CVE-2020-5752

Relative path traversal in Druva inSync Windows Client 6.6.3 allows a local, unauthenticated attacker to execute arbitrary operating system commands with SYSTEM privileges...

CVE-2020-5752: Improper Limitation of a Pathname to a Restricted Directory

Relative path traversal in Druva inSync Windows Client 6.6.3 allows a local, unauthenticated attacker to execute arbitrary operating system commands with SYSTEM privileges...

Emerson OpenEnterprise Critical Function Authentication Missing Vulnerability

Emerson Electric OpenEnterprise is a data acquisition and monitoring system SCADA from Emerson Electric, primarily for remote oil and gas applications. A security vulnerability exists in Emerson Electric OpenEnterprise 3.3.4 and prior versions. The vulnerability can be exploited by an attacker to...

[ASA-202005-15] ant: arbitrary command execution

Arch Linux Security Advisory ASA-202005-15 ========================================== Severity: Medium Date : 2020-05-20 CVE-ID : CVE-2020-1945 Package : ant Type : arbitrary command execution Remote : No Link : https://security.archlinux.org/AVG-1159 Summary ======= The package ant before versio...

GHSA-M8XJ-5V73-3HH8 curlrequest allows execution of arbitrary commands

curlrequest through 1.0.1 allows execution of arbitrary commands. It is possible to inject arbitrary commands by using a semicolon char in any of the options values...

CuteNews 2.1.2 - Authenticated Arbitrary File Upload

Exploit Title: CuteNews 2.1.2 - Authenticated Arbitrary File Upload Date: 2020-05-12 Author: Vigov5 - SunCSR Team Vendor Homepage: https://cutephp.com Software Link: https://cutephp.com/click.php?cutenewslatest Version: v2.1.2 Tested on: Ubuntu 18.04 / Kali Linux Description:...

Curlrequest OS Command Injection Vulnerability

curlrequest is a Node.js-based package for transferring data over URLs. An operating system command injection vulnerability exists in curlrequest 1.0.1 and earlier versions. An attacker can exploit this vulnerability to inject and execute arbitrary commands...

Code Injection in vishwanatharondekar/gitlab-cli

Description The git-lab-cli module is vulnerable against RCE since a command is crafted using user inputs not validated and then executedading to arbitrary command injection POC 1. Check there aren't files called HACKED 2. Execute the following commands in another terminal: bash npm i git-lab-cli...

CVE-2020-7805

An issue was discovered on KT Slim egg IML500 R7283, R8112, R8424 and IML520 R8112, R8368, R8411 wifi device. This issue is a command injection allowing attackers to execute arbitrary OS commands...

CVE-2020-4428: Improper Neutralization of Special Elements used in an OS Command

IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, and 2.0.4 could allow a remote authenticated attacker to execute arbitrary commands on the system. IBM X-Force ID: 180533...

TrixBox CE 2.8.0.4 Command Execution Exploit

This Metasploit module exploits an authenticated OS command injection vulnerability found in Trixbox CE versions 1.2.0 through 2.8.0.4 inclusive in the network POST parameter of the /maint/modules/endpointcfg/endpointdevicemap.php page. Successful exploitation allows for arbitrary command executi...

Command Injection in hot-formula-parser

Versions of hot-formula-parser prior to 3.0.1 are vulnerable to Command Injection. The package fails to sanitize values passed to the parse function and concatenates it in an eval call. If a value of the formula is supplied by user-controlled input it may allow attackers to run arbitrary commands...

CVE-2020-12393

The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP method of a request, which can be controlled by the website. If a user used the 'Copy as cURL' feature and pasted the command into a terminal, it could have resulted in command injection and arbitrary command...

Dell EMC RSA Archer Operating System Command Injection Vulnerability

Dell EMC RSA Archer is an enterprise IT governance and compliance governance product from Dell USA. The product enables the development of eGRC programs for managing enterprise risk, automating business processes, and more. An operating system command injection vulnerability exists in versions...

[ASA-202005-4] a2ps: multiple issues

Arch Linux Security Advisory ASA-202005-4 ========================================= Severity: High Date : 2020-05-06 CVE-ID : CVE-2014-0466 CVE-2015-8107 Package : a2ps Type : multiple issues Remote : No Link : https://security.archlinux.org/AVG-1150 Summary ======= The package a2ps before versio...

Security Vulnerabilities fixed in Firefox 76 — Mozilla

A race condition when running shutdown code for Web Worker led to a use-after-free vulnerability. This resulted in a potentially exploitable crash. The Firefox content processes did not sufficiently lockdown access control which could result in a sandbox escape.Note: this issue only affects Firef...

TrixBox CE 2.8.0.4 Command Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'TrixBox CE endpointdevicemap.php Authenticated Command Execution', 'Description' = %q This module exploits an authenticated OS command injection...

[ASA-202005-1] salt: multiple issues

Arch Linux Security Advisory ASA-202005-1 ========================================= Severity: Critical Date : 2020-05-05 CVE-ID : CVE-2020-11651 CVE-2020-11652 Package : salt Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1147 Summary ======= The package salt before...

PT-2020-18407

Name of the Vulnerable Software and Affected Versions RSA Archer versions prior to 6.7 P3 6.7.0.3 Description The issue allows an authenticated malicious user with administrator privileges to potentially execute arbitrary commands on the system where the vulnerable application is deployed. This i...

Node.js third-party modules: [extra-ffmpeg] Command Injection via insecure command formatting

I would like to report a Command Injection issue in the extra-ffmpeg module. It allows to execute arbitrary commands on the victim's PC. Module module name: extra-ffmpeg version: 4.0.3 npm page: https://www.npmjs.com/package/extra-ffmpeg Module Description Decode, encode, transcode, mux, demux,...