Design/Logic Flaw

Electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Electron apps that are launched as command line executables are impacted. Specifically this issue can only be exploited if the following conditions are met: 1. The app is launched with...

CVE-2023-39956 Electron: Out-of-package code execution when launched with arbitrary cwd

Electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Electron apps that are launched as command line executables are impacted. Specifically this issue can only be exploited if the following conditions are met: 1. The app is launched with...

CVE-2023-39956 Electron: Out-of-package code execution when launched with arbitrary cwd

Electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Electron apps that are launched as command line executables are impacted. Specifically this issue can only be exploited if the following conditions are met: 1. The app is launched with...

CVE-2023-39956 Electron: Out-of-package code execution when launched with arbitrary cwd

Electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Electron apps that are launched as command line executables are impacted. Specifically this issue can only be exploited if the following conditions are met: 1. The app is launched with...

GHSA-7X97-J373-85X5 Electron vulnerable to out-of-package code execution when launched with arbitrary cwd

Impact Apps that are launched as command line executables are impacted. E.g. if your app exposes itself in the path as myapp --help Specifically this issue can only be exploited if the following conditions are met: Your app is launched with an attacker-controlled working directory The attacker ha...

Electron vulnerable to out-of-package code execution when launched with arbitrary cwd

Impact Apps that are launched as command line executables are impacted. E.g. if your app exposes itself in the path as myapp --help Specifically this issue can only be exploited if the following conditions are met: Your app is launched with an attacker-controlled working directory The attacker ha...

CVE-2023-39956: Improper Control of Generation of Code

Electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Electron apps that are launched as command line executables are impacted. Specifically this issue can only be exploited if the following conditions are met: 1. The app is launched with...

[SECURITY] Fedora 37 Update: oggvideotools-0.9.1-13.fc37

A toolbox for manipulating Ogg video files, which usually consist of a video stream Theora and an audio stream Vorbis. It includes a number of handy command line tools for manipulating these video files, such as for splitting the different streams...

CVE-2023-41057 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in hyper-bump-it

hyper-bump-it is a command line tool for updating the version in project files.hyper-bump-it reads a file glob pattern from the configuration file. That is combined with the project root directory to construct a full glob pattern that is used to find files that should be edited. These matched fil...

CVE-2023-41057

Hyper-bump-it contains a Path Traversal vulnerability due to not checking that the globbed files reside under the project root. The code joins project root with a config-supplied string to build the target path, which can cause edits to files outside the project. The issue is fixed in release v0....

GHSA-XC27-F9Q3-4448 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in hyper-bump-it

Summary hyper-bump-it reads a file glob pattern from the configuration file. That is combined with the project root directory to construct a full glob pattern that is used to find files that should be edited. These matched files should be contained within the project root directory, but that is n...

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in hyper-bump-it

Summary hyper-bump-it reads a file glob pattern from the configuration file. That is combined with the project root directory to construct a full glob pattern that is used to find files that should be edited. These matched files should be contained within the project root directory, but that is n...

How to backup NetScaler appliance via Command Line or GUI interface

This article describes how to backup NetScaler appliance via command line or GUI interface...

CVE-2023-41057: Improper Limitation of a Pathname to a Restricted Directory

hyper-bump-it is a command line tool for updating the version in project files.hyper-bump-it reads a file glob pattern from the configuration file. That is combined with the project root directory to construct a full glob pattern that is used to find files that should be edited. These matched fil...

[SECURITY] Fedora 37 Update: ImageMagick-6.9.12.93-1.fc37

ImageMagick is an image display and manipulation tool for the X Window System. ImageMagick can read and write JPEG, TIFF, PNM, GIF, and Photo CD image formats. It can resize, rotate, sharpen, color reduce, or add special effects to an image, and when finished you can either save the completed wor...

The vulnerability of the command-line interface of Cisco ThousandEyes Enterprise Agent allows a hacker to elevate their privileges to the root level.

The vulnerability of the command-line interface of Cisco ThousandEyes Enterprise Agent software relates to the implementation or modification of arguments. Exploiting this vulnerability can allow an attacker to elevate their privileges to the root level...

FreeBSD : py-httpie -- exposure of sensitive information vulnerabilities (1e37fa3e-5988-4991-808f-eae98047e2af)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 1e37fa3e-5988-4991-808f-eae98047e2af advisory. - Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository httpie/httpi...

Noir - An Attack Surface Detector Form Source Code

Noir is an attack surface detector form source code. Key Features Automatically identify language and framework from source code. Find API endpoints and web pages through code analysis. Load results quickly through interactions with proxy tools such as ZAP, Burpsuite, Caido and More Proxy tools...

CVE-2023-39267

An authenticated remote code execution vulnerability exists in the command line interface in ArubaOS-Switch. Successful exploitation results in a Denial-of-Service DoS condition in the switch...

CVE-2023-39267 Authenticated Denial of Service Vulnerability in ArubaOS-Switch Command Line Interface

An authenticated remote code execution vulnerability exists in the command line interface in ArubaOS-Switch. Successful exploitation results in a Denial-of-Service DoS condition in the switch...