18168 matches found
Command Injection
Overview Versions of addax prior to 1.1.0 are vulnerable to Command Injection. The package does not validate user input on the presignPath function which receives input directly from the API endpoint. Exploiting the vulnerability requires authentication. This may allow attackers to run arbitrary...
Command Injection
Overview All versions of expressfs are vulnerable to Command Injection. The package does not validate user input on several API endpoints, allowing attackers to run arbitrary commands in the system. The affected endpoints are: expressfs.appendFile, expressfs.cp, expressfs.create and...
Moxa AWK-3121 Command Injection Vulnerability
Moxa AWK-3121 is an industrial-grade wireless access point from Moxa Taiwan, China. A command injection vulnerability exists in the 'iwfilename' parameter in the Moxa AWK-3121 version 1.14, which can be exploited by an attacker to execute an illegal command...
Debian DSA-4456-1 : exim4 - security update
The Qualys Research Labs reported a flaw in Exim, a mail transport agent. Improper validation of the recipient address in the delivermessage function may result in the execution of arbitrary commands. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were...
Ubuntu 18.04 LTS : Exim vulnerability (USN-4010-1)
The remote Ubuntu 18.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-4010-1 advisory. It was discovered that Exim incorrectly handled certain decoding operations. A remote attacker could possibly use this issue to execute arbitrary commands. Tenabl...
Malicious Package
hulp is a malicious package. It contains malicious codes in its pre-install script that attempt to call home to a Command and Control server to execute arbitrary commands...
Malicious Package
kraken-api is a malicious package. It contains malicious codes in its post-install script which attempt to call home to a Command and Control server to execute arbitrary commands...
FusionPBX Operator Panel exec.php Command Execution
This module exploits an authenticated command injection vulnerability in FusionPBX versions 4.4.3 and prior. The exec.php file within the Operator Panel permits users with operatorpanelview permissions, or administrator permissions, to execute arbitrary commands as the web server user by sending ...
Debian: Security Advisory (DSA-4456-1)
The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Exim: Remote command execution
Background Exim is a message transfer agent MTA designed to be a a highly configurable, drop-in replacement for sendmail. Description A vulnerability was discovered in how Exim validates recipient addresses in the delivermessage function. Impact A remote attacker could execute arbitrary commands ...
The vulnerability of the command-line interface implementation of the network operating system NX-OS allows a attacker to execute arbitrary commands with root privileges.
The vulnerability of the command-line interface implementation of the NX-OS network operating system is caused by buffer overflow. Exploiting this vulnerability can allow an attacker to execute arbitrary commands with root privileges...
Ubuntu: Security Advisory (USN-4010-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Command Injection in dot
All versions of dot are vulnerable to Command Injection. The template compilation may execute arbitrary commands if an attacker can inject code in the template or if a Prototype Pollution-like vulnerability can be exploited to alter an Object's prototype...
CVE-2019-6800
In TitanHQ SpamTitan through 7.03, a vulnerability exists in the spam rule update function. Updates are downloaded over HTTP, including scripts which are subsequently executed with root permissions. An attacker with a privileged network position is trivially able to inject arbitrary commands...
CVE-2019-6800
CVE-2019-6800 affects TitanHQ SpamTitan up to version 7.03. The issue is in the spam rule update function where updates are downloaded over HTTP and include scripts that are subsequently executed with root privileges. An attacker with a privileged network position can trivially inject arbitrary c...
USN-4010-1 exim4 vulnerability
It was discovered that Exim incorrectly handled certain decoding operations. A remote attacker could possibly use this issue to execute arbitrary commands...
USN-4010-1: Exim vulnerability
It was discovered that Exim incorrectly handled certain decoding operations. A remote attacker could possibly use this issue to execute arbitrary commands...
GHSA-F698-M2V9-5FH3 Command Injection in opencv
Versions of opencvprior to 6.1.0 are vulnerable to Command Injection. The utils/ script find-opencv.js does not validate user input allowing attackers to execute arbitrary commands. Recommendation Upgrade to version 6.1.0...
Malicious Package
Overview Version 0.1.8 of kraken-api contains malicious code as a postinstall script. When installed, the package calls home to a Command and Control server to execute arbitrary commands. Recommendation Any computer that has this package installed or running should be considered fully compromised...