CVE-2022-46908

CVE-2022-46908 affects SQLite up to version 3.40.0 and stems from improper handling of azProhibitedFunctions when using --safe for untrusted CLI scripts, allowing UDFs like WRITEFILE. Multiple connected advisories confirm impact across Linux distros (e.g., Alpine, Mariner) and provide patch guida...

AZL-33617 CVE-2022-41717 affecting package moby-cli for versions less than 24.0.9-1

An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large keys can cause the server to allocate...

CVE-2022-42718

The CVE-2022-42718 entry concerns NI LabVIEW Command Line Interface (CLI). The root issue is incorrect default permissions in the installation folder, which may allow an authenticated local user to escalate privileges. Impact is a local privilege-escalation risk with high severity (CVE reported w...

CVE-2022-44532

An authenticated path traversal vulnerability exists in the Aruba EdgeConnect Enterprise command line interface. Successful exploitation of this vulnerability results in the ability to read arbitrary files on the underlying operating system, including sensitive system files in Aruba EdgeConnect...

CVE-2022-44532

CVE-2022-44532 describes an authenticated path traversal in the Aruba EdgeConnect Enterprise CLI that allows reading arbitrary files on the underlying OS. Affected software (ECOS) includes versions ECOS 9.2.1.0 and below; 9.1.3.0 and below; 9.0.7.0 and below; 8.3.7.1 and below. The vulnerability ...

CVE-2022-43541

CVE-2022-43541 affects Aruba EdgeConnect Enterprise Software via the built-in command line interface. The vulnerability allows remote authenticated users to execute arbitrary commands as root on the underlying OS, potentially leading to complete system compromise. Affected software and versions a...

CVE-2022-37923

The CVE-2022-37923 issue affects Aruba EdgeConnect Enterprise Software, specifically the EdgeConnect Enterprise command line interface. The vulnerability enables remote authenticated users to execute arbitrary commands with root privileges on the underlying OS, potentially resulting in complete s...

CVE-2022-37922

CVE-2022-37922 affects Aruba EdgeConnect Enterprise Software via the EdgeConnect CLI. The vulnerability allows remote authenticated users to execute arbitrary commands on the underlying host with root privileges, potentially leading to complete system compromise. Affected versions include ECOS 9....

CVE-2022-37920

CVE-2022-37920 affects Aruba EdgeConnect Enterprise Software (ECOS) prior to 9.2.1.0, 9.1.3.0, 9.0.7.0, and 8.3.7.1. The vulnerability exists in the command line interface and allows remote authenticated users to execute arbitrary commands on the underlying host with root privileges, potentially ...

CVE-2022-22984

The package snyk before 1.1064.0; the package snyk-mvn-plugin before 2.31.3; the package snyk-gradle-plugin before 3.24.5; the package @snyk/snyk-cocoapods-plugin before 2.5.3; the package snyk-sbt-plugin before 2.16.2; the package snyk-python-plugin before 1.24.2; the package snyk-docker-plugin...

Snyk CLI 操作系统命令注入漏洞

Snyk CLI is a build-time tool from Snyk USA for finding and fixing known vulnerabilities in projects. An operating system command injection vulnerability exists in versions of Snyk CLI prior to 1.1064.0. An attacker could exploit this vulnerability to execute arbitrary code...

Snyk CLI 操作系统命令注入漏洞

Snyk CLI is a build-time tool from Snyk USA for finding and fixing known vulnerabilities in your project. Snyk CLI before 1.1064.0, snyk-mvn-plugin before 2.31.3, snyk-gradle-plugin before 3.24.5, snyk-cocoapods-plugin before 2.5.3, snyk-sbt-plugin before 2.16.2 versions, snyk-python-plugin befor...

CVE-2022-24441

CVE-2022-24441 relates to a code injection flaw in Snyk when analyzing a project. According to the provided description, snyk before 1.1064.0 can be leveraged by convincing a user to scan a malicious project, including commands in build files (e.g., build.gradle or gradle-wrapper.jar), which will...

CVE-2022-22984 Command Injection

The package snyk before 1.1064.0; the package snyk-mvn-plugin before 2.31.3; the package snyk-gradle-plugin before 3.24.5; the package @snyk/snyk-cocoapods-plugin before 2.5.3; the package snyk-sbt-plugin before 2.16.2; the package snyk-python-plugin before 1.24.2; the package snyk-docker-plugin...

CVE-2022-24441 Code Injection

The package snyk before 1.1064.0 are vulnerable to Code Injection when analyzing a project. An attacker who can convince a user to scan a malicious project can include commands in a build file such as build.gradle or gradle-wrapper.jar, which will be executed with the privileges of the applicatio...

CVE-2022-22984 Command Injection

The package snyk before 1.1064.0; the package snyk-mvn-plugin before 2.31.3; the package snyk-gradle-plugin before 3.24.5; the package @snyk/snyk-cocoapods-plugin before 2.5.3; the package snyk-sbt-plugin before 2.16.2; the package snyk-python-plugin before 1.24.2; the package snyk-docker-plugin...

CVE-2022-24441 Code Injection

The package snyk before 1.1064.0 are vulnerable to Code Injection when analyzing a project. An attacker who can convince a user to scan a malicious project can include commands in a build file such as build.gradle or gradle-wrapper.jar, which will be executed with the privileges of the applicatio...

CVE-2022-39334

Nextcloud also ships a CLI utility called nextcloudcmd which is sometimes used for automated scripting and headless servers. Versions of nextcloudcmd prior to 3.6.1 would incorrectly trust invalid TLS certificates, which may enable a Man-in-the-middle attack that exposes sensitive data or...

CVE-2022-39334

Nextcloud also ships a CLI utility called nextcloudcmd which is sometimes used for automated scripting and headless servers. Versions of nextcloudcmd prior to 3.6.1 would incorrectly trust invalid TLS certificates, which may enable a Man-in-the-middle attack that exposes sensitive data or...

CVE-2022-39334 nextcloudcmd incorrectly trusts bad TLS certificates

Nextcloud also ships a CLI utility called nextcloudcmd which is sometimes used for automated scripting and headless servers. Versions of nextcloudcmd prior to 3.6.1 would incorrectly trust invalid TLS certificates, which may enable a Man-in-the-middle attack that exposes sensitive data or...