Neekey node-ps injection vulnerability

Neekey node-ps is a lookup tool from the US-based individual developer Neekey. It is provided to find running processes. An injection vulnerability exists in Neekey node-ps, which stems from a lack of proper validation of user input data in lib/index.js, which is not filtered or does not correctl...

The vulnerability in the rConfig network device configuration management web application for the CentOS operating system exists due to the lack of measures taken to neutralize special elements used in the operating system’s command line. This allows an attacker to execute arbitrary commands on the target system.

The vulnerability in the rConfig network device configuration management web application for the CentOS operating system relates to the lack of measures taken to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a malicious actor to execute...

Red Hat CloudForms OS Command Injection Vulnerability

Red Hat CloudForms is a hybrid infrastructure management platform from Red Hat, Inc. The platform provides deployment, management, and other capabilities across virtual machines, clouds, containers, and physical infrastructure. An operating system command injection vulnerability exists in Red Hat...

Apache Airflow Command Injection Vulnerability

Apache Airflow is the United States Apache Apache Software Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. A command injection vulnerability exists in Apache Airflow 1.10.10 and...

Apache Airflow Remote Code Execution Vulnerability (CNVD-2020-44094)

Apache Airflow is the United States Apache Apache Software Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. A security vulnerability exists in Apache Airflow 1.10.10 and earlier...

NETGEAR R7800 Command Injection Vulnerability (CNVD-2020-23423)

The NETGEAR R7800 is a wireless router from NETGEAR. A command injection vulnerability exists in the NETGEAR R7800 prior to version 1.0.2.62. The vulnerability arises from a network system or product not properly filtering specific elements of externally entered data during the construction of...

jenkins-git-client-plugin: OS command injection via 'git ls-remote'

Jenkins Git Client Plugin 2.8.4 and earlier and 3.0.0-rc did not properly restrict values passed as URL argument to an invocation of 'git ls-remote', resulting in OS command injection...

D-Link DBA-1510P OS Command Injection Vulnerability (CNVD-2019-36969)

The D-Link DBA-1510P is a wireless access point device from Taiwan, China-based AUO D-Link. An operating system command injection vulnerability exists in the CLI of D-Link DBA-1510P versions using firmware version 1.70b009 and earlier, which can be exploited by an attacker to execute illegal...

CVE-2019-1295

A remote code execution vulnerability exists in Microsoft SharePoint where APIs aren't properly protected from unsafe data input, aka 'Microsoft SharePoint Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1257, CVE-2019-1296...

openITCOCKPIT Code Injection Vulnerability

openITCOCKPIT is a set of open source system monitoring tools . A code injection vulnerability exists in versions of openITCOCKPIT prior to 3.7.1. The vulnerability arises from external input data to construct code segments in the process , the network system or product is not properly filtered f...

CVE-2019-1894

A vulnerability in Cisco Enterprise NFV Infrastructure Software NFVIS could allow an authenticated, remote attacker with administrator privileges to overwrite or read arbitrary files on the underlying operating system OS of an affected device. The vulnerability is due to improper input validation...

Nextcloud Extract App OS Command Injection Vulnerability

Nextcloud is an open source self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany.Extract App is one of the compressed file extractor. An operating system command injection vulnerability exists in Nextcloud Extract App versions prior to 1.2.0. The...

CVE-2019-1756

A vulnerability in Cisco IOS XE Software could allow an authenticated, remote attacker to execute commands on the underlying Linux shell of an affected device with root privileges. The vulnerability occurs because the affected software improperly sanitizes user-supplied input. An attacker who has...

chromium-browser: Insufficient validation of untrusted input in SafeBrowsing

Omission of the .desktop filetype from the Safe Browsing checklist in SafeBrowsing in Google Chrome on Linux prior to 72.0.3626.81 allowed an attacker who convinced a user to download a .desktop file to execute arbitrary code via a downloaded .desktop file...

CVE-2018-0274

A vulnerability in the CLI parser of Cisco Network Services Orchestrator NSO could allow an authenticated, remote attacker to execute arbitrary shell commands with the privileges of the root user. The vulnerability is due to insufficient input validation. An attacker could exploit this...

CVE-2018-8711

A local file inclusion issue was discovered in the WooCommerce Products Filter aka WOOF plugin before 2.2.0 for WordPress, as demonstrated by the shortcode parameter in a woofredrawwoof action. The vulnerability is due to the lack of args/input validation on renderhtml before allowing it to be...

Atlassian JIRA cross-site scripting vulnerability (CNVD-2018-05472)

Atlassian JIRA is a project and transaction tracking tool from Atlassian. Atlassian JIRA suffers from a cross-site scripting vulnerability because it fails to properly clean up user-supplied input. An attacker could exploit this issue to execute arbitrary HTML and script code in the browser of an...

CVE-2017-16608

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Netgain Enterprise Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within exec.jsp. The issue results from the lack of proper validation of a...

CVE-2017-14964

In IKARUS anti.virus before 2.16.18, the ntguard.sys driver contains an Arbitrary Write vulnerability because of not validating input values from IOCtl 0x8300005c...

SQL Injection Vulnerability in UQCMS Cloud Business B2B2C Multi-store System member.class.php Page

B2B2C multi-store system is a B2B2C e-commerce software with PHP+MYSQL program and smarty template. A SQL injection vulnerability exists in the member.class.php page of the UQCMS Cloud Business B2B2C Multi-Store System. The vulnerability stems from the program not adequately filtering user-suppli...