CVE-2020-3430

CVE-2020-3430 – Cisco Jabber for Windows Protocol Handler Command Injection : A vulnerability in the application protocol handling features allows an unauthenticated, remote attacker to execute arbitrary commands by convincing a user to click a crafted link in a message. It arises from improper i...

CVE-2020-3451

Cisco CVE-2020-3451 affects the Cisco Small Business RV340 Series Routers web-based management interface. Public details (ZDI/Nessus/Cisco advisory) describe a command injection/remote code execution flaw in the upload.cgi handler, caused by improper validation of a user-supplied string used in a...

CVE-2020-3451 Cisco Small Business RV340 Series Routers Command Injection and Remote Code Execution Vulnerabilities

Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV340 Series Routers could allow an authenticated, remote attacker with administrative credentials to execute arbitrary commands on the underlying operating system OS as a restricted user. For more information...

CVE-2020-3453 Cisco Small Business RV340 Series Routers Command Injection and Remote Code Execution Vulnerabilities

Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV340 Series Routers could allow an authenticated, remote attacker with administrative credentials to execute arbitrary commands on the underlying operating system OS as a restricted user. For more information...

Cisco Jabber for Windows Protocol Handler Command Injection (cisco-sa-jabber-vY8M4KGB)

According to its self-reported version, Cisco Jabber for Windows is affected by a Windows Protocol Handler Command Injection vulnerability. The vulnerability exists in the web-based user interface due to improper handling of input to the application protocol handlers. An unathenticated, remote...

GHSA-5MRR-RGP6-X4GR Command Injection in marsdb

All versions of marsdb are vulnerable to Command Injection. In the DocumentMatcher class, selectors on $where clauses are passed to a Function constructor unsanitized. This allows attackers to run arbitrary commands in the system when the function is executed. Recommendation No fix is currently...

GHSA-X87G-RGRH-R6G3 Malicious Package in rpc-websocket

Versions of rpc-websocket = 0.7.6 contained malicious code. The package opens a backdoor to a remote server and executes arbitrary commands, effectively acting as a backdoor. Recommendation Any computer that has these versions of the package installed or running should be considered fully...

GHSA-8PX5-63X9-5C7P pullit vulnerable to command injection

Versions of pullit prior to 1.4.0 are vulnerable to Command Injection. The package does not validate input on git branch names and concatenates it to an exec call, allowing attackers to run arbitrary commands in the system. Recommendation Upgrade to version 1.4.0 or later. Credits This...

pullit vulnerable to command injection

Versions of pullit prior to 1.4.0 are vulnerable to Command Injection. The package does not validate input on git branch names and concatenates it to an exec call, allowing attackers to run arbitrary commands in the system. Recommendation Upgrade to version 1.4.0 or later. Credits This...

Malicious Package

regenrator contains to malicious code. Taking advantage of user's mistake in the module name at the time of installation, the code when executed, invokes home to a Command and Control server to execute arbitrary commands...

Malicious Package

axois is a malicious package. Taking advantage of user's mistake in the module name at the time of installation, the code when executed, invokes home to a Command and Control server to execute arbitrary commands...

Malicious Package

regenraotr contains to malicious code. Taking advantage of user's mistake in the module name at the time of installation, the code when executed, invokes home to a Command and Control server to execute arbitrary commands...

OS Command Injection

bestzip is vulnerable to OS command injection. A remote attacker is able to inject and execute arbitrary OS commands on the host OS via the destination parameter...

Remote Code Execution

pomelo-monitor is vulnerable to remote code execution. An attacker could run arbitrary commands on the server due to lack of validation...

Remote Code Execution

office-converter is vulnerable to remote code execution. An attacker could run arbitrary commands on the server due to lack of validation...

Command Injection in addax

Versions of addax prior to 1.1.0 are vulnerable to Command Injection. The package does not validate user input on the presignPath function which receives input directly from the API endpoint. Exploiting the vulnerability requires authentication. This may allow attackers to run arbitrary commands ...

GHSA-MXMJ-84Q8-34R7 Command Injection in expressfs

All versions of expressfs are vulnerable to Command Injection. The package does not validate user input on several API endpoints, allowing attackers to run arbitrary commands in the system. The affected endpoints are: expressfs.appendFile, expressfs.cp, expressfs.create and expressfs.rmdir...

The vulnerability of the command-line interface (CLI) of the Cisco NX-OS network operating system, allowing a attacker to execute arbitrary commands with root privileges

The vulnerability of the command-line interface CLI of the Cisco NX-OS network operating system exists due to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to execute arbitrary commands with root privileges...

Command Injection in cocos-utils

All versions of cocos-utils are vulnerable to Remote Code Execution. The unzip function concatenates user input to exec which may allow attackers to execute arbitrary commands on the server. Recommendation No fix is currently available. Consider using an alternative module until a fix is made...

Command Injection in tomato

All versions of tomato are vulnerable to Command Injection. The /api/exec endpoint does not validate user input allowing attackers to run arbitrary commands in the system. Recommendation No fix is currently available. Consider using an alternative module until a fix is made available...