Apache CloudStack 代码注入漏洞

Apache CloudStack is a suite of Infrastructure as a Service IaaS cloud computing platforms from the Apache Foundation in the United States. The platform is primarily used to deploy and manage large networks of virtual machines. Apache CloudStack suffers from a code injection vulnerability that...

Security Bulletin: Red Hat OpenShift on IBM Cloud is affected by a cri-o security vulnerability (CVE-2024-3154)

Summary Red Hat OpenShift on IBM Cloud is affected by a security vulnerability found in the cri-o component which could allow a remote authenticated attacker to execute arbitrary commands on the system CVE-2024-3154. Vulnerability Details CVEID: CVE-2024-3154 Description: CRI-O could allow a remo...

SQL Injection

craftcms/cms is vulnerable to SQL Injection. The vulnerability is caused by insufficient sanitization and validation of user-supplied input within GraphQL queries, allowing attackers to manipulate these queries to execute arbitrary SQL commands...

The vulnerability of the automated support tool for Lenovo Service Bridge (LSB) arises from the lack of measures taken to neutralize special elements used in the operating system’s command set. This allows attackers to escalate their privileges and execute arbitrary commands.

The vulnerability of the Lenovo Service Bridge LSB automated support tool is related to the lack of measures taken to neutralize special elements used in the operating system’s command set. Exploiting this vulnerability can allow a malicious actor to increase their privileges and execute arbitrar...

CBL Mariner 2.0 Security Update: clamav (CVE-2024-20328)

The version of clamav installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-20328 advisory. - A vulnerability in the VirusEvent feature of ClamAV could allow a local attacker to inject arbitrary command...

PT-2024-37032 · Helmholz +2 · Rex100 +2

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: A high privileged remote attacker can execute arbitrary system commands via GET requests due to improper neutralization of special elements used in an O...

CVE-2023-24531

Command go env is documented as outputting a shell script containing the Go environment. However, go env doesn't sanitize values, so executing its output as a shell script can cause various bad bahaviors, including executing arbitrary commands or inserting new environment variables. This issue is...

CVE-2023-24531

Command go env is documented as outputting a shell script containing the Go environment. However, go env doesn't sanitize values, so executing its output as a shell script can cause various bad bahaviors, including executing arbitrary commands or inserting new environment variables. This issue is...

UBUNTU-CVE-2023-24531

Command go env is documented as outputting a shell script containing the Go environment. However, go env doesn't sanitize values, so executing its output as a shell script can cause various bad bahaviors, including executing arbitrary commands or inserting new environment variables. This issue is...

CVE-2023-24531 Output of "go env" does not sanitize values in cmd/go

Command go env is documented as outputting a shell script containing the Go environment. However, go env doesn't sanitize values, so executing its output as a shell script can cause various bad bahaviors, including executing arbitrary commands or inserting new environment variables. This issue is...

GO-2024-2962 Output of "go env" does not sanitize values in cmd/go

Command go env is documented as outputting a shell script containing the Go environment. However, go env doesn't sanitize values, so executing its output as a shell script can cause various bad bahaviors, including executing arbitrary commands or inserting new environment variables. This issue is...

CVE-2024-20399

A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated user in possession of Administrator credentials to execute arbitrary commands as root on the underlying operating system of an affected device. This vulnerability is due to insufficient validation of arguments that ar...

CVE-2024-20399 Cisco NX-OS Software CLI Command Injection Vulnerability

A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated user in possession of Administrator credentials to execute arbitrary commands as root on the underlying operating system of an affected device. This vulnerability is due to insufficient validation of arguments that ar...

CVE-2024-20399

Cisco NX-OS Software contains a CLI command injection vulnerability (CVE-2024-20399) that could allow an authenticated administrator to execute arbitrary root commands on the underlying OS. The issue arises from insufficient validation of parameters passed to specific configuration CLI commands, ...

PT-2024-4435

Name of the Vulnerable Software and Affected Versions Cisco NX-OS Software versions prior to the fixed version Description A vulnerability in the Command Line Interface CLI of Cisco NX-OS Software could allow an authenticated user in possession of Administrator credentials to execute arbitrary...

Zsh: Prompt Expansion Vulnerability

Background A shell designed for interactive use, although it is also a powerful scripting language. Description Multiple vulnerabilities have been discovered in Zsh. Please review the CVE identifiers referenced below for details. Impact A vulnerability in prompt expansion could be exploited throu...

Cisco NX-OS Software CLI Comm Injection (cisco-sa-nxos-cmd-injection-xD9OhyOP)

According to its self-reported version, Cisco NX-OS Software is affected by a vulnerability. - A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands as root on the underlying operating system of an affected device. This...

USN-6851-2: Netplan regression

USN-6851-1 fixed vulnerabilities in Netplan. The update lead to the discovery of a regression in netplan which caused systemctl enable to fail on systems where systemd is not running. This update fixes the problem. We apologize for the inconvenience. Original advisory details: Andreas Hasenack...

CVE-2024-39351

A vulnerability regarding improper neutralization of special elements used in an OS command 'OS Command Injection' is found in the NTP configuration. This allows remote authenticated users with administrator privileges to execute arbitrary commands via unspecified vectors. The following models wi...

CVE-2023-47802

Synology CVE-2023-47802 affects Synology Camera Firmware BC500/TC500 prior to version 1.0.7-0298. Root cause: improper neutralization of special elements used in OS commands in IP block functionality, enabling OS Command Injection. Impact: remote authenticated administrators can run arbitrary com...