polkit: Local privilege escalation in pkexec due to incorrect handling of argument vector

A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters coun...

polkit: Local privilege escalation in pkexec due to incorrect handling of argument vector

A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters coun...

polkit: Local privilege escalation in pkexec due to incorrect handling of argument vector

A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters coun...

The vulnerability of NETGEAR XR1000 Wi-Fi routers’ microprogramming software lies in insufficient checking of the arguments passed in commands, allowing attackers to execute arbitrary commands.

The vulnerability of NETGEAR XR1000 Wi-Fi routers’ microprogramming software is related to insufficient testing of the arguments passed in commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

GHSA-2457-2263-MM9F Memory leak in micronaut-core

Impact Sending an invalid Content Type header leads to memory leak in DefaultArgumentConversionContext as this type is erroneously used in static state. Patches The problem is patched in Micronaut 3.2.7 and above. Workarounds The default content type binder can be replaced in an existing Micronau...

CVE-2022-22890

There is an Assertion 'argumentstype != SCANNERARGUMENTSPRESENT && argumentstype != SCANNERARGUMENTSPRESENTNOREG' failed at /jerry-core/parser/js/js-scanner-util.c in Jerryscript 3.0.0...

report_vbuild in report.c in Fetchmail before 6.4.20 sometimes omits initialization of the vsnprintf va_list argument which might allow mail servers to cause a denial of service or possibly have unspecified other impact via long error messages. NOTE: it is unclear whether use of Fetchmail on any realistic platform results in an impact beyond an inconvenience to the client user.

...

PT-2022-2309 · Confd +1 · Confd +1

Name of the Vulnerable Software and Affected Versions: ConfD affected versions not specified Description: A vulnerability in the implementation of the CLI on a device running ConfD could allow an authenticated, local attacker to perform a command injection attack. The issue is due to insufficient...

Object Computing micronaut 资源管理错误漏洞

Object Computing micronaut is a JVM-based full-stack framework from US-based Object Computing, which is primarily used to build modular microservices and serverless applications.A resource management error vulnerability exists in Object Computing Micronaut, which stems from the fact that in the...

PT-2022-15762 · Western Digital · Western Digital My Cloud

Name of the Vulnerable Software and Affected Versions: Western Digital My Cloud Devices affected versions not specified Description: A command injection remote code execution issue was discovered that could allow an attacker to execute arbitrary system commands on the device. The issue was...

The vulnerability of the Ruby interpreter, related to the insertion or modification of arguments, allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the Ruby programming language interpreter is related to the introduction or modification of arguments. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected information...

UBUNTU-CVE-2022-23218

The deprecated compatibility function svcunixcreate in the sunrpc module of the GNU C Library aka glibc through 2.34 copies its path argument on the stack without validating its length, which may result in a buffer overflow, potentially resulting in a denial of service or if an application is not...

Signature replay

Handle 0x1f8b Vulnerability details Impact Signature replay in PoolTemplate. Proof of Concept The redeem method of PoolTemplate verifies the data stored in incident, and the verification logic of this process is performed as following: require MerkleProof.verify merkleProof, targets, keccak256...

The vulnerability of Google Chrome’s command-line interface allows attackers to perform spear-phishing attacks.

The vulnerability of the Google Chrome browser’s command-line interface is related to the implementation or modification of arguments. Exploiting this vulnerability can allow attackers to perform spoofing attacks...

GHSA-3269-X4PW-VFFG OS Command Injection in diskusage-ng

diskusage-ng through 0.2.4 is vulnerable to Command Injection.It allows execution of arbitrary commands via the path argument...

OS Command Injection in diskusage-ng

diskusage-ng through 0.2.4 is vulnerable to Command Injection.It allows execution of arbitrary commands via the path argument...

GHSA-CQR2-XHG6-P268 OS Command Injection in node-mpv

node-mpv through 1.4.3 is vulnerable to Command Injection. It allows execution of arbitrary commands via the options argument...

CVE-2021-45456

Apache kylin checks the legitimacy of the project before executing some commands with the project name passed in by the user. There is a mismatch between what is being checked and what is being used as the shell command argument in DiagnosisService. This may cause an illegal project name to pass...

CVE-2021-45456

CVE-2021-45456 affects Apache Kylin 4.0.0. Multiple connected sources describe a mismatch between the legitimacy check for the project name and the shell command argument in DiagnosisService, enabling potential command injection. The issue is network-exploitable with a very high CVSS score (3.1: ...

Fix of CVE: CVE-2021-3973, CVE-2021-3974, CVE-2021-4019, CVE-2021-4069, CVE-2021-3984

CVE-2021-3974: fix using freed memory with regexp using a mark - CVE-2021-3984: fix illegal memory access when C-indenting - CVE-2021-3973: fix crash when using CTRL-W f without finding a file name - CVE-2021-4019: fix buffer overflow with long help argument - CVE-2021-4069: fix using freed...