CVE-2022-37005

CVE-2022-37005 is an argument/parameter injection vulnerability in the HarmonyOS Settings application. The issue can lead to data confidentiality exposure. The affected component is the Settings app on HarmonyOS; root cause is parameter injection. No exploit details are provided in the connected ...

CVE-2022-37005

The Settings application has an argument injection vulnerability. Successful exploitation of this vulnerability may affect data confidentiality...

CVE-2022-37005

The Settings application has an argument injection vulnerability. Successful exploitation of this vulnerability may affect data confidentiality...

PT-2022-23750 · Unknown · Settings Application

Name of the Vulnerable Software and Affected Versions: Settings application affected versions not specified Description: The issue is related to an argument injection vulnerability in the Settings application. Successful exploitation of this vulnerability may affect data confidentiality...

CVE-2022-37005: Improper Neutralization of Argument Delimiters in a Command

The Settings application has an argument injection vulnerability. Successful exploitation of this vulnerability may affect data confidentiality...

Apache Hadoop argument injection vulnerability

Apache Hadoop's FileUtil.unTarFile, File API does not escape the input file name before being passed to the shell. An attacker can inject arbitrary commands. This is only used in Hadoop 3.3 InMemoryAliasMap.completeBootstrapTransfer, which is only ever run by a local user. It has been used in...

GHSA-8WM5-8H9C-47PC Apache Hadoop argument injection vulnerability

Apache Hadoop's FileUtil.unTarFile, File API does not escape the input file name before being passed to the shell. An attacker can inject arbitrary commands. This is only used in Hadoop 3.3 InMemoryAliasMap.completeBootstrapTransfer, which is only ever run by a local user. It has been used in...

GLSA-202208-02 : Go: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202208-02 Go: Multiple Vulnerabilities - Go before 1.14.12 and 1.15.x before 1.15.5 allows Code Injection. CVE-2020-28366 - Go before 1.14.12 and 1.15.x before 1.15.5 allows Argument Injection. CVE-2020-28367 - encoding/xml in Go...

CVE-2019-10800

This affects the package codecov before 2.0.16. The vulnerability occurs due to not sanitizing gcov arguments before being being provided to the popen method...

PT-2022-22433

Name of the Vulnerable Software and Affected Versions Webswing versions prior to 20.1.16 Webswing versions prior to 20.2.19 Webswing versions prior to 21.1.8 Webswing versions prior to 21.2.12 Webswing versions prior to 22.1.3 Description The issue allows X-Forwarded-For header injection. The...

Metasploit Weekly Wrap-Up

SAMR Auxiliary Module A new SAMR auxiliary module has been added that allows users to add, lookup, and delete computer accounts from an AD domain. This should be useful for pentesters on engagements who need to create an AD account to gain an initial foothold into the domain for lateral movement...

UBUNTU-CVE-2022-31084

LDAP Account Manager LAM is a webfrontend for managing entries e.g. users, groups, DHCP settings stored in an LDAP directory. In versions prior to 8.0 There are cases where LAM instantiates objects from arbitrary classes. An attacker can inject the first constructor argument. This can lead to cod...

CVE-2022-31084: Improper Neutralization of Argument Delimiters in a Command

LDAP Account Manager LAM is a webfrontend for managing entries e.g. users, groups, DHCP settings stored in an LDAP directory. In versions prior to 8.0 There are cases where LAM instantiates objects from arbitrary classes. An attacker can inject the first constructor argument. This can lead to cod...

CVE-2022-31749: WatchGuard Authenticated Arbitrary File Read/Write (Fixed)

A remote and low-privileged WatchGuard Firebox or XTM user can read arbitrary system files when using the SSH interface due to an argument injection vulnerability affecting the diagnose command. Additionally, a remote and highly privileged user can write arbitrary system files when using the SSH...

PYSEC-2022-204

The package cookiecutter before 2.1.1 are vulnerable to Command Injection via hg argument injection. When calling the cookiecutter function from Python code with the checkout parameter, it is passed to the hg checkout command in a way that additional flags can be set. The additional flags can be...

CVE-2022-24065

The CVE-2022-24065 vulnerability affects the Python package cookiecutter prior to 2.1.1 . The root cause is a Command Injection via the checkout flow: when cookiecutter is invoked from Python code and passes the checkout parameter to the underlying hg checkout command, additional flags can be set...

CVE-2022-24065

The package cookiecutter before 2.1.1 are vulnerable to Command Injection via hg argument injection. When calling the cookiecutter function from Python code with the checkout parameter, it is passed to the hg checkout command in a way that additional flags can be set. The additional flags can be...

CVE-2022-24065

The package cookiecutter before 2.1.1 are vulnerable to Command Injection via hg argument injection. When calling the cookiecutter function from Python code with the checkout parameter, it is passed to the hg checkout command in a way that additional flags can be set. The additional flags can be...

Argument Injection

dragonfly is vulnerable to argument injection. An attacker can exploit the vulnerability by ejecting crafted url and gaining access to arbitrary files via the disabled verifyurl option...

Arbitrary file write in dragonfly

An argument injection vulnerability in Dragonfly Ruby Gem v1.3.0 allows attackers to read and write arbitrary files when the verifyurl option is disabled. This vulnerability is exploited via a crafted URL...