PT-2022-10318

Name of the Vulnerable Software and Affected Versions Turistforeningen node-s3-uploader versions prior to 2.0.4 Description The issue allows attackers to execute arbitrary commands via the metadata function, which is a part of the node-s3-uploader for Node.js. This can be exploited by providing...

Cisco SD-WAN vManage CLI Arbitrary Command Execution

The vulnerability of the CLI component in the Cisco SD-WAN vManage centralized network management system is related to insecure privilege management. Exploiting this vulnerability could allow an attacker to execute arbitrary commands using a specially created file...

Arbitrary Command Injection

sharp is vulnerable to arbitrary command injection. An attacker is able to set the value of the PKGCONFIGPATH environment variable in a build environment which allows arbitrary command injection at npm install time...

Arbitrary command execution in Minidoc

An arbitrary file upload vulnerability in Mindoc v2.1-beta.5 allows attackers to execute arbitrary commands via a crafted Zip file...

CVE-2022-29637

An arbitrary file upload vulnerability in Mindoc v2.1-beta.5 allows attackers to execute arbitrary commands via a crafted Zip file...

PT-2022-19741

Name of the Vulnerable Software and Affected Versions Mindoc version 2.1-beta.5 Description The issue allows attackers to execute arbitrary commands via a crafted Zip file, exploiting an arbitrary file upload vulnerability. Recommendations For Mindoc version 2.1-beta.5, consider restricting the...

CVE-2022-29256

sharp is an application for Node.js image processing. Prior to version 0.30.5, there is a possible vulnerability in logic that is run only at npm install time when installing versions of sharp prior to the latest v0.30.5. If an attacker has the ability to set the value of the PKGCONFIGPATH...

CVE-2022-29256 Possible vulnerability at 'npm install' time in sharp if an attacker has control over build environment

sharp is an application for Node.js image processing. Prior to version 0.30.5, there is a possible vulnerability in logic that is run only at npm install time when installing versions of sharp prior to the latest v0.30.5. If an attacker has the ability to set the value of the PKGCONFIGPATH...

System command execution vulnerability in Selection tasks Jenkins Plugin

Jenkins Selection tasks Plugin 1.0 and earlier executes a user-specified program on the Jenkins controller, allowing attackers with Job/Configure permission to execute an arbitrary system command on the Jenkins controller as the OS user that the Jenkins process is running as...

GHSA-P5X5-JG3J-2JCJ OS command injection in CryptoMove Plugin

CryptoMove Plugin 0.1.33 and earlier allows the configuration of an OS command to execute as part of its build step configuration. This command will be executed on the Jenkins controller as the OS user account running Jenkins, allowing user with Job/Configure permission to execute an arbitrary OS...

OS command injection in CryptoMove Plugin

CryptoMove Plugin 0.1.33 and earlier allows the configuration of an OS command to execute as part of its build step configuration. This command will be executed on the Jenkins controller as the OS user account running Jenkins, allowing user with Job/Configure permission to execute an arbitrary OS...

CVE-2018-0493

remctld in remctl before 3.14, when an attacker is authorized to execute a command that uses the sudo option, has a use-after-free that leads to a daemon crash, memory corruption, or arbitrary command execution...

PT-2022-19106

Name of the Vulnerable Software and Affected Versions HPE Nimble Storage versions prior to 5.0.10.100 HPE Nimble Storage versions prior to 5.2.1.0 HPE Nimble Storage versions prior to 6.0.0.100 Description A command injection security issue has been identified in HPE Nimble Storage Hybrid Flash...

TotoLink A3100R Command Injection Vulnerability (CNVD-2022-54652)

TotoLink A3100R is a series of wireless routers from TotoLink, Taiwan, China.TotoLink A3100R version V4.1.2cu.5050B20200504 and V4.1.2cu.5247B20211129 are vulnerable to command injection, which originates from uci cloudupdateconfig function in the magicid parameter fails to properly filter the...

TOTOLINK A3100R security vulnerabilities

TotoLink A3100R is a series of wireless routers from TotoLink, Taiwan, China.TotoLink A3100R version V4.1.2cu.5050B20200504 and V4.1.2cu.5247B20211129 are vulnerable to command injection, which originates from uci cloudupdateconfig function in the magicid parameter fails to properly filter the...

CVE-2022-1362

The affected On-Premise cnMaestro is vulnerable inside a specific route where a user can upload a crafted package to the system. An attacker could abuse this user-controlled data to execute arbitrary commands on the server...

Design/Logic Flaw

The affected On-Premise cnMaestro is vulnerable inside a specific route where a user can upload a crafted package to the system. An attacker could abuse this user-controlled data to execute arbitrary commands on the server...

CVE-2022-1362 Cambium Networks cnMaestro OS Command Injection

The affected On-Premise cnMaestro is vulnerable inside a specific route where a user can upload a crafted package to the system. An attacker could abuse this user-controlled data to execute arbitrary commands on the server...

CVE-2022-1362

The CVE-2022-1362 issue affects Cambium Networks cnMaestro On-Premises. In a specific route, an attacker can upload a crafted package, allowing user-controlled data to execute arbitrary commands on the server (OS command injection). Impact is execution of code with the server’s privileges. Remedi...

D-Link DIR-820L Router Arbitrary Command Execution

The vulnerability of D-Link DIR-820L router microprogramming software is related to errors in the code. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands through the device name parameter in /lan.asp...