UBUNTU-CVE-2017-17405

Ruby before 2.4.3 allows Net::FTP command injection. Net::FTPget, getbinaryfile, gettextfile, put, putbinaryfile, and puttextfile use Kernelopen to open a local file. If the localfile argument starts with the "|" pipe character, the command following the pipe character is executed. The default...

Moderate: Red Hat Security Advisory: go-toolset-7 and go-toolset-7-golang security and bug fix update

An update for go-toolset-7 and go-toolset-7-golang is now available for Red Hat Developer Tools. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

The vulnerability of the “viewcert” component in the CGI application of the web interface for administering the Sonicwall Secure Remote Access server allows a perpetrator to execute arbitrary commands.

The vulnerability of the “viewcert” component /cgi-bin/viewcert of the CGI application for the web interface of the Dell Inc. Sonicwall Secure Remote Access SRA system management application is related to the lack of measures for cleaning input data. Exploiting this vulnerability could allow a...

Command injection vulnerability in Net::FTP

There is a command injection vulnerability in Net::FTP bundled with Ruby. Net::FTPget, getbinaryfile, gettextfile, put, putbinaryfile, and puttextfile use Kernelopen to open a local file. If the localfile argument starts with the pipe character "|", the command following the pipe character is...

Debian DLA-1204-1 : evince security update

It was discovered that there was an arbitrary command injection in the evince PDF viewer. A specially crafted embedded DVI filename could be exploited to run commands as the current user when 'printing' to PDF. For Debian 7 'Wheezy', this issue has been fixed in evince version 3.4.0-3.1+deb7u2. W...

[SECURITY] [DLA 1204-1] evince security update

Package : evince Version : 3.4.0-3.1+deb7u2 CVE ID : CVE-2017-1000159 It was discovered that there was an arbitrary command injection in the evince PDF viewer. A specially-crafted embedded DVI filename could be exploited to run commands as the current user when "printing" to PDF. For Debian 7...

Fluentd vulenrable to escape sequence injection

Overview Fluentd provided by Cloud Native Computing Foundation CNCF contains an escape sequence injection vulnerability. Fluentd is an open source data collector provided by Cloud Native Computing Foundation CNCF. The parse Filter Plugin for Fluentd contains an escape sequence injection...

The vulnerability of the qmiweb component of the D-Link DWR-932B router’s microprogramming software allows a hacker to execute any command they desire.

The vulnerability of the qmiweb component in the microprogramming software of the D-Link DWR-932B router lies in the lack of measures for cleaning incoming data. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands by adding the character “’”...

iSmartAlarm CubeOne Arbitrary Command Execution Vulnerability

iSmartAlarm is a DIY smart home security system that allows for self-monitoring and self-control, and Cube One is the control center of this smart system. An arbitrary command execution vulnerability exists in iSmartAlarm CubeOne. An attacker can exploit this vulnerability to execute arbitrary...

Internet Bug Bounty: Mercurial git subrepo lead to arbritary command injection

Hi IBB, I'd like to submit a issue exist in Mercurial. It is possible that a specially malformed repository can cause Git subrepositories to run arbitrary code in the form of a .git/hooks/post-update script checked in to the repository in Mercurial 4.4 and earlier. Typical use of Mercurial preven...

[ASA-201711-40] shadowsocks-libev: arbitrary command execution

Arch Linux Security Advisory ASA-201711-40 ========================================== Severity: High Date : 2017-11-30 CVE-ID : CVE-2017-15924 Package : shadowsocks-libev Type : arbitrary command execution Remote : No Link : https://security.archlinux.org/AVG-474 Summary ======= The package...

GHSA-RPH7-J9QR-H8Q8 Potential Command Injection in codem-transcode

When the ffprobe functionality is enabled on the server, HTTP POST requests can be made to /probe. These requests are passed to the ffprobe binary on the server. Through this HTTP endpoint it is possible to send a malformed source file name to ffprobe that results in arbitrary command execution...

Potential Command Injection in codem-transcode

When the ffprobe functionality is enabled on the server, HTTP POST requests can be made to /probe. These requests are passed to the ffprobe binary on the server. Through this HTTP endpoint it is possible to send a malformed source file name to ffprobe that results in arbitrary command execution...

The vulnerability of the AirLink router’s microprogramming software, related to the lack of measures taken to clean data at the management level, allows a hacker to execute arbitrary commands.

The vulnerability of the AirLink router’s microprogramming software is related to the lack of measures taken for data cleaning at the control level. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands using metasymbols on certain pages /goform/...

The vulnerability of the datamover module of the Linux operating system-based backup software NovaBACKUP allows a perpetrator to execute arbitrary commands.

The vulnerability of the datamover module of the Linux operating system-based NovaBACKUP data center backup software exists due to insufficient verification of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

Command injection

soyuka/pidusage =1.1.4 is vulnerable to command injection in the module resulting in arbitrary command execution...

CVE-2017-1000220

soyuka/pidusage =1.1.4 is vulnerable to command injection in the module resulting in arbitrary command execution...

CVE-2017-1000220

soyuka/pidusage =1.1.4 is vulnerable to command injection in the module resulting in arbitrary command execution...

[ASA-201711-24] couchdb: multiple issues

Arch Linux Security Advisory ASA-201711-24 ========================================== Severity: High Date : 2017-11-16 CVE-ID : CVE-2017-12635 CVE-2017-12636 Package : couchdb Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-495 Summary ======= The package couchdb...

The vulnerability of Huawei FusionServer’s software allows a hacker to bypass access restrictions and execute arbitrary commands.

The vulnerabilities of the FusionServer RH2288V3, FusionServer RH2288HV3, FusionServer XH628V3, FusionServer RH1288V3, FusionServer RH2288A2, FusionServer RH1288A2, FusionServer RH8100V3, FusionServer CH222V3, FusionServer CH220V3, and FusionServer CH121V3 software programs are related to the lac...