OpenSSL -- Command injection vulnerability

The OpenSSL project reports: Circumstances where the crehash script does not properly sanitise shell metacharacters to prevent command injection were found by code review...

SUSE SLES12 Security Update : openssl (SUSE-SU-2022:2098-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:2098-1 advisory. - The crehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some...

Amazon Linux 2 : openssl (ALAS-2022-1801)

The version of openssl installed on the remote host is prior to 1.0.2k-24. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2022-1801 advisory. The crehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by so...

OS Command Injection

proctree is vulnerable to OS command injection. The vulnerability exists in the getProcessTree function in index.js due to a lack of sanitization in shell metacharacters which allows attackers to execute arbitrary commands via the fix function...

CVE-2021-34079

OS Command injection vulnerability in Mintzo Docker-Tester through 1.2.1 allows attackers to execute arbitrary commands via shell metacharacters in the 'ports' entry of a crafted docker-compose.yml file...

CVE-2021-34079

OS Command injection vulnerability in Mintzo Docker-Tester through 1.2.1 allows attackers to execute arbitrary commands via shell metacharacters in the 'ports' entry of a crafted docker-compose.yml file...

gitsome 操作系统命令注入漏洞

npm bbultman gitsome is a small library from npm, USA. It can help make decisions based on the data available in a git repository. A security vulnerability exists in gitsome version 0.2.3, which stems from the fact that an attacker controlling the tagged name of the target git repository may...

CVE-2021-34079

OS Command injection vulnerability in Mintzo Docker-Tester through 1.2.1 allows attackers to execute arbitrary commands via shell metacharacters in the 'ports' entry of a crafted docker-compose.yml file...

Improper Neutralization of Special Elements used in a Command in Shell-quote

The shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the output of this package is passed to a real shell as a quoted argument to a command with exec, an...

Debian DSA-5139-1 : openssl - security update

The remote Debian 10 / 11 host has packages installed that are affected by a vulnerability as referenced in the dsa-5139 advisory. Elison Niven discovered that the crehash script included in OpenSSL did not sanitise shell meta characters which could result in the execution of arbitrary commands...

GHSA-G34C-MG6M-XVXJ Cobbler subject to Command Injection

A Command Injection in actionpower.py in Cobbler prior to v2.6.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the 1 username or 2 password fields to the powersystem method in the xmlrpc API...

Cobbler subject to Command Injection

A Command Injection in actionpower.py in Cobbler prior to v2.6.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the 1 username or 2 password fields to the powersystem method in the xmlrpc API...

EGroupware Code Injection vulnerability

phpgwapi/js/fckeditor/editor/dialog/fckspellerpages/spellerpages/serverscripts/spellchecker.php in EGroupware 1.4.001+.002; 1.6.001+.002 and possibly other versions before 1.6.003; and EPL 9.1 before 9.1.20100309 and 9.2 before 9.2.20100309; allows remote attackers to execute arbitrary commands v...

Pillow command injection

Python Image Library PIL 1.1.7 and earlier and Pillow before 2.5.0 might allow remote attackers to execute arbitrary commands via shell metacharacters in unspecified vectors related to CVE-2014-1932, possibly JpegImagePlugin.py...

GHSA-HH2X-7MF9-78FR Sup Code Injection vulnerability

lib/sup/messagechunks.rb in Sup before 0.13.2.1 and 0.14.x before 0.14.1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the contenttype of an email attachment...

GHSA-C4FJ-3WQQ-G9C9 Centreon Command Injection

The escapecommand function in include/Administration/corePerformance/getStats.php in Centreon formerly Merethis Centreon 2.5.4 and earlier offending file deleted in Centreon 19.10.0 uses an incorrect regular expression, which allows remote authenticated users to execute arbitrary commands via she...

Centreon Command Injection

The escapecommand function in include/Administration/corePerformance/getStats.php in Centreon formerly Merethis Centreon 2.5.4 and earlier offending file deleted in Centreon 19.10.0 uses an incorrect regular expression, which allows remote authenticated users to execute arbitrary commands via she...

Puppet Arbitrary Command Execution

Puppet 2.6.x before 2.6.15 and 2.7.x before 2.7.13, and Puppet Enterprise PE Users 1.0, 1.1, 1.2.x, 2.0.x, and 2.5.x before 2.5.1 allows remote authenticated users with agent SSL keys and file-creation permissions on the puppet master to execute arbitrary commands by creating a file whose full...

OS Command Injection

openssl is vulnerable to OS command injection. The crehash script does not properly sanitise shell metacharacters to prevent command injection which allows an attacker to execute arbitrary commands with the privileges of the script...

Galleon NTS-6002 操作系统命令注入漏洞

Galleon NTS-6002 is a complete time solution for medium to large organizations from Galleon UK. An operating system command injection vulnerability exists in the Galleon NTS-6002-GPS version 4.14.103-Galleon-NTS-6002.V12, which allows an authenticated attacker to perform command injection as root...