Arbitrary Command Injection

shescape is vulnerable to Arbitrary Command Injection. The vulnerability exists in threaded contexts on Windows, which results in improper escaping of shells, which allows an attacker to bypass shell sanitization...

Arbitrary Command Injection

matrix-appservice-irc is vulnerable to Arbitrary Command Injection. The vulnerability exists due to improper handling of commands with newlines \n which allows an attacker to inject and execute arbitrary commands on the IRC bridge bot...

Arbitrary Command Injection

Overview Affected versions of this package are vulnerable to Arbitrary Command Injection via single sign-on SSO browser URL authentication. In order to exploit the potential for command injection, an attacker would need to be successful in 1 establishing a malicious resource and 2 redirecting use...

CVE-2023-30623 Arbitrary command injection in embano1/wip

embano1/wip is a GitHub Action written in Bash. Prior to version 2, the embano1/wip action uses the github.event.pullrequest.title parameter in an insecure way. The title parameter is used in a run statement - resulting in a command injection vulnerability due to string interpolation. This...

CVE-2023-30623 Arbitrary command injection in embano1/wip

embano1/wip is a GitHub Action written in Bash. Prior to version 2, the embano1/wip action uses the github.event.pullrequest.title parameter in an insecure way. The title parameter is used in a run statement - resulting in a command injection vulnerability due to string interpolation. This...

CVE-2023-25507

NVIDIA DGX-1 BMC contains a vulnerability in the SPX REST API, where an attacker with the appropriate level of authorization can inject arbitrary shell commands, which may lead to code execution, denial of service, information disclosure, and data tampering...

CVE-2023-30621

Gipsy (Curiosity Open Source)

Arbitrary Command Injection

Overview Affected versions of this package are vulnerable to Arbitrary Command Injection via the host field, due to passing unsanitized user-supplied input to the command line. Remediation There is no fixed version for karo. References - Advisory...

CVE-2023-24841

HGiga MailSherlock query function for connection log has a vulnerability of insufficient filtering for user input. An authenticated remote attacker with administrator privilege can exploit this vulnerability to inject and execute arbitrary system commands to perform arbitrary system operation or...

Arbitrary Command Injection

Overview printer is a module for sending commands to a small thermal printer Affected versions of this package are vulnerable to Arbitrary Command Injection in the saveurltopath function in lib/printer/jobs/preparepage.rb. Remediation A fix was pushed into the master branch but not yet published...

Arbitrary Command Injection

Overview Affected versions of this package are vulnerable to Arbitrary Command Injection via the host parameter on the /list-gitolite endpoint. An attacker can inject commands by sending local requests to the vulnerable endpoint. Remediation Upgrade...

GHSA-G2C3-VWFF-M3XR Font-Converter Vulnerable to Arbitrary Command Injection

Overview font-converter is a FontForge wrapper that allows conversion between different font formats TTF, WOFF, OTF All versions of this package are vulnerable to Arbitrary Command Injection due to missing sanitization of input that potentially flows into the childprocess.exec function. PoC js va...

Font-Converter Vulnerable to Arbitrary Command Injection

Overview font-converter is a FontForge wrapper that allows conversion between different font formats TTF, WOFF, OTF All versions of this package are vulnerable to Arbitrary Command Injection due to missing sanitization of input that potentially flows into the childprocess.exec function. PoC js va...

CVE-2022-21165

All versions of package font-converter are vulnerable to Arbitrary Command Injection due to missing sanitization of input that potentially flows into the childprocess.exec function...

Command injection

All versions of package font-converter are vulnerable to Arbitrary Command Injection due to missing sanitization of input that potentially flows into the childprocess.exec function...

CVE-2022-21165

The CVE-2022-21165 entry concerns the font-converter package (FontForge wrapper) where all versions are vulnerable to Arbitrary Command Injection due to missing sanitization of input that potentially flows into child_process.exec(). The core issue is input sanitization failure, enabling injection...

CVE-2022-21165

All versions of package font-converter are vulnerable to Arbitrary Command Injection due to missing sanitization of input that potentially flows into the childprocess.exec function...

PT-2022-14895 · Unknown · Font-Converter

Name of the Vulnerable Software and Affected Versions: font-converter versions all Description: The issue is related to Arbitrary Command Injection due to missing sanitization of input that potentially flows into the child process.exec function. This affects a FontForge wrapper used for conversio...

CVE-2022-21186

The package @acrontum/filesystem-template before 0.0.2 are vulnerable to Arbitrary Command Injection due to the fetchRepo API missing sanitization of the href field of external input...

Command injection

The package @acrontum/filesystem-template before 0.0.2 are vulnerable to Arbitrary Command Injection due to the fetchRepo API missing sanitization of the href field of external input...