CVE-2020-27129 Cisco SD-WAN vManage Software Command Injection Vulnerability

A vulnerability in the remote management feature of Cisco SD-WAN vManage Software could allow an authenticated, local attacker to inject arbitrary commands and potentially gain elevated privileges. The vulnerability is due to improper validation of commands to the remote management CLI of the...

git-lfs Remote Code Execution

/ Go PoC exploit for git-lfs - Remote Code Execution RCE vulnerability CVE-2020-27955 git-lfs-RCE-exploit-CVE-2020-27955.go Discovered by Dawid Golunski https://legalhackers.com https://exploitbox.io Affected RCE exploit: Git / GitHub CLI / GitHub Desktop / Visual Studio / GitKraken / SmartGit /...

stratis-cli bug fix and enhancement update

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section...

nvme-cli bug fix and enhancement update

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section...

Cisco Firepower Threat Defense Software Hidden Commands (cisco-sa-ftd-hidcmd-pFDeWVBd)

According to its self-reported version, Cisco Firepower Threat Defense Software is affected by a vulnerability in its CLI component which allows access to hidden commands. An authenticated, local attacker could exploit this to access these commands and make configuration changes to various sectio...

PowerZure - PowerShell Framework To Assess Azure Security

For a list of functions, their usage, and more, check outhttps://powerzure.readthedocs.io What is PowerZure? PowerZure is a PowerShell project created to assess and exploit resources within Microsoft’s cloud platform, Azure. PowerZure was created out of the need for a framework that can both...

Directory Traversal

zenn-cli is vulnerable to directory traversal. The vulnerability exists as it is possible to bypass the sanitization through \ on Windows...

CLI does not correctly implement strict mode

In the affected versions, the AWS Encryption CLI operated in "discovery mode" even when "strict mode" was specified. Although decryption only succeeded if the user had permission to decrypt with at least one of the CMKs, decryption could be successful using a CMK that was not included in the...

Oracle Linux 7 : docker-engine / docker-cli (ELSA-2020-5900)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-5900 advisory. - Fix for CVE-2020-15157 - Address CVE-2020-16845 - update to 19.03.11 for CVE-2020-13401 - apply e4931e664feac6fa8846f3f04268a0cc98822549, fixes CVE-2019-5736 ...

@azteam/monitor (>=1.0.1, <=1.0.9), @best/builder (>=4.0.0-alpha10, <=4.0.0-beta9) +19 more potentially affected by CVE-2020-26300 via systeminformation (>=4.0.9, <=4.23.1)

systeminformation NPM version =4.0.9, =1.0.1, =4.0.0-alpha10, =4.0.0-alpha10, =4.0.0-alpha10, =4.0.0-alpha10, =4.0.0-alpha10, =4.0.0-alpha10, =4.0.0-alpha10, =4.0.0-alpha10, =4.0.0-alpha10, =4.0.0-alpha10, =4.0.0-alpha10, =0.0.3, =1.1.0, =1.2.3 - @remote.it/cli 0.43.1 and more Source cves:...

CVE-2020-10256

An issue was discovered in beta versions of the 1Password command-line tool prior to 0.5.5 and in beta versions of the 1Password SCIM bridge prior to 0.7.3. An insecure random number generator was used to generate various keys. An attacker with access to the user's encrypted data may be able to...

@agneta/cli (>=0.14.7, <=0.14.15), @servisbot/servisbot-cli (>=9.4.0, <=10.3.2) +3 more potentially affected by CVE-2020-7774 via y18n (4.0.0)

y18n NPM version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on y18n and may be impacted: - @agneta/cli =0.14.7, =9.4.0, =0.14.4, =1.0.0-rc.1, =1.0.0-rc.7 Source cves: CVE-2020-7774 Source advisory: SNYK:JS-Y18N-1021887...

NoSQLi - NoSql Injection CLI Tool

NoSQL scanner and injector. About Nosqli I wanted a better nosql injection tool that was simple to use, fully command line based, and configurable. To that end, I began work on nosqli - a simple nosql injection tool written in Go. It aims to be fast, accurate, and highly usable, with an easy to...

CVE-2020-3459

A vulnerability in the CLI of Cisco FXOS Software could allow an authenticated, local attacker to inject arbitrary commands that are executed with root privileges. The vulnerability is due to insufficient input validation of commands supplied by the user. An attacker could exploit this...

Input validation

A vulnerability in the CLI of Cisco FXOS Software could allow an authenticated, local attacker to inject arbitrary commands that are executed with root privileges. The vulnerability is due to insufficient input validation of commands supplied by the user. An attacker could exploit this...

Design/Logic Flaw

A vulnerability in the CLI of Cisco Firepower Threat Defense FTD Software could allow an authenticated, local attacker to access hidden commands. The vulnerability is due to the presence of undocumented configuration commands. An attacker could exploit this vulnerability by performing specific...

Input validation

A vulnerability in the CLI of Cisco FXOS Software could allow an authenticated, local attacker to inject arbitrary commands that are executed with root privileges. The vulnerability is due to insufficient input validation of commands supplied by the user. An attacker could exploit this...

CVE-2020-3352

CVE-2020-3352 affects Cisco Firepower Threat Defense (FTD) Software CLI, where undocumented configuration commands allow an authenticated, local attacker to access hidden commands and modify various device configurations that should not be exposed via CLI. The root cause is exposure of hidden/und...

CVE-2020-3459

CVE-2020-3459 affects Cisco FXOS Software for Firepower 4100/9300 series. The issue stems from insufficient input validation in the CLI, allowing an authenticated, local attacker to submit crafted input that commands are executed with root privileges on the underlying OS. Impact is command inject...

Cisco Firepower Threat Defense Software Hidden Commands Vulnerability

A vulnerability in the CLI of Cisco Firepower Threat Defense FTD Software could allow an authenticated, local attacker to access hidden commands. The vulnerability is due to the presence of undocumented configuration commands. An attacker could exploit this vulnerability by performing specific...