CVE-2018-13797

The macaddress module before 0.2.9 for Node.js is prone to an arbitrary command injection flaw, due to allowing unsanitized input to an exec rather than execFile call...

GLSA-201804-09 : SPICE VDAgent: Arbitrary command injection

The remote host is affected by the vulnerability described in GLSA-201804-09 SPICE VDAgent: Arbitrary command injection SPICE VDAgent does not properly escape save directory before passing to shell. Impact : A local attacker could execute arbitrary commands. Workaround : There is no known...

Debian DLA-1204-1 : evince security update

It was discovered that there was an arbitrary command injection in the evince PDF viewer. A specially crafted embedded DVI filename could be exploited to run commands as the current user when 'printing' to PDF. For Debian 7 'Wheezy', this issue has been fixed in evince version 3.4.0-3.1+deb7u2. W...

[SECURITY] [DLA 1204-1] evince security update

Package : evince Version : 3.4.0-3.1+deb7u2 CVE ID : CVE-2017-1000159 It was discovered that there was an arbitrary command injection in the evince PDF viewer. A specially-crafted embedded DVI filename could be exploited to run commands as the current user when "printing" to PDF. For Debian 7...

Internet Bug Bounty: Mercurial git subrepo lead to arbritary command injection

Hi IBB, I'd like to submit a issue exist in Mercurial. It is possible that a specially malformed repository can cause Git subrepositories to run arbitrary code in the form of a .git/hooks/post-update script checked in to the repository in Mercurial 4.4 and earlier. Typical use of Mercurial preven...

GHSA-W754-GQ8R-PF5F MiniMagick Gem for Ruby URI Handling Arbitrary Command Injection

lib/minimagick.rb in the MiniMagick Gem 1.3.1 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a URL...

GHSA-W248-XR37-JX8M fastreader Gem for Ruby URI Handling Arbitrary Command Injection

fastreader Gem for Ruby contains a flaw that is triggered during the handling of specially crafted input passed via a URL that contains a ';' character. This may allow a context-dependent attacker to potentially execute arbitrary commands...

fastreader Gem for Ruby URI Handling Arbitrary Command Injection

fastreader Gem for Ruby contains a flaw that is triggered during the handling of specially crafted input passed via a URL that contains a ';' character. This may allow a context-dependent attacker to potentially execute arbitrary commands...

The vulnerability of the USB modem code of Cisco ASR 920 router series in the Cisco IOS operating system allows a intruder to implant and execute arbitrary commands.

The vulnerability of the Cisco ASR 920 router’s USB modem code exists because measures to neutralize special elements used in the operating system commands have not been taken. Exploiting this vulnerability allows a local attacker to inject and execute arbitrary commands by modifying the USB...

EulerOS 2.0 SP1 : bash (EulerOS-SA-2017-1163)

According to the versions of the bash package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An arbitrary command injection flaw was found in the way bash processed the hostname value. A malicious DHCP server could use this flaw to execute...

EulerOS 2.0 SP2 : bash (EulerOS-SA-2017-1164)

According to the versions of the bash package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An arbitrary command injection flaw was found in the way bash processed the hostname value. A malicious DHCP server could use this flaw to execute...

CentOS 7 : bash (CESA-2017:1931)

An update for bash is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...

Edgewater Networks Edgemarc Arbitrary Command Injection Vulnerability

Edgewater Networks Edgemarc is an Edgewater Networks device. An arbitrary command injection vulnerability exists in Edgewater Networks Edgemarc. An attacker can exploit this vulnerability to inject arbitrary commands into the context of an affected application, leading to further attacks...

The vulnerability of the Cisco Firepower Extensible Operating System and the Cisco Unified Computing System Central device management system allows a intruder to inject arbitrary commands.

The vulnerability of the Cisco Firepower Extensible Operating System’s local management component and the Cisco Unified Computing System Central’s centralized device management system exists due to the lack of measures taken to neutralize special elements used in operating system commands...

SolarWinds Log and Event Manager < 6.3.1 Hotfix 4 Multiple Vulnerabilities

SolarWinds Log and Event Manager LEM is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Scientific Linux Security Update : bash on SL6.x i386/x86_64 (20170321)

Security Fixes : - An arbitrary command injection flaw was found in the way bash processed the hostname value. A malicious DHCP server could use this flaw to execute arbitrary commands on the DHCP client machines running bash under specific circumstances. CVE-2016-0634 - An arbitrary command...

bash security update

CentOS Errata and Security Advisory CESA-2017:0725 An update for bash is now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...

Pivotal Greenplum Arbitrary Command Injection Vulnerability

Pivotal Greenplum is the U.S. Pivotal Software's set of open source parallel data warehouse , it provides a petabyte-scale data volume of fast query and analysis and other functions . A security vulnerability exists in Pivotal Greenplum versions prior to 4.3.10.0. An attacker can exploit the...

Netgear R7000/R6400 like router exposure remote arbitrary command injection vulnerability, CERT recommends that a comprehensive moratorium on the use-vulnerability warning-the black bar safety net

You with Netgear NETGEAR router? The recent need to be extra careful, especially router model R7000 and R6400 users-Netgear other models the users also need to beware. CERT/CC-us computer Emergency Response Team Coordination Center on Friday issued a security Bulletin, users are advised to suspen...

LifeSize Room 5.0.9 - Multiple Vulnerabilities

LifeSize Room 5.0.9 - Multiple Vulnerabilities Source: https://github.com/XiphosResearch/exploits/tree/master/deathsize LifeSize Room 5.0.9, remote config disclosure, code execution & local privilege escalation Ultimately the Lifesize Room products have fundamentally flawed firmware, many similar...