trace-cmd bug fix and enhancement update

An update is available for trace-cmd. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky Enterpri...

trace-cmd bug fix and enhancement update

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section...

PT-2021-5459

Name of the Vulnerable Software and Affected Versions QEMU versions up to and including 6.0 Description An information disclosure issue exists in the virtio vhost-user GPU device of QEMU, specifically in the virgl cmd get capset info function in contrib/vhost-user-gpu/virgl.c. This issue could...

PT-2021-5462

Name of the Vulnerable Software and Affected Versions QEMU versions up to and including 6.0 Description The issue is related to an out-of-bounds write vulnerability in the virtio vhost-user GPU device of QEMU. This vulnerability occurs while processing the VIRTIO GPU CMD GET CAPSET command from t...

PT-2021-10625

Name of the Vulnerable Software and Affected Versions: uniview ISC2500-S affected versions not specified Description: An issue was discovered where an attacker can upload malicious code via the "Interface/DevManage/EC.php?cmd=upload" endpoint. Recommendations: At the moment, there is no informati...

CVE-2020-21452: Unrestricted Upload of File with Dangerous Type

An issue was discovered in uniview ISC2500-S. This is an upload vulnerability where an attacker can upload malicious code via /Interface/DevManage/EC.php?cmd=upload...

GO-2021-0068 Arbitrary code injection via the go command with cgo on Windows in cmd/go

The go command may execute arbitrary code at build time when using cgo on Windows. This can be triggered by running go get on a malicious module, or any other time the code is built...

CVE-2021-30184

GNU Chess 6.2.7 allows attackers to execute arbitrary code via crafted PGN Portable Game Notation data. This is related to a buffer overflow in the use of a .tmp.epd temporary file in the cmdpgnload and cmdpgnreplay functions in frontend/cmd.cc...

PT-2021-18658

Name of the Vulnerable Software and Affected Versions GNU Chess version 6.2.7 Description The issue allows attackers to execute arbitrary code via crafted PGN Portable Game Notation data. This is related to a buffer overflow in the use of a .tmp.epd temporary file in the cmd pgnload and cmd...

PT-2021-10381

Name of the Vulnerable Software and Affected Versions: INSMA Wifi Mini Spy 1080P HD Security IP Camera version 1.9.7 B Description: An issue allows an unauthenticated attacker to cause a Denial of Service by rebooting the device. This can be achieved by sending a hidden reboot command to the...

Command injection in wc-cmd

REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

GHSA-MX3R-W3PJ-7WV7 Command injection in wc-cmd

REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

CVE-2021-23347

The package github.com/argoproj/argo-cd/cmd before 1.7.13, from 1.8.0 and before 1.8.6 are vulnerable to Cross-site Scripting XSS the SSO provider connected to Argo CD would have to send back a malicious error message containing JavaScript to the user...

CVE-2021-23347: Improper Neutralization of Input During Web Page Generation

The package github.com/argoproj/argo-cd/cmd before 1.7.13, from 1.8.0 and before 1.8.6 are vulnerable to Cross-site Scripting XSS the SSO provider connected to Argo CD would have to send back a malicious error message containing JavaScript to the user...

Command Injection

wc-cmd is vulnerable to command injection. An attacker is able to inject and execute malicious command via the index.js file...

RAT-el - An Open Source Penetration Test Tool That Allows You To Take Control Of A Windows Machine

RAT-el is an open source penetration test tool that allows you to take control of a windows machine. It works on the client-server model, the server sends commands and the client executes the commands and sends the result back to the server. The client is completely undetectable by anti-virus...

PT-2021-11530

Name of the Vulnerable Software and Affected Versions: wc-cmd versions all Description: The issue concerns command injection via the index.js file in the wc-cmd package. An example of exploitation is provided using the require function to execute a command, such as touch JHU. Recommendations: For...

3di-cmd-client (>=0.0.1a0, <=0.0.3), aboutcode (3.0.0.dev3) +891 more potentially affected by CVE-2020-28493 via jinja2 (>=2.7.2, <=2.11.2)

jinja2 PYPI version =2.7.2, =0.0.1a0, =0.0.0, =0.4.0, =0.0.1, =0.2.0, =0.0.3, =1.0.0, =2022.9.19, =0.2.0, =0.5.1, =0.2.0, =0.5.0 and more Source cves: CVE-2020-28493 Source advisory: MEND:CVE-2020-28493...

PT-2021-7251

Name of the Vulnerable Software and Affected Versions Infiray IRAY-A8Z3 version 1.0.957 Description The issue is related to the webserver of the Infiray IRAY-A8Z3, which contains an endpoint that can execute arbitrary commands. This can be achieved by manipulating the cmd string URL parameter. Th...

CVE-2021-3115

A flaw was found in golang: cmd/go, in which Go can execute arbitrary commands at build time when cgo is in use on Windows OS. On Linux/Unix, only users who have "." listed explicitly in their PATH variable are affected. The highest threat from this vulnerability is to data confidentiality and...