CVE-2020-6811

The Mozilla Foundation Security Advisory describes this flaw as: The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP method of a request, which can be controlled by the website. If a user used the 'Copy as Curl' feature and pasted the command into a terminal, it...

PT-2020-19239

Name of the Vulnerable Software and Affected Versions Thunderbird versions prior to 68.6 Firefox versions prior to 74 Firefox ESR versions prior to 68.6 Description The 'Copy as cURL' feature in the network tab of Devtools did not properly escape the HTTP method of a request. This could be...

CVE-2019-10807: Improper Neutralization of Special Elements used in an OS Command

Blamer versions prior to 1.0.1 allows execution of arbitrary commands. It is possible to inject arbitrary commands as part of the arguments provided to blamer...

PT-2020-9157

Name of the Vulnerable Software and Affected Versions Blamer versions prior to 1.0.1 Description The issue allows execution of arbitrary commands. It is possible to inject arbitrary commands as part of the arguments provided to blamer. Recommendations For versions prior to 1.0.1, update to versio...

UBUNTU-CVE-2020-1734

A flaw was found in the pipe lookup plugin of ansible. Arbitrary commands can be run, when the pipe lookup plugin uses subprocess.Popen with shell=True, by overwriting ansible facts and the variable is not escaped by quote plugin. An attacker could take advantage and run arbitrary commands by...

CVE-2020-1734

CVE-2020-1734 affects the ansible pipe lookup plugin, where subprocess.Popen() with shell=True could allow an attacker to overwrite ansible facts and run arbitrary commands. The public advisories in connected documents confirm this issue and show mitigations in openSUSE/SUSE updates (e.g., ansibl...

CVE-2020-1734

A flaw was found in the pipe lookup plugin of ansible. Arbitrary commands can be run, when the pipe lookup plugin uses subprocess.Popen with shell=True, by overwriting ansible facts and the variable is not escaped by quote plugin. An attacker could take advantage and run arbitrary commands by...

[ASA-202002-13] opensmtpd: arbitrary command execution

Arch Linux Security Advisory ASA-202002-13 ========================================== Severity: Critical Date : 2020-02-29 CVE-ID : CVE-2020-8794 Package : opensmtpd Type : arbitrary command execution Remote : Yes Link : https://security.archlinux.org/AVG-1105 Summary ======= The package opensmtp...

CVE-2019-10803

push-dir through 0.4.1 allows execution of arbritary commands. Arguments provided as part of the variable "opt.branch" is not validated before being provided to the "git" command within "index.jsL139". This could be abused by an attacker to inject arbitrary commands...

CVE-2019-10802

giting version prior to 0.0.8 allows execution of arbritary commands. The first argument "repo" of function "pull" is executed by the package without any validation...

CVE-2019-10801

enpeem through 2.2.0 allows execution of arbitrary commands. The "options.dir" argument is provided to the "exec" function without any sanitization...

CVE-2019-10803

CVE-2019-10803 affects push-dir up to version 0.4.1, enabling OS command injection via unsafely passed argument opt.branch to the git command in index.js (line ~139). Connected sources (Red Hat, OSV, Snyk, Veracode, GHSA) consistently describe arbitrary command execution stemming from lack of val...

CVE-2019-10804

serial-number through 1.3.0 allows execution of arbritary commands. The "cmdPrefix" argument in serialNumber function is used by the "exec" function without any validation...

Sandbox Escape

Overview safe-eval is a Safer version of eval Affected versions of this package are vulnerable to Sandbox Escape. It is possible for an attacker to run an arbitrary command on the host machine. POC by Anirudh Anand for node 12.13.0 const safeEval = require'safe-eval'; const theFunction = function...

Cisco UCS Manager Software Operating System Command Injection Vulnerability

The Cisco UCS 6400 Series Fabric Interconnects is a 6400 series switching matrix device from Cisco USA. An operating system command injection vulnerability exists in the local management CLI in Cisco UCS Manager Software, which stems from the program's failure to perform sufficient input validati...

PT-2020-9151

Name of the Vulnerable Software and Affected Versions enpeem versions 2.2.0 and earlier Description The issue allows execution of arbitrary commands. The options.dir argument is provided to the exec function without any sanitization. Recommendations For versions 2.2.0 and earlier, as a temporary...

CVE-2019-10803: Improper Neutralization of Special Elements used in an OS Command

push-dir through 0.4.1 allows execution of arbritary commands. Arguments provided as part of the variable "opt.branch" is not validated before being provided to the "git" command within "index.jsL139". This could be abused by an attacker to inject arbitrary commands...

CVE-2019-10802: Improper Neutralization of Special Elements used in an OS Command

giting version prior to 0.0.8 allows execution of arbritary commands. The first argument "repo" of function "pull" is executed by the package without any validation...

PT-2020-9152

Name of the Vulnerable Software and Affected Versions giting versions prior to 0.0.8 Description The issue allows execution of arbitrary commands. The first argument repo of function pull is executed by the package without any validation. Recommendations For versions prior to 0.0.8, update to...

PT-2020-9153

Name of the Vulnerable Software and Affected Versions push-dir versions 0.4.1 and earlier Description The issue allows execution of arbitrary commands. Arguments provided as part of the variable opt.branch are not validated before being provided to the git command within index.jsL139. This could ...