12975 matches found
GO-2021-0073 Arbitrary command execution in github.com/git-lfs/git-lfs
Arbitrary command execution can be triggered by improperly sanitized SSH URLs in LFS configuration files. This can be triggered by cloning a malicious repository...
CVE-2021-28157
An SQL Injection issue in Devolutions Server before 2021.1 and Devolutions Server LTS before 2020.3.18 allows an administrative user to execute arbitrary SQL commands via a username in api/security/userinfo/delete...
JVN#29739718: Multiple vulnerabilities in Aterm WF1200CR, Aterm WG1200CR, Aterm WG2600HS, and Aterm WX3000HP
Aterm WF1200CR, Aterm WG1200CR, Aterm WG2600HS, and Aterm WX3000HP provided by NEC Corporation contain multiple vulnerabilities listed below. Aterm WF1200CR, Aterm WG1200CR, and Aterm WG2600HS OS Command Injection CWE-78 - CVE-2021-20708 Version| Vector| Score ---|---|--- CVSS v3|...
CVE-2021-1485
A vulnerability in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to inject arbitrary commands that are executed with root privileges on the underlying Linux operating system OS of an affected device. This vulnerability is due to insufficient input validation of...
Arbitrary Command Injection in portprocesses
Impact An Arbitrary Command Injection vulnerability was reported in portprocesses impacting versions = 1.0.4. Example Proof of Concept The following example demonstrates the vulnerability and will run touch success therefore creating a file named success. js const portprocesses =...
GHSA-VM67-7VMG-66VM Arbitrary Command Injection in portprocesses
Impact An Arbitrary Command Injection vulnerability was reported in portprocesses impacting versions = 1.0.4. Example Proof of Concept The following example demonstrates the vulnerability and will run touch success therefore creating a file named success. js const portprocesses =...
CVE-2021-28204: Improper Neutralization of Special Elements used in an OS Command
The specific function in ASUS BMC’s firmware Web management page Modify user’s information function does not filter the specific parameter. As obtaining the administrator permission, remote attackers can launch command injection to execute command arbitrary...
Cisco IOS XE SD-WAN Privilege Escalation
The vulnerability of the Cisco IOS XE SD-WAN software’s command-line interface is related to resource management errors. Exploiting this vulnerability allows an attacker to execute arbitrary commands on the underlying operating system...
Cisco IOS XE SD-WAN CLI Command Execution
The vulnerability of Cisco IOS XE operating system-based routers in Cisco IOS XE SD-WAN solutions exists due to insufficient validation of input data. Exploiting this vulnerability can allow attackers to execute arbitrary commands with superuser privileges...
CVE-2021-29996
Mark Text through 0.16.3 allows attackers arbitrary command execution. This could lead to Remote Code Execution RCE by opening .md files containing a mutation Cross Site Scripting XSS payload...
CVE-2021-29996
Mark Text through 0.16.3 allows attackers arbitrary command execution. This could lead to Remote Code Execution RCE by opening .md files containing a mutation Cross Site Scripting XSS payload...
CVE-2021-29996
Mark Text through 0.16.3 allows attackers arbitrary command execution. This could lead to Remote Code Execution RCE by opening .md files containing a mutation Cross Site Scripting XSS payload...
PT-2021-18562
Name of the Vulnerable Software and Affected Versions Mark Text versions 0.16.3 and earlier Description The issue allows attackers to execute arbitrary commands, potentially leading to Remote Code Execution RCE by opening .md files containing a mutation Cross Site Scripting XSS payload...
PT-2021-7653 · Qnap · Qts +1
Name of the Vulnerable Software and Affected Versions: QTS versions prior to 4.5.2.1566 Build 20210202 QTS versions prior to 4.5.1.1495 Build 20201123 QTS versions prior to 4.3.6.1620 Build 20210322 QTS versions prior to 4.3.4.1632 Build 20210324 QTS versions prior to 4.3.3.1624 Build 20210416 QT...
CVE-2021-28940
Because of a incorrect escaped exec command in MagpieRSS in 0.72 in the /extlib/Snoopy.class.inc file, it is possible to add a extra command to the curl binary. This creates an issue on the /scripts/magpiedebug.php and /scripts/magpiesimple.php page that if you send a specific https url in the RS...
CVE-2021-28940
Because of a incorrect escaped exec command in MagpieRSS in 0.72 in the /extlib/Snoopy.class.inc file, it is possible to add a extra command to the curl binary. This creates an issue on the /scripts/magpiedebug.php and /scripts/magpiesimple.php page that if you send a specific https url in the RS...
PT-2021-17994 · Magpierss · Magpierss
Name of the Vulnerable Software and Affected Versions: MagpieRSS version 0.72 Description: The issue arises from an incorrectly escaped exec command in the /extlib/Snoopy.class.inc file. This allows an attacker to add an extra command to the curl binary, creating a problem on the /scripts/magpie...
MagpieRSS security vulnerabilities
A security vulnerability exists in MagpieRSS in 0.72, which originates from a command escape error in /extlib/Snoopy.class.inc and can be exploited by an attacker to execute arbitrary commands...
Debian DLA-2615-1 : spamassassin security update
Damian Lukowski discovered a flaw in spamassassin, a Perl-based spam filter using text analysis. Malicious rule configuration files, possibly downloaded from an updates server, could execute arbitrary commands under multiple scenarios. For Debian 9 stretch, this problem has been fixed in version...
