RDoc Arbitrary Command Execution

The vulnerability of the RDoc documentation generator for the Ruby programming language is related to the lack of measures taken to clean up data at the control level. Exploiting this vulnerability allows an attacker to execute arbitrary commands...

PT-2021-5500

Name of the Vulnerable Software and Affected Versions Apache Traffic Control Traffic Ops affected versions not specified Description The issue exists due to the lack of neutralization of special elements in the LDAP filter of Apache Traffic Control. An unauthenticated user can exploit this by...

azure-arm-nb-extensions (>=0.0.1, <=0.0.2), cfn-docgen (>=0.0.1, <=0.1.4) +1 more potentially affected by CVE-2021-3572 via pip (20.2.3)

pip PYPI version 20.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - azure-arm-nb-extensions =0.0.1, =0.0.1, =0.0.8, =0.0.11 Source cves: CVE-2021-3572 Source advisory: OSV:PYSEC-2021-437...

Cisco Firepower Threat Defense CLI Command Execution

The vulnerability of the command-line interface CLI of Cisco Firepower Threat Defense FTD microprogramming systems lies in insufficient checking of command arguments. Exploiting this vulnerability allows an attacker to execute arbitrary commands...

PT-2021-10162

Name of the Vulnerable Software and Affected Versions: ED01-CMS version 1.0 Description: An arbitrary file upload vulnerability in the image upload function allows attackers to execute arbitrary commands. Recommendations: For ED01-CMS version 1.0, consider disabling the image upload function unti...

Cisco Catalyst Passive Optical Network Series Switches: Operating System Command Injection Vulnerability

Cisco Catalyst Passive Optical Network Series Switches Catalyst Pon Series Switches is a series of high-performance, simple and easy-to-maintain switches from Cisco. Used to provide competitive network solutions. An operating system command injection vulnerability exists in Cisco Catalyst Passive...

CVE-2021-34755

Multiple vulnerabilities in the CLI of Cisco Firepower Threat Defense FTD Software could allow an authenticated, local attacker to execute arbitrary commands with root privileges. For more information about these vulnerabilities, see the Details section of this advisory...

CVE-2021-34755: Improper Input Validation

Multiple vulnerabilities in the CLI of Cisco Firepower Threat Defense FTD Software could allow an authenticated, local attacker to execute arbitrary commands with root privileges. For more information about these vulnerabilities, see the Details section of this advisory...

CVE-2021-34756: Improper Input Validation

Multiple vulnerabilities in the CLI of Cisco Firepower Threat Defense FTD Software could allow an authenticated, local attacker to execute arbitrary commands with root privileges. For more information about these vulnerabilities, see the Details section of this advisory...

CVE-2021-26607

An Improper input validation in execDefaultBrowser method of NEXACRO17 allows a remote attacker to execute arbitrary command on affected systems...

Input validation

An Improper input validation in execDefaultBrowser method of NEXACRO17 allows a remote attacker to execute arbitrary command on affected systems...

CVE-2011-2195

WebSVN 2.3.2 contains an unauthenticated OS command injection when allowDownload is enabled in config.php. An attacker can call the dl.php script with a well-formed path argument to execute arbitrary commands on the underlying OS. The issue is triggered without prior authentication and is tied to...

PT-2021-8348

Name of the Vulnerable Software and Affected Versions WebSVN version 2.3.2 Description A flaw was found in WebSVN. Without prior authentication, if the allowDownload option is enabled in config.php, an attacker can invoke the "dl.php" script and pass a well-formed path argument to execute arbitra...

VulnCheck KEV: CVE-2021-26605

An improper input validation vulnerability in the service of ezPDFReader allows attacker to execute arbitrary command. This issue occurred when the ezPDF launcher received and executed crafted input values through JSON-RPC communication...

PT-2021-5357

Name of the Vulnerable Software and Affected Versions vim affected versions not specified Description The issue is related to a heap-based buffer overflow in the vim editor, which can be exploited by a remote attacker to execute arbitrary commands. This can be achieved by using the -s parameter i...

GHSA-VW27-FWJF-5QXM Arbitrary command execution on Windows via qutebrowserurl: URL handler

Impact Starting with qutebrowser v1.7.0, the Windows installer for qutebrowser registers it as a handler for certain URL schemes. With some applications such as Outlook Desktop, opening a specially crafted URL can lead to argument injection, allowing execution of qutebrowser commands, which in tu...

Arbitrary Command Execution

qutebrowser is vulnerable to arbitrary command execution. An attacker is able to execute commands such as :spawn or :debug-pyeval on the host OS via a specially crafted URL leading to argument injection. The vulnerability exists on windows installations where qutebrowser is registered as a URL...

CVE-2021-41146 Arbitrary command execution on Windows in qutebrowser

qutebrowser is an open source keyboard-focused browser with a minimal GUI. Starting with qutebrowser v1.7.0, the Windows installer for qutebrowser registers a qutebrowserurl: URL handler. With certain applications, opening a specially crafted qutebrowserurl:... URL can lead to execution of...

‘Lone Wolf’ APT Uses Commodity RATs

An APT described as a “lone wolf” is exploiting a decades-old Microsoft Office flaw to deliver a barrage of commodity RATs to organizations in India and Afghanistan, researchers have found. Attackers use political and government-themed malicious domains as lures in the campaign, which targets...

PT-2021-15218

Name of the Vulnerable Software and Affected Versions ConneXium Network Manager Software All Versions Description A vulnerability exists due to improper privilege management, which could lead to arbitrary command execution when the software is configured with specially crafted event actions...