354 matches found
CVE-2022-0764 Arbitrary Command Injection in strapi/strapi
Arbitrary Command Injection in GitHub repository strapi/strapi prior to 4.1.0...
CVE-2022-0764 Arbitrary Command Injection in strapi/strapi
Arbitrary Command Injection in GitHub repository strapi/strapi prior to 4.1.0...
CVE-2022-0764: Improper Neutralization of Special Elements used in an OS Command
Arbitrary Command Injection in GitHub repository strapi/strapi prior to 4.1.0...
Strapi 安全漏洞
Strapi is an open source headless content management system CMS. Strapi is vulnerable to an operating system command injection vulnerability that originates from arbitrary command injection in the GitHub repository. No detailed vulnerability details are currently available...
Arbitrary Command Injection
Description When creating a strapi app using npxcreate-strapi-app, we can inject arbitrary commands through the template cli argument as per the code in this particular link https://github.com/strapi/strapi/blob/master/packages/generators/app/lib/utils/fetch-npm-template.jsL13, this happens due t...
Command injection
Realtek Jungle SDK version v2.x up to v3.4.14B provides a diagnostic tool called 'MP Daemon' that is usually compiled as 'UDPServer' binary. The binary is affected by multiple memory corruption vulnerabilities and an arbitrary command injection vulnerability that can be exploited by remote...
GHSA-V85C-HGQ5-7PFW Arbitrary Command Injection
This affects all versions of package wincred. If attacker-controlled user input is given to the getCredential function, it is possible for an attacker to execute arbitrary commands. This is due to use of the childprocess exec function without input sanitization...
CVE-2021-23399 Arbitrary Command Injection
This affects all versions of package wincred. If attacker-controlled user input is given to the getCredential function, it is possible for an attacker to execute arbitrary commands. This is due to use of the childprocess exec function without input sanitization...
CVE-2021-1401: Improper Privilege Management
Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series Wireless Access Points could allow an authenticated, remote attacker to obtain sensitive information from or inject arbitrary commands on an affected device. For more informatio...
CVE-2021-1400: Improper Privilege Management
Multiple vulnerabilities in the web-based management interface of certain Cisco Small Business 100, 300, and 500 Series Wireless Access Points could allow an authenticated, remote attacker to obtain sensitive information from or inject arbitrary commands on an affected device. For more informatio...
CVE-2021-23379 Arbitrary Command Injection
This affects all versions of package portkiller. If attacker-controlled user input is given, it is possible for an attacker to execute arbitrary commands. This is due to use of the childprocess exec function without input sanitization...
CVE-2021-23381 Arbitrary Command Injection
This affects all versions of package killing. If attacker-controlled user input is given, it is possible for an attacker to execute arbitrary commands. This is due to use of the childprocess exec function without input sanitization...
CVE-2021-23375 Arbitrary Command Injection
This affects all versions of package psnode. If attacker-controlled user input is given to the kill function, it is possible for an attacker to execute arbitrary commands. This is due to use of the childprocess exec function without input sanitization...
CVE-2021-23378 Arbitrary Command Injection
This affects all versions of package picotts. If attacker-controlled user input is given to the say function, it is possible for an attacker to execute arbitrary commands. This is due to use of the childprocess exec function without input sanitization...
Arbitrary Command Injection
Overview psnode is an A Node.js KISS module to list and kill process on OSX and Windows. Affected versions of this package are vulnerable to Arbitrary Command Injection. If attacker-controlled user input is given to the kill function, it is possible for an attacker to execute arbitrary commands...
Arbitrary Command Injection
Overview ps-visitor is a Node.js visit command ps aux and kill. Affected versions of this package are vulnerable to Arbitrary Command Injection. If attacker-controlled user input is given to the kill function, it is possible for an attacker to execute arbitrary commands. This is due to use of the...
CVE-2021-1485
A vulnerability in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to inject arbitrary commands that are executed with root privileges on the underlying Linux operating system OS of an affected device. This vulnerability is due to insufficient input validation of...
Arbitrary Command Injection in portprocesses
Impact An Arbitrary Command Injection vulnerability was reported in portprocesses impacting versions = 1.0.4. Example Proof of Concept The following example demonstrates the vulnerability and will run touch success therefore creating a file named success. js const portprocesses =...
GHSA-VM67-7VMG-66VM Arbitrary Command Injection in portprocesses
Impact An Arbitrary Command Injection vulnerability was reported in portprocesses impacting versions = 1.0.4. Example Proof of Concept The following example demonstrates the vulnerability and will run touch success therefore creating a file named success. js const portprocesses =...
