Arbitrary Command Injection

Overview Affected versions of this package are vulnerable to Arbitrary Command Injection via the host field, due to passing unsanitized user-supplied input to the command line. Remediation There is no fixed version for karo. References - Advisory...

CVE-2023-24841

HGiga MailSherlock query function for connection log has a vulnerability of insufficient filtering for user input. An authenticated remote attacker with administrator privilege can exploit this vulnerability to inject and execute arbitrary system commands to perform arbitrary system operation or...

Arbitrary Command Injection

Overview printer is a module for sending commands to a small thermal printer Affected versions of this package are vulnerable to Arbitrary Command Injection in the saveurltopath function in lib/printer/jobs/preparepage.rb. Remediation A fix was pushed into the master branch but not yet published...

Arbitrary Command Injection

Overview Affected versions of this package are vulnerable to Arbitrary Command Injection via the host parameter on the /list-gitolite endpoint. An attacker can inject commands by sending local requests to the vulnerable endpoint. Remediation Upgrade...

Font-Converter Vulnerable to Arbitrary Command Injection

Overview font-converter is a FontForge wrapper that allows conversion between different font formats TTF, WOFF, OTF All versions of this package are vulnerable to Arbitrary Command Injection due to missing sanitization of input that potentially flows into the childprocess.exec function. PoC js va...

GHSA-G2C3-VWFF-M3XR Font-Converter Vulnerable to Arbitrary Command Injection

Overview font-converter is a FontForge wrapper that allows conversion between different font formats TTF, WOFF, OTF All versions of this package are vulnerable to Arbitrary Command Injection due to missing sanitization of input that potentially flows into the childprocess.exec function. PoC js va...

CVE-2022-21165

All versions of package font-converter are vulnerable to Arbitrary Command Injection due to missing sanitization of input that potentially flows into the childprocess.exec function...

Command injection

All versions of package font-converter are vulnerable to Arbitrary Command Injection due to missing sanitization of input that potentially flows into the childprocess.exec function...

CVE-2022-21165

The CVE-2022-21165 entry concerns the font-converter package (FontForge wrapper) where all versions are vulnerable to Arbitrary Command Injection due to missing sanitization of input that potentially flows into child_process.exec(). The core issue is input sanitization failure, enabling injection...

CVE-2022-21165

All versions of package font-converter are vulnerable to Arbitrary Command Injection due to missing sanitization of input that potentially flows into the childprocess.exec function...

PT-2022-14895 · Unknown · Font-Converter

Name of the Vulnerable Software and Affected Versions: font-converter versions all Description: The issue is related to Arbitrary Command Injection due to missing sanitization of input that potentially flows into the child process.exec function. This affects a FontForge wrapper used for conversio...

CVE-2022-21165: Undefined Security Weakness

All versions of package font-converter are vulnerable to Arbitrary Command Injection due to missing sanitization of input that potentially flows into the childprocess.exec function...

CVE-2022-38368: Improper Authentication

An issue was discovered in Aviatrix Gateway before 6.6.5712 and 6.7.x before 6.7.1376. Because Gateway API functions mishandle authentication, an authenticated VPN user can inject arbitrary commands...

CVE-2022-21186

The package @acrontum/filesystem-template before 0.0.2 are vulnerable to Arbitrary Command Injection due to the fetchRepo API missing sanitization of the href field of external input...

Command injection

The package @acrontum/filesystem-template before 0.0.2 are vulnerable to Arbitrary Command Injection due to the fetchRepo API missing sanitization of the href field of external input...

CVE-2022-21186

The CVE-2022-21186 issue affects @acrontum/filesystem-template versions prior to 0.0.2. The root cause is lack of sanitization of the href field in the fetchRepo API on external input, enabling Arbitrary Command Injection. Reported impact is high severity: potential remote code execution with net...

CVE-2022-21186 Arbitrary Command Injection

The package @acrontum/filesystem-template before 0.0.2 are vulnerable to Arbitrary Command Injection due to the fetchRepo API missing sanitization of the href field of external input...

CVE-2022-21186

The package @acrontum/filesystem-template before 0.0.2 are vulnerable to Arbitrary Command Injection due to the fetchRepo API missing sanitization of the href field of external input...

Acrontum filesystem-template 安全漏洞

Acrontum filesystem-template is a filesystem template from the German company Acrontum. A security vulnerability exists in Acrontum filesystem-template versions prior to 0.0.2 that stems from vulnerability to arbitrary command injection...

CVE-2022-21186: Undefined Security Weakness

The package @acrontum/filesystem-template before 0.0.2 are vulnerable to Arbitrary Command Injection due to the fetchRepo API missing sanitization of the href field of external input...