CVE-2025-29659: Improper Authorization

Yi IOT XY-3820 6.0.24.10 is vulnerable to Remote Command Execution via the "cmdlisten" function located in the "cmd" binary...

CVE-2025-29659

The Yi IOT XY-3820 wireless security camera, specifically version 6.0.24.10 , is vulnerable to Remote Command Execution (RCE) . The root cause is located in the cmd_listen function within the cmd binary, which allows for the unauthorized execution of commands and could potentially lead to a full ...

The vulnerability of the `ovs_vport_cmd_fill_info()` function in the `net/openvswitch/datapath.c` module, which is part of the Open vSwitch router support in the Linux operating system, allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the ovsvportcmdfillinfo function in the net/openvswitch/datapath.c module, which is part of the Open vSwitch router support in the Linux operating system, relates to the reutilization of previously released memory. Exploiting this vulnerability could allow an attacker to...

CVE-2025-30222

Shescape is a simple shell escape library for JavaScript. Versions 1.7.2 through 2.1.1 are vulnerable to potential environment variable exposure on Windows with CMD. This impact users of Shescape on Windows that explicitly configure shell: 'cmd.exe' or shell: true using any of...

Shescape has potential environment variable exposure on Windows with CMD

Impact This impact users of Shescape on Windows that explicitly configure shell: 'cmd.exe' or shell: true using any of quote/quoteAll/escape/escapeAll. An attacker may be able to get read-only access to environment variables. Example: javascript import as cp from "node:childprocess"; import...

GHSA-66PP-5P9W-Q87J Shescape has potential environment variable exposure on Windows with CMD

Impact This impact users of Shescape on Windows that explicitly configure shell: 'cmd.exe' or shell: true using any of quote/quoteAll/escape/escapeAll. An attacker may be able to get read-only access to environment variables. Example: javascript import as cp from "node:childprocess"; import...

CVE-2025-30222

Shescape is a simple shell escape library for JavaScript. Versions 1.7.2 through 2.1.1 are vulnerable to potential environment variable exposure on Windows with CMD. This impact users of Shescape on Windows that explicitly configure shell: 'cmd.exe' or shell: true using any of...

CVE-2025-30222 Shescape has potential environment variable exposure on Windows with CMD

Shescape is a simple shell escape library for JavaScript. Versions 1.7.2 through 2.1.1 are vulnerable to potential environment variable exposure on Windows with CMD. This impact users of Shescape on Windows that explicitly configure shell: 'cmd.exe' or shell: true using any of...

CVE-2025-30222

Shescape vulnerability (CVE-2025-30222) affects versions 1.7.2–2.1.1 of the JavaScript shell-escape library. On Windows, when shell: 'cmd.exe' or shell: true is configured and any of quote/quoteAll/escape/escapeAll is used, an attacker may gain read-only access to environment variables due to env...

CVE-2025-30222 Shescape has potential environment variable exposure on Windows with CMD

Shescape is a simple shell escape library for JavaScript. Versions 1.7.2 through 2.1.1 are vulnerable to potential environment variable exposure on Windows with CMD. This impact users of Shescape on Windows that explicitly configure shell: 'cmd.exe' or shell: true using any of...

CVE-2025-30222 Shescape has potential environment variable exposure on Windows with CMD

Shescape is a simple shell escape library for JavaScript. Versions 1.7.2 through 2.1.1 are vulnerable to potential environment variable exposure on Windows with CMD. This impact users of Shescape on Windows that explicitly configure shell: 'cmd.exe' or shell: true using any of...

UBUNTU-CVE-2025-2361

A vulnerability was found in Mercurial SCM 4.5.3/71.19.145.211. It has been declared as problematic. This vulnerability affects unknown code of the component Web Interface. The manipulation of the argument cmd leads to cross site scripting. The attack can be initiated remotely. The exploit has be...

CVE-2025-2361

A vulnerability was found in Mercurial SCM 4.5.3/71.19.145.211. It has been declared as problematic. This vulnerability affects unknown code of the component Web Interface. The manipulation of the argument cmd leads to cross site scripting. The attack can be initiated remotely. The exploit has be...

CVE-2025-2361: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in Mercurial SCM 4.5.3/71.19.145.211. It has been declared as problematic. This vulnerability affects unknown code of the component Web Interface. The manipulation of the argument cmd leads to cross site scripting. The attack can be initiated remotely. The exploit has be...

PT-2025-11389

Name of the Vulnerable Software and Affected Versions: Mercurial SCM version 4.5.3 Description: A vulnerability was found in the Web Interface component of Mercurial SCM, where the manipulation of the cmd argument leads to cross-site scripting. The attack can be initiated remotely. Recommendation...

Linux Distros Unpatched Vulnerability : CVE-2022-48848

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: tracing/osnoise: Do not unregister events twice Nicolas reported that using: trace-cmd recor...

Linux Distros Unpatched Vulnerability : CVE-2024-46689

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: soc: qcom: cmd-db: Map shared memory as WC, not WB Linux does not write into cmd-db region...

CVE-2024-57237: Improper Neutralization of Input During Web Page Generation

Prolink 4G LTE Mobile Wi-Fi DL-7203E V4.0.0B05 is vulnerable to Cross Site Scripting XSS in the /reqproc/procget endpoint. The vulnerability arises because the cmd parameter does not properly sanitize input and the response is served with a Content-Type of text/html. This behavior allows the...

CVE-2024-45340

A flaw was found in cmd/go. This vulnerability allows a malicious server to obtain credentials for unintended domains via improper segmentation of credentials by domain. By default, this issue primarily affects credentials stored in the user's .netrc file...

The vulnerability of the target_completecmd function in the target_core_transport.c component of the Linux operating system allows a hacker to trigger a service failure.

The vulnerability of the targetcompletecmd function in the targetcoretransport.c component of the Linux operating system is related to pointer dereferencing errors. Exploiting this vulnerability could allow an attacker to cause a service failure...