4970 matches found
MiracleLinux 4 : sudo-1.8.6p3-12.AXS4 (AXSA:2014-027:01)
The remote MiracleLinux 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2014-027:01 advisory. Sudo superuser do allows a system administrator to give certain users or groups of users the ability to run some or all commands as root while loggin...
Unity Linux 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-003559)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003559 advisory. Systems with microprocessors utilizing speculative execution and address translations may allow unauthorized disclosure of information residing in the L1 data cache ...
Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-002166)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002166 advisory. The ttyopen function in drivers/tty/ttyio.c in the Linux kernel before 3.1.1 mishandles a driver-lookup failure, which allows local users to cause a denial of servic...
CLSA-2026-1768410745 aide: Fix of CVE-2025-54389
CVE-2025-54389: escape filenames in error/log messages to prevent terminal escape sequence injection...
CVE-2026-22708 Cursor has a Terminal Tool Allowlist Bypass via Environment Variables
Cursor is a code editor built for programming with AI. Prior to 2.3, hen the Cursor Agent is running in Auto-Run Mode with Allowlist mode enabled, certain shell built-ins can still be executed without appearing in the allowlist and without requiring user approval. This allows an attacker via...
CVE-2022-50919
Tdarr 2.00.15 has an unauthenticated remote code execution vulnerability in the Help terminal caused by insufficient input filtering, enabling command chaining (example: --help; curl .py | python) without authentication. Public exploit exists (Exploit-DB: 50822). CVSS metrics indicate high impact...
CVE-2022-50919 Tdarr 2.00.15 - Command Injection
Tdarr 2.00.15 contains an unauthenticated remote code execution vulnerability in its Help terminal that allows attackers to inject and chain arbitrary commands. Attackers can exploit the lack of input filtering by chaining commands like --help; curl .py | python to execute remote code without...
CVE-2022-50919 Tdarr 2.00.15 - Command Injection
Tdarr 2.00.15 contains an unauthenticated remote code execution vulnerability in its Help terminal that allows attackers to inject and chain arbitrary commands. Attackers can exploit the lack of input filtering by chaining commands like --help; curl .py | python to execute remote code without...
GHSA-VXW4-WV6M-9HHH OpenCode's Unauthenticated HTTP Server Allows Arbitrary Command Execution
Previously reported via email to [email protected] on 2025-11-17 per the security policy in opencode-sdk-js/SECURITY.md. No response received. Summary OpenCode automatically starts an unauthenticated HTTP server that allows any local process—or any website via permissive CORS—to execute arbitrary...
Astra Linux – Vulnerability in ffmpeg
A flaw was discovered in FFmpeg’s TTY Demuxer. This vulnerability allows for potential data exfiltration through improper parsing of input files that do not comply with TTY standards in HLS playlists...
PT-2026-2395
Name of the Vulnerable Software and Affected Versions Tdarr version 2.00.15 Description The software contains an unauthenticated remote code execution issue in its Help terminal. An attacker can inject and chain arbitrary commands due to a lack of input filtering. Specifically, an attacker can us...
NSecsoft NSecKrnl 安全漏洞
NSecsoft NSecKrnl is the underlying core module of a terminal protection software from China Anzai NSecsoft. A security vulnerability exists in NSecsoft NSecKrnl, which originates from a local attacker being able to terminate another user's process via a specially crafted IOCTL request...
MiracleLinux 8 : git-2.43.5-3.el8_10 (AXSA:2025-9978:03)
The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2025-9978:03 advisory. git: The sideband payload is passed unfiltered to the terminal in git CVE-2024-52005 Tenable has extracted the preceding description block directly from the...
ROS-20260112-7330
A vulnerability in the Linux kernel components ttyldisc.c, vt.c, ttydriver.h is related to improper control of resource identifiers. Exploitation of the vulnerability could allow an attacker to cause a denial of service...
CVE-2023-49258
User browser may be forced to execute JavaScript and pass the authentication cookie to the attacker leveraging the XSS vulnerability located at "/gui/terminaltool.cgi" in the "data" parameter...
CVE-2023-49260
An XSS attack can be performed by changing the MOTD banner and pointing the victim to the "terminaltool.cgi" path. It can be used together with the vulnerability CVE-2023-49255...
CVE-2010-0002
The /etc/profile.d/60alias.sh script in the Mandriva bash package for Bash 2.05b, 3.0, 3.2, 3.2.48, and 4.0 enables the --show-control-chars option in LSOPTIONS, which allows local users to send escape sequences to terminal emulators, or hide the existence of a file, via a crafted filename...
CVE-2010-0537
DesktopServices in Apple Mac OS X 10.6 before 10.6.3 does not properly resolve pathnames in certain circumstances involving an application's save panel, which allows user-assisted remote attackers to trigger unintended remote file copying via a crafted share name...