The Return of Raining SYSTEM Shells with Citrix Workspace app

TL;DR Back in July I documented a new Citrix Workspace vulnerability that allowed attackers to remotely execute arbitrary commands under the SYSTEM account. Well after some further investigation on the initial fix I discovered a new vector that quite frankly should not exist at all since the...

The vulnerability of the command-line interface of the Cisco Data Center Network Manager allows a attacker to execute arbitrary commands with root privileges on the basic operating system.

The vulnerability of the command-line interface of the Cisco Data Center Network Manager system is related to insufficient restrictions during the execution of vulnerable CLI commands. Exploiting this vulnerability allows an attacker to execute arbitrary commands with root privileges on the basic...

Run Command Line Interface with Hybrid Cloud Security

Learn how you can get started with running CLI commands against Trend Micro Cloud One™ services...

How to manually collect recovery media logs for Veeam Agent for Linux

Challenge You cannot collect recovery media logs for Veeam Agent for Linux from the repository. In such a case, you can still manually collect recovery media logs from the Linux machine where the bare-metal restore is performed. Cause If the bare-metal restore is not completed, the recovery media...

Command injection

A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was not validating a Deploy-Token and allowed a disabled repository be accessible via a git command line...

CVE-2020-13316

Removed by vendor...

CVE-2020-13316

CVE-2020-13316 affects GitLab versions before 13.1.10, 13.2.8, and 13.3.4. The root cause is that Deploy-Token validation was not performed, allowing access to a disabled repository via a git command line. The impact is exposure of otherwise inaccessible repositories, enabling an attacker with ne...

The vulnerability of the Cisco IOS XR command-line interface allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the Cisco IOS XR operating system’s command-line interface is related to privilege management errors. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of protected information...

[SECURITY] Fedora 31 Update: xen-4.12.3-4.fc31

This package contains the XenD daemon and xm command line tools, needed to manage virtual machines running under the Xen hypervisor...

chromium-browser: Insufficient validation of untrusted input in command line handling

Insufficient validation of untrusted input in command line handling in Google Chrome on Windows prior to 85.0.4183.83 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page...

RHEL 6 : chromium-browser (RHSA-2020:3723)

The remote Redhat Enterprise Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:3723 advisory. Chromium is an open-source web browser, powered by WebKit Blink. This update upgrades Chromium to version 85.0.4183.83. Security Fixes:...

CVE-2020-3473 Cisco IOS XR Software Authenticated User Privilege Escalation Vulnerability

A vulnerability in task group assignment for a specific CLI command in Cisco IOS XR Software could allow an authenticated, local CLI shell user to elevate privileges and gain full administrative control of the device. The vulnerability is due to incorrect mapping of a command to task groups withi...

Huawei EulerOS: Security Advisory for curl (EulerOS-SA-2020-1935)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

OPENSUSE-SU-2020:1328-1 Security update for chromium

This update for chromium fixes the following issues: Chromium was updated to version 85.0.4183.83 boo1175757 fixing: - CVE-2020-6558: Insufficient policy enforcement in iOS - CVE-2020-6559: Use after free in presentation API - CVE-2020-6560: Insufficient policy enforcement in autofill -...

Cisco IOS XR Elevation of Privilege Vulnerability (CNVD-2020-51772)

Cisco IOS XR software is a modular and fully distributed network operating system for service provider networks. An elevation of privilege vulnerability exists in the CLI in Cisco IOS XR Software that stems from the lack of effective privilege-granting and access-control measures in a network...

Security update for chromium (important)

openSUSE Security Update: Security update for chromium Announcement ID: openSUSE-SU-2020:1328-1 Rating: important References: 1175757 Cross-References: CVE-2020-6558 CVE-2020-6559 CVE-2020-6560 CVE-2020-6561 CVE-2020-6562 CVE-2020-6563 CVE-2020-6564 CVE-2020-6565 CVE-2020-6566 CVE-2020-6567...

The vulnerability of the local-mgmt component in the microprogramming software for Cisco UCS 6400 Series Fabric Interconnects allows a attacker to trigger a service failure.

The vulnerability of the local-mgmt component in Cisco UCS 6400 Series Fabric Interconnects routers can be exploited by manipulating command-line parameters. Exploiting this vulnerability can allow attackers to cause service failures...

The vulnerability of the command-line interface (CLI) of the Cisco NX-OS network operating system, allowing a attacker to execute arbitrary commands with root privileges

The vulnerability of the command-line interface CLI of the Cisco NX-OS network operating system exists due to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to execute arbitrary commands with root privileges...

CVE-2020-15167

In Miller command line utility using the configuration file support introduced in version 5.9.0, it is possible for an attacker to cause Miller to run arbitrary code by placing a malicious .mlrrc file in the working directory. See linked GitHub Security Advisory for complete details. A fix is rea...

CVE-2020-15167

In Miller command line utility using the configuration file support introduced in version 5.9.0, it is possible for an attacker to cause Miller to run arbitrary code by placing a malicious .mlrrc file in the working directory. See linked GitHub Security Advisory for complete details. A fix is rea...