CVE-2025-1244: Improper Neutralization of Special Elements used in an OS Command

A command injection flaw was found in the text editor Emacs. It could allow a remote, unauthenticated attacker to execute arbitrary shell commands on a vulnerable system. Exploitation is possible by tricking users into visiting a specially crafted website or an HTTP URL with a redirect...

CVE-2025-24499

A vulnerability has been identified in SCALANCE WAB762-1 6GK5762-1AJ00-6AA0 All versions V3.0.0, SCALANCE WAM763-1 6GK5763-1AL00-7DA0 All versions V3.0.0, SCALANCE WAM763-1 ME 6GK5763-1AL00-7DC0 All versions V3.0.0, SCALANCE WAM763-1 US 6GK5763-1AL00-7DB0 All versions V3.0.0, SCALANCE WAM766-1...

CVE-2025-24499: Improper Input Validation

A vulnerability has been identified in SCALANCE WAB762-1 6GK5762-1AJ00-6AA0 All versions V3.0.0, SCALANCE WAM763-1 6GK5763-1AL00-7DA0 All versions V3.0.0, SCALANCE WAM763-1 ME 6GK5763-1AL00-7DC0 All versions V3.0.0, SCALANCE WAM763-1 US 6GK5763-1AL00-7DB0 All versions V3.0.0, SCALANCE WAM766-1...

Azure Linux 3.0 Security Update: perl-Module-ScanDeps (CVE-2024-10224)

The version of perl-Module-ScanDeps installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-10224 advisory. - Qualys discovered that if unsanitized input was used with the library Modules::ScanDeps, befor...

CVE-2024-48418

In Edimax AC1200 Wi-Fi 5 Dual-Band Router BR-6476AC 1.06, the request /goform/fromSetDDNS does not properly handle special characters in any of user provided parameters, allowing an attacker with access to the web interface to inject and execute arbitrary shell commands...

CVE-2025-22606: Improper Neutralization of Special Elements used in an OS Command

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In version 4.0.0-beta.358 and possibly earlier versions, when creating or updating a "project," it is possible to inject arbitrary shell commands by altering the project name. If a name includes...

CVE-2025-23196

A code injection vulnerability exists in the Apache Ambari Alert Definition feature, affecting versions prior to 2.7.9 . The flaw occurs because the script filename field is executed using sh -c when defining alert scripts. An authenticated user can exploit this to inject and execute arbitrary sh...

OESA-2024-2496 perl-Module-ScanDeps security update

This module scans potential modules used by perl programs, and returns a hash reference; its keys are the module names as appears in %INC e.g. Test/More.pm; the values are hash references. Security Fixes: Qualys discovered that if unsanitized input was used with the library Modules::ScanDeps,...

CVE-2024-10224

A flaw was found in the Module-ScanDeps package. Due to the handling of unsanitized input, a local attacker can execute arbitrary shell commands or potentially escalate privileges on the host...

CVE-2024-10224

Qualys discovered that if unsanitized input was used with the library Modules::ScanDeps, before version 1.36 a local attacker could possibly execute arbitrary shell commands by opening a "pesky pipe" such as passing "commands|" as a filename or by passing arbitrary strings to eval...

CVE-2024-11003

Qualys discovered that needrestart, before version 3.8, passes unsanitized data to a library Modules::ScanDeps which expects safe input. This could allow a local attacker to execute arbitrary shell commands. Please see the related CVE-2024-10224 in Modules::ScanDeps...

CVE-2024-11003

Qualys discovered that needrestart, before version 3.8, passes unsanitized data to a library Modules::ScanDeps which expects safe input. This could allow a local attacker to execute arbitrary shell commands. Please see the related CVE-2024-10224 in Modules::ScanDeps...

CVE-2024-11003

Qualys discovered that needrestart, before version 3.8, passes unsanitized data to a library Modules::ScanDeps which expects safe input. This could allow a local attacker to execute arbitrary shell commands. Please see the related CVE-2024-10224 in Modules::ScanDeps...

CVE-2024-11003

Qualys discovered that needrestart, before version 3.8, passes unsanitized data to a library Modules::ScanDeps which expects safe input. This could allow a local attacker to execute arbitrary shell commands. Please see the related CVE-2024-10224 in Modules::ScanDeps...

CVE-2024-11003

Qualys-identified vulnerability in needrestart (before version 3.8): unsanitized input passed to Modules::ScanDeps can allow a local user to run arbitrary shell commands. The root cause is unsafe data handling by needrestart feeding Modules::ScanDeps, enabling command execution on the host with l...

CVE-2024-10224

Qualys discovered that if unsanitized input was used with the library Modules::ScanDeps, before version 1.36 a local attacker could possibly execute arbitrary shell commands by opening a "pesky pipe" such as passing "commands|" as a filename or by passing arbitrary strings to eval...

CVE-2024-10224

Qualys discovered that if unsanitized input was used with the library Modules::ScanDeps, before version 1.36 a local attacker could possibly execute arbitrary shell commands by opening a "pesky pipe" such as passing "commands|" as a filename or by passing arbitrary strings to eval...

CVE-2024-10224

Qualys discovered that if unsanitized input was used with the library Modules::ScanDeps, before version 1.36 a local attacker could possibly execute arbitrary shell commands by opening a "pesky pipe" such as passing "commands|" as a filename or by passing arbitrary strings to eval...

CVE-2024-10224

Qualys reports CVE-2024-10224 affects perl-Module-ScanDeps prior to 1.36, where unsanitized input could allow local command execution via open() of a pipe or by eval(). Remediations shown in connected advisories include updating to 1.36+ (examples show 1.37+ in Amazon Linux 2023/AL2023 and other ...

CVE-2024-10224

Qualys discovered that if unsanitized input was used with the library Modules::ScanDeps, before version 1.36 a local attacker could possibly execute arbitrary shell commands by opening a "pesky pipe" such as passing "commands|" as a filename or by passing arbitrary strings to eval...