CVE-2020-28026

Exim 4 before 4.94.2 contains a vulnerability (CVE-2020-28026) described as Improper Neutralization of Line Delimiters in DSN contexts. In non-default configurations using DSN, ORCPT= can insert a newline into a spool header file, enabling unauthenticated remote attackers to execute arbitrary com...

CVE-2020-28008

Exim 4 before 4.94.2 allows Execution with Unnecessary Privileges. Because Exim operates as root in the spool directory owned by a non-root user, an attacker can write to a /var/spool/exim4/input spool header file, in which a crafted recipient address can indirectly lead to command execution...

CVE-2021-1401: Improper Privilege Management

Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series Wireless Access Points could allow an authenticated, remote attacker to obtain sensitive information from or inject arbitrary commands on an affected device. For more informatio...

CVE-2021-29203: Missing Authentication for Critical Function

A security vulnerability has been identified in the HPE Edgeline Infrastructure Manager, also known as HPE Edgeline Infrastructure Management Software, prior to version 1.22. The vulnerability could be remotely exploited to bypass remote authentication leading to execution of arbitrary commands,...

CVE-2021-1400: Improper Privilege Management

Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series Wireless Access Points could allow an authenticated, remote attacker to obtain sensitive information from or inject arbitrary commands on an affected device. For more informatio...

PT-2021-12264

Name of the Vulnerable Software and Affected Versions IBM QRadar SIEM versions 7.3 through 7.4 Description The issue allows an attacker who can compromise or spoof traffic between hosts to potentially execute arbitrary commands due to insecure inter-deployment communication. Recommendations For I...

RDoc OS command injection vulnerability

RDoc used to call Kernelopen to open a local file. If a Ruby project has a file whose name starts with | and ends with tags, the command following the pipe character is executed. A malicious Ruby project could exploit it to run an arbitrary command execution against a user who attempts to run rdo...

RDoc -- command injection vulnerability

Alexandr Savca reports: RDoc used to call Kernelopen to open a local file. If a Ruby project has a file whose name starts with | and ends with tags, the command following the pipe character is executed. A malicious Ruby project could exploit it to run an arbitrary command execution against a user...

OPENSUSE-SU-2021:0644-1 Security update for MozillaThunderbird

This update for MozillaThunderbird fixes the following issues: - Firefox was updated to 78.10.0 ESR bsc1184960 CVE-2021-23994: Out of bound write due to lazy initialization CVE-2021-23995: Use-after-free in Responsive Design Mode CVE-2021-23998: Secure Lock icon could have been spoofed...

Arbitrary Command Execution Vulnerability in YMBCMS 9.2

YMBCMS website management system also known as YMBCMS is one of the independent research and development products of Hebei OuRunTianTeng YMBCMS network studio.YMBCMS set computer station, cell phone station, WeChat public platform, small program, APP in one, shared space, data synchronization, is...

CVE-2021-1476

CVE-2021-1476 affects Cisco ASA/FTD CLI, where insufficient input validation in command handling allows an authenticated local attacker with admin credentials to execute arbitrary commands on the device OS with root privileges. Affected products are Cisco ASA and Firepower Threat Defense software...

CVE-2021-29147

Aruba ClearPass Policy Manager versions prior to 6.9.5, 6.8.9, and 6.7.14-HF1 contain a remote arbitrary command execution vulnerability. The CVE-2021-29147 issue has been confirmed across multiple sources (NVD, Red Hat, CNVD/CNNVD, CVE records) and Aruba has released patches addressing the vulne...

PT-2021-18676

Name of the Vulnerable Software and Affected Versions China Mobile An Lianbao WF-1 router version 1.0.1 Description The issue allows remote attackers to execute arbitrary commands. This is achieved by injecting shell metacharacters into specific parameters in the "api/zrDm/set zrDm" interface. Th...

CVE-2021-30232: Improper Neutralization of Special Elements used in an OS Command

The api/ZRIGMP/setIGMPPROXY interface in China Mobile An Lianbao WF-1 router 1.0.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the IGMPPROXYWANCONNECT parameter...

PT-2021-18111

Name of the Vulnerable Software and Affected Versions: Aruba ClearPass Policy Manager versions prior to 6.9.5 Aruba ClearPass Policy Manager versions prior to 6.8.9 Aruba ClearPass Policy Manager versions prior to 6.7.14-HF1 Description: A remote arbitrary command execution issue was discovered...

PT-2021-18679

Name of the Vulnerable Software and Affected Versions China Mobile An Lianbao WF-1 router version 1.0.1 Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in the IGMP PROXY WAN CONNECT parameter in the "api/ZRIGMP/set IGMP PROXY" interface...

[ASA-202104-6] nimble: multiple issues

Arch Linux Security Advisory ASA-202104-6 ========================================= Severity: High Date : 2021-04-29 CVE-ID : CVE-2021-21372 CVE-2021-21373 CVE-2021-21374 Package : nimble Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1842 Summary ======= The packag...

Apache OFBiz Code Issue Vulnerability

Apache OFBiz is the United States Apache Apache Foundation of a set of enterprise resource planning ERP system. The system provides a set of Java-based Web application components and tools. A code issue vulnerability exists in Apache OFBiz versions prior to 17.12.07 that stems from insecure...

Arbtirary Command Execution

composer/composer is vulnerable to arbitrary command execution. A missing argument delimiter allows an attacker to inject and execute arbitrary commands via VCS repository URLs or source download URLs on systems with Mercurial...

Apache OFBiz code-related vulnerabilities

Apache OFBiz is the United States Apache Apache Foundation of a set of enterprise resource planning ERP system. The system provides a set of Java-based Web application components and tools. A code issue vulnerability exists in Apache OFBiz versions prior to 17.12.07 that stems from insecure...