4407 matches found
exec-local-bin vulnerable to Command Injection
Versions of the package exec-local-bin before 1.2.0 are vulnerable to Command Injection via the theProcess functionality due to improper user-input sanitization...
CVE-2022-25923
Versions of the package exec-local-bin before 1.2.0 are vulnerable to Command Injection via the theProcess functionality due to improper user-input sanitization...
CVE-2022-25923
CVE-2022-25923 affects the exec-local-bin package. The vulnerability arises in theProcess() where improper user-input sanitization enables Command Injection. Affected versions are prior to 1.2.0. Impact is described as potential unauthorized code execution with high confidentiality/integrity/avai...
CVE-2022-25923
Versions of the package exec-local-bin before 1.2.0 are vulnerable to Command Injection via the theProcess functionality due to improper user-input sanitization...
CVE-2022-25923: Improper Neutralization of Special Elements used in an OS Command
Versions of the package exec-local-bin before 1.2.0 are vulnerable to Command Injection via the theProcess functionality due to improper user-input sanitization...
PT-2023-12836 · Unknown · Exec-Local-Bin
Name of the Vulnerable Software and Affected Versions: exec-local-bin versions prior to 1.2.0 Description: The issue is related to Command Injection via the theProcess functionality due to improper user-input sanitization. This allows for potential exploitation. No information is provided about t...
exec-local-bin 安全漏洞
exec-local-bin is a library by Saeed Seyfi Dorcheh personal developer. A simple helper for executing a local nodemodule bin in a node. A security vulnerability exists in exec-local-bin versions prior to 1.2.0, which stems from incorrect user input cleanup and is prone to command injection via...
VulnCheck KEV: CVE-2018-20057
An issue was discovered in /bin/boa on D-Link DIR-619L Rev.B 2.06B1 and DIR-605L Rev.B 2.12B1 devices. goform/formSysCmd allows remote authenticated users to execute arbitrary OS commands via the sysCmd POST parameter...
CVE-2022-45028: Improper Neutralization of Input During Web Page Generation
A cross-site scripting XSS vulnerability in Arris NVG443B 9.3.0h3d36 allows attackers to execute arbitrary web scripts or HTML via a crafted POST request sent to /cgi-bin/logs.ha...
Pool._amountToBin() returns a wrong value when protocolFeeRatio = 100%.
Lines of code Vulnerability details Impact Pool.amountToBin returns a larger value than it should when protocolFeeRatio = 100%. As a result, bin balances might be calculated wrongly. Proof of Concept delta.deltaInBinInternal is used to update the bin balances like this. if tokenAIn binBalanceA +=...
TWA update is not correct
Lines of code Vulnerability details Impact Time-warped-price is updated incorrectly and this affects moving bins. Proof of Concept The protocol updates twa on every swap and uses that to decide how to move bins. But in the function swap, the delta's endSqrtPrice can not contribute negatively to t...
www/awstats -- Partial absolute pathname
MITRE reports: It seems 90 is not completely fixed in 7.8. that is, even after CVE-2017-1000501 and CVE-2020-29600 are fixed. In AWStats through 7.8, cgi-bin/awstats.pl?config= accepts a partial absolute pathname omitting the initial /etc, even though it was intended to only read a file in the...
Command Injection
Overview Affected versions of this package are vulnerable to Command Injection via the theProcess functionality due to improper user-input sanitization. PoC js var root = require"exec-local-bin" root"& touch JHU", Remediation Upgrade exec-local-bin to version 1.2.0 or higher. References - GitHub...
CVE-2022-4257: Improper Neutralization
A vulnerability was found in C-DATA Web Management System. It has been rated as critical. This issue affects some unknown processing of the file cgi-bin/jumpto.php of the component GET Parameter Handler. The manipulation of the argument hostname leads to argument injection. The attack may be...
CVE-2022-4257
A vulnerability was found in C-DATA Web Management System. It has been rated as critical. This issue affects some unknown processing of the file cgi-bin/jumpto.php of the component GET Parameter Handler. The manipulation of the argument hostname leads to argument injection. The attack may be...
JeecgBoot Jeecg-Boot SQL注入漏洞
Jeecg-Boot is a code generator based low-code platform from the JeecgBoot community. JeecgBoot A security vulnerability exists in Jeecg-Boot version v3.4.3, which stems from the discovery of a contained SQL injection vulnerability via component /sys/user/deleteRecycleBin...
Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS / 22.04 LTS : JBIG-KIT vulnerability (USN-5742-1)
The remote Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS / 22.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-5742-1 advisory. It was discovered that JBIG-KIT incorrectly handled decoding certain large image files. If a user or automated system using...
CVE-2022-44204
D-Link DIR3060 DIR3060A1FW111B04.bin is vulnerable to Buffer Overflow...
