11720 matches found
CVE-2020-7604
pulverizr through 0.7.0 allows execution of arbitrary commands. Within "lib/job.js", the variable "filename" can be controlled by the attacker. This function uses the variable "filename" to construct the argument of the exec call without any sanitization. In order to successfully exploit this...
CVE-2020-7602
node-prompt-here through 1.0.1 allows execution of arbitrary commands. The "runCommand" is called by "getDevices" function in file "linux/manager.js", which is required by the "index. process.env.NMCLI" in the file "linux/manager.js". This function is used to construct the argument of function...
CVE-2020-7601
CVE-2020-7601 affects gulp-scss-lint up to version 1.0.0. The root cause is command injection through the exec function in src/command.js, allowing an attacker to execute arbitrary commands. Documented impact is remote command execution with high severity (NVD CVSS v3.1 base score 9.8; v2 7.5). M...
CVE-2020-7605: Improper Neutralization of Special Elements used in an OS Command
gulp-tape through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands as part of 'gulp-tape' options...
CVE-2020-7606: Improper Neutralization of Special Elements used in an OS Command
docker-compose-remote-api through 0.1.4 allows execution of arbitrary commands. Within 'index.js' of the package, the function 'execserviceName, cmd, fnStdout, fnStderr, fnExit' uses the variable 'serviceName' which can be controlled by users without any sanitization...
CVE-2020-7601: Improper Neutralization of Special Elements used in an OS Command
gulp-scss-lint through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands to the "exec" function located in "src/command.js" via the provided options...
PT-2020-19651
Name of the Vulnerable Software and Affected Versions gulp-styledocco versions 0.0.3 and earlier Description The issue allows execution of arbitrary commands. The argument options of the exports function in index.js can be controlled by users without any sanitization. Recommendations For versions...
CVE-2020-7607: Improper Neutralization of Special Elements used in an OS Command
gulp-styledocco through 0.0.3 allows execution of arbitrary commands. The argument 'options' of the exports function in 'index.js' can be controlled by users without any sanitization...
CVE-2020-7603: Improper Neutralization of Special Elements used in an OS Command
closure-compiler-stream through 0.1.15 allows execution of arbitrary commands. The argument "options" of the exports function in "index.js" can be controlled by users without any sanitization...
libssh: Arbitrary command execution
Background libssh is a multiplatform C library implementing the SSHv2 protocol on client and server side. Description It was discovered that libssh incorrectly handled certain scp commands. Impact A remote attacker could trick a victim into using a specially crafted scp command, possibly resultin...
PT-2020-19648
Name of the Vulnerable Software and Affected Versions node-prompt-here versions 1.0.0 through 1.0.1 Description The issue allows execution of arbitrary commands. The runCommand function is called by the getDevices function in the file linux/manager.js, which is required by the index.js process...
CVE-2020-7602: Improper Neutralization of Special Elements used in an OS Command
node-prompt-here through 1.0.1 allows execution of arbitrary commands. The "runCommand" is called by "getDevices" function in file "linux/manager.js", which is required by the "index. process.env.NMCLI" in the file "linux/manager.js". This function is used to construct the argument of function...
PT-2020-19649
Name of the Vulnerable Software and Affected Versions closure-compiler-stream versions 0.1.15 and earlier Description The issue allows execution of arbitrary commands. The argument options of the exports function in index.js can be controlled by users without any sanitization. Recommendations For...
Updated firefox packages fix security vulnerabilities
Updated firefox packages fix security vulnerabilities: The inputs to sctploadaddressesfrominit are verified by sctparethereunrecognizedparameters; however, the two functions handled parameter bounds differently, resulting in out of bounds reads when parameters are partially outside a chunk...
[ASA-202003-10] okular: arbitrary command execution
Arch Linux Security Advisory ASA-202003-10 ========================================== Severity: Low Date : 2020-03-13 CVE-ID : CVE-2020-9359 Package : okular Type : arbitrary command execution Remote : Yes Link : https://security.archlinux.org/AVG-1113 Summary ======= The package okular before...
Moxa AWK-3131A Arbitrary Command Execution
The vulnerability of the diagnostic script of the microprogramming software for wireless access points in Moxa AWK-3131A systems exists due to the lack of measures taken to neutralize the special elements used in the operating system commands. Exploiting this vulnerability allows a malicious acto...
Design/Logic Flaw
Blamer versions prior to 1.0.1 allows execution of arbitrary commands. It is possible to inject arbitrary commands as part of the arguments provided to blamer...
CVE-2020-6811
The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP method of a request, which can be controlled by the website. If a user used the 'Copy as Curl' feature and pasted the command into a terminal, it could have resulted in command injection and arbitrary command...
Mozilla Firefox/Firefox ESR Command Injection Vulnerability
Mozilla Firefox is a free, open-source browser for Windows, Linux, and MacOSX. firefox ESR refers to the Extended Support Release of Firefox, which was created by mozilla specifically for organizations that can't or don't want to upgrade their browser every six weeks. A command injection...