Arbitrary command execution in Minidoc

An arbitrary file upload vulnerability in Mindoc v2.1-beta.5 allows attackers to execute arbitrary commands via a crafted Zip file...

CVE-2022-29637

An arbitrary file upload vulnerability in Mindoc v2.1-beta.5 allows attackers to execute arbitrary commands via a crafted Zip file...

PT-2022-19741

Name of the Vulnerable Software and Affected Versions Mindoc version 2.1-beta.5 Description The issue allows attackers to execute arbitrary commands via a crafted Zip file, exploiting an arbitrary file upload vulnerability. Recommendations For Mindoc version 2.1-beta.5, consider restricting the...

CVE-2022-29256

sharp is an application for Node.js image processing. Prior to version 0.30.5, there is a possible vulnerability in logic that is run only at npm install time when installing versions of sharp prior to the latest v0.30.5. If an attacker has the ability to set the value of the PKGCONFIGPATH...

CVE-2022-29256 Possible vulnerability at 'npm install' time in sharp if an attacker has control over build environment

sharp is an application for Node.js image processing. Prior to version 0.30.5, there is a possible vulnerability in logic that is run only at npm install time when installing versions of sharp prior to the latest v0.30.5. If an attacker has the ability to set the value of the PKGCONFIGPATH...

System command execution vulnerability in Selection tasks Jenkins Plugin

Jenkins Selection tasks Plugin 1.0 and earlier executes a user-specified program on the Jenkins controller, allowing attackers with Job/Configure permission to execute an arbitrary system command on the Jenkins controller as the OS user that the Jenkins process is running as...

OS command injection in CryptoMove Plugin

CryptoMove Plugin 0.1.33 and earlier allows the configuration of an OS command to execute as part of its build step configuration. This command will be executed on the Jenkins controller as the OS user account running Jenkins, allowing user with Job/Configure permission to execute an arbitrary OS...

GHSA-P5X5-JG3J-2JCJ OS command injection in CryptoMove Plugin

CryptoMove Plugin 0.1.33 and earlier allows the configuration of an OS command to execute as part of its build step configuration. This command will be executed on the Jenkins controller as the OS user account running Jenkins, allowing user with Job/Configure permission to execute an arbitrary OS...

CVE-2018-0493

remctld in remctl before 3.14, when an attacker is authorized to execute a command that uses the sudo option, has a use-after-free that leads to a daemon crash, memory corruption, or arbitrary command execution...

TotoLink A3100R Command Injection Vulnerability (CNVD-2022-54652)

TotoLink A3100R is a series of wireless routers from TotoLink, Taiwan, China.TotoLink A3100R version V4.1.2cu.5050B20200504 and V4.1.2cu.5247B20211129 are vulnerable to command injection, which originates from uci cloudupdateconfig function in the magicid parameter fails to properly filter the...

PT-2022-19106

Name of the Vulnerable Software and Affected Versions HPE Nimble Storage versions prior to 5.0.10.100 HPE Nimble Storage versions prior to 5.2.1.0 HPE Nimble Storage versions prior to 6.0.0.100 Description A command injection security issue has been identified in HPE Nimble Storage Hybrid Flash...

TOTOLINK A3100R security vulnerabilities

TotoLink A3100R is a series of wireless routers from TotoLink, Taiwan, China.TotoLink A3100R version V4.1.2cu.5050B20200504 and V4.1.2cu.5247B20211129 are vulnerable to command injection, which originates from uci cloudupdateconfig function in the magicid parameter fails to properly filter the...

CVE-2022-1362

The affected On-Premise cnMaestro is vulnerable inside a specific route where a user can upload a crafted package to the system. An attacker could abuse this user-controlled data to execute arbitrary commands on the server...

Design/Logic Flaw

The affected On-Premise cnMaestro is vulnerable inside a specific route where a user can upload a crafted package to the system. An attacker could abuse this user-controlled data to execute arbitrary commands on the server...

CVE-2022-1362

The CVE-2022-1362 issue affects Cambium Networks cnMaestro On-Premises. In a specific route, an attacker can upload a crafted package, allowing user-controlled data to execute arbitrary commands on the server (OS command injection). Impact is execution of code with the server’s privileges. Remedi...

CVE-2022-1362 Cambium Networks cnMaestro OS Command Injection

The affected On-Premise cnMaestro is vulnerable inside a specific route where a user can upload a crafted package to the system. An attacker could abuse this user-controlled data to execute arbitrary commands on the server...

D-Link DIR-820L Router Arbitrary Command Execution

The vulnerability of D-Link DIR-820L router microprogramming software is related to errors in the code. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands through the device name parameter in /lan.asp...

InHand Networks InRouter302 OS Command Injection Vulnerability (CNVD-2022-59178 )

InHand Networks InRouter Series is a series of routers from InHand Networks, Inc. InHand Networks InRouter302 version V3.5.37 contains an operating system command injection vulnerability that can be exploited by attackers to cause arbitrary command execution...

InHand Networks InRouter302 OS Command Injection Vulnerability (CNVD-2022-59179)

InHand Networks InRouter Series is a series of routers from InHand Networks, Inc. InHand Networks InRouter302 version V3.5.37 contains an operating system command injection vulnerability that can be exploited by attackers to cause arbitrary command execution...

InHand Networks InRouter302 OS Command Injection Vulnerability

InHand Networks InRouter Series is a series of routers from InHand Networks, Inc. InHand Networks InRouter302 version V3.5.4 contains an operating system command injection vulnerability that can be exploited by attackers to cause arbitrary command execution...