CVE-2024-20326

A vulnerability in the ConfD CLI and the Cisco Crosswork Network Services Orchestrator CLI could allow an authenticated, low-privileged, local attacker to read and write arbitrary files as root on the underlying operating system. This vulnerability is due to improper authorization enforcement whe...

CVE-2023-46842

Unlike 32-bit PV guests, HVM guests may switch freely between 64-bit and other modes. This in particular means that they may set registers used to pass 32-bit-mode hypercall arguments to values outside of the range 32-bit code would be able to set them to. When processing of hypercalls takes a...

UBUNTU-CVE-2023-46842

Unlike 32-bit PV guests, HVM guests may switch freely between 64-bit and other modes. This in particular means that they may set registers used to pass 32-bit-mode hypercall arguments to values outside of the range 32-bit code would be able to set them to. When processing of hypercalls takes a...

CVE-2024-20389

A vulnerability in the ConfD CLI and the Cisco Crosswork Network Services Orchestrator CLI could allow an authenticated, low-privileged, local attacker to read and write arbitrary files as root on the underlying operating system. This vulnerability is due to improper authorization enforcement whe...

CVE-2024-20326

The CVE-2024-20326 entry applies to Cisco ConfD CLI and Cisco Crosswork NSO CLI. The vulnerability stems from improper authorization enforcement for specific CLI commands, allowing an authenticated, low-privileged, local attacker to read and write arbitrary files as root on the underlying OS. Exp...

CVE-2023-46842

The Xen hypervisor is vulnerable to a crash due to a flaw in hypercall processing for HVM guests that can switch between 64-bit and other modes. The root cause is that internal sanity checking of translated hypercall arguments incorrectly assumes the high halves of registers are always clear. Whe...

GHSA-26HP-CGJJ-M2J3 fuel/core ImageMagick driver does not escape all shell arguments.

This vulnerability may cause OS commands to be executed when you pass unvalidated image filenames containing specially crafted strings to the ImageMagick driver...

fuel/core ImageMagick driver does not escape all shell arguments.

This vulnerability may cause OS commands to be executed when you pass unvalidated image filenames containing specially crafted strings to the ImageMagick driver...

Drupal core Remote Code Execution

In Drupal core, when sending email some variables were not being sanitized for shell arguments in DefaultMailSystem::mail, which could lead to remote code execution...

PT-2024-40130 · Drupal · Drupal Core

Name of the Vulnerable Software and Affected Versions: Drupal core affected versions not specified Description: The issue is related to the sanitization of variables for shell arguments in the DefaultMailSystem::mail function when sending email, which could potentially lead to remote code...

OESA-2024-1555 python-tqdm security update

tqdm derives from the Arabic word taqaddum which can mean "progress". Instantly make your loops show a smart progress meter - just wrap any iterable with tqdminterable, and you are done! Security Fixes: tqdm is an open source progress bar for Python and CLI. Any optional non-boolean CLI arguments...

tqdm CLI arguments injection attack

...

SUSE CVE-2024-34062

tqdm is an open source progress bar for Python and CLI. Any optional non-boolean CLI arguments e.g. --delim, --buf-size, --manpath are passed through python's eval, allowing arbitrary code execution. This issue is only locally exploitable and had been addressed in release version 4.66.3. All user...

GHSA-G7VV-2V7X-GJ9P tqdm CLI arguments injection attack

Impact Any optional non-boolean CLI arguments e.g. --delim, --buf-size, --manpath are passed through python's eval, allowing arbitrary code execution. Example: sh python -m tqdm --manpath="" + strexec"import os\nos.system'echo hi && killall python3'" + "" Patches...

tqdm CLI arguments injection attack

Impact Any optional non-boolean CLI arguments e.g. --delim, --buf-size, --manpath are passed through python's eval, allowing arbitrary code execution. Example: sh python -m tqdm --manpath="" + strexec"import os\nos.system'echo hi && killall python3'" + "" Patches...

CVE-2024-34062

A flaw was found in python-tqdm. When processing non-boolean command line arguments, python-tqdm uses python's eval function but fails to properly sanitize the input provided by the user. This flaw allows an attacker to trick a user into running python-tqdm with crafted command line arguments,...

AZL-40307 CVE-2024-34062 affecting package python-tqdm for versions less than 4.63.1-3

tqdm is an open source progress bar for Python and CLI. Any optional non-boolean CLI arguments e.g. --delim, --buf-size, --manpath are passed through python's eval, allowing arbitrary code execution. This issue is only locally exploitable and had been addressed in release version 4.66.3. All user...

CVE-2024-34062 tqdm CLI arguments injection attack

tqdm is an open source progress bar for Python and CLI. Any optional non-boolean CLI arguments e.g. --delim, --buf-size, --manpath are passed through python's eval, allowing arbitrary code execution. This issue is only locally exploitable and had been addressed in release version 4.66.3. All user...

CVE-2024-34062 tqdm CLI arguments injection attack

tqdm is an open source progress bar for Python and CLI. Any optional non-boolean CLI arguments e.g. --delim, --buf-size, --manpath are passed through python's eval, allowing arbitrary code execution. This issue is only locally exploitable and had been addressed in release version 4.66.3. All user...

CVE-2024-34062

tqdm is an open source progress bar for Python and CLI. Any optional non-boolean CLI arguments e.g. "--delim", "--buf-size", "--manpath" are passed through python's "eval", allowing arbitrary code execution. This issue is only locally exploitable and had been addressed in release version 4.66.3...