command injection vulnerability exists in the local management CLI in Cisco UCS Manager Software, which stems from the program's failure to perform sufficient input validati...

CVE-2020-3173

A vulnerability in the local management local-mgmt CLI of Cisco UCS Manager Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system OS on an affected device. The vulnerability is due to insufficient input validation of command...

PT-2020-1992 · Cisco · Cisco Fxos +3

Name of the Vulnerable Software and Affected Versions: Cisco FXOS Software versions affected versions not specified Cisco UCS Manager Software versions affected versions not specified Description: The issue is related to insufficient input validation in the command-line interface of Cisco FXOS...

Druva inSync Windows Client Arbitrary OS Command Execution Vulnerability

Druva inSync Client is a lightweight application that manages data backups and allows collaboration with other users.Druva inSync Windows Client is for Windows. An arbitrary operating system command execution vulnerability exists in Druva inSync Windows Client 6.5.0. The vulnerability stems from...