CVE-2022-47926: Improper Neutralization of Argument Delimiters in a Command

AyaCMS 3.1.2 is vulnerable to file deletion via /aya/module/admin/fstdel.inc.php...

CVE-2022-36069

Poetry is a dependency manager for Python. When handling dependencies that come from a Git repository instead of a registry, Poetry uses various commands, such as "git clone". These commands are constructed using user input e.g. the repository URL. When building the commands, Poetry correctly...

CVE-2021-45456

CVE-2021-45456 affects Apache Kylin 4.0.0. Multiple connected sources describe a mismatch between the legitimacy check for the project name and the shell command argument in DiagnosisService, enabling potential command injection. The issue is network-exploitable with a very high CVSS score (3.1: ...

PT-2021-4684 · Cisco · Cisco Ftd

Name of the Vulnerable Software and Affected Versions: Cisco Firepower Threat Defense FTD Software affected versions not specified Description: The issue is related to insufficient validation of command arguments in the Command Line Interface CLI of Cisco Firepower Threat Defense FTD Software. Th...

PT-2021-18730

Name of the Vulnerable Software and Affected Versions PAN-OS versions prior to 8.1.19 PAN-OS versions prior to 9.0.14 PAN-OS versions prior to 9.1.10 Description An OS command argument injection vulnerability in the Palo Alto Networks PAN-OS web interface enables an authenticated administrator to...

PT-2021-21119

Name of the Vulnerable Software and Affected Versions: Echo ShareCare version 8.15.5 Description: An issue was discovered in the UnzipFile feature, specifically in Access/EligFeedParse Sup/UnzipFile Upd.cfm, which is susceptible to a command argument injection vulnerability. This occurs when...

CVE-2021-36122: Improper Neutralization of Argument Delimiters in a Command

An issue was discovered in Echo ShareCare 8.15.5. The UnzipFile feature in Access/EligFeedParseSup/UnzipFileUpd.cfm is susceptible to a command argument injection vulnerability when processing remote input in the zippass parameter from an authenticated user, leading to the ability to inject...

The vulnerability of the server software BIG-IQ Centralized Management lies in insufficient validation of arguments passed in commands, allowing a perpetrator to execute arbitrary commands on the target system.

The vulnerability of the server software in BIG-IQ Centralized Management lies in insufficient validation of the arguments passed in commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands on the target system by entering specially crafted control commands...

PT-2021-17017

Name of the Vulnerable Software and Affected Versions VembuBDR versions prior to 4.2.0.1 VembuOffsiteDR versions prior to 4.2.0.1 Description The issue allows an unauthenticated attacker to execute arbitrary shell commands by using the command argument in the http API located at "/sgwebservice...

DEBIAN-CVE-2014-8139

Heap-based buffer overflow in the CRC32 verification in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the -t command argument to the unzip command...

CVE-2014-8140

Heap-based buffer overflow in the testcompreb function in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the -t command argument to the unzip command...

CVE-2014-8140

Heap-based buffer overflow in the testcompreb function in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the -t command argument to the unzip command...

CVE-2014-8139: Out-of-bounds Write

Heap-based buffer overflow in the CRC32 verification in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the -t command argument to the unzip command...

CVE-2019-16255

Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows code injection if the first argument aka the "command" argument to Shell or Shelltest in lib/shell.rb is untrusted data. An attacker can exploit this to call an arbitrary Ruby method...

PT-2019-4295 · Centos · Centos Web Panel

Name of the Vulnerable Software and Affected Versions: CentOS Web Panel version 0.9.8.885 Description: The issue is related to a lack of input sanitization in the filemanager2.php component, allowing for the execution of arbitrary HTML code or JavaScript scripts. This can be exploited via the cmd...

The vulnerability of the docker build mechanism, a tool for automating the deployment and management of applications in containerized environments, allows an attacker to gain unauthorized access to information, cause service failures, or affect the availability of information.

The vulnerability of the docker build mechanism, a tool for automating the deployment and management of applications in containerized environments, is related to insufficient testing of arguments passed in commands. Exploiting this vulnerability can allow attackers to gain unauthorized access to...

CVE-2019-1610

A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system of an affected device. The vulnerability is due to insufficient validation of arguments passed to certain CLI commands. An attacker coul...

PT-2018-13002

Name of the Vulnerable Software and Affected Versions Cisco IOS XE Software affected versions not specified Description A vulnerability in the CLI parser could allow an authenticated, local attacker to gain access to the underlying Linux shell of an affected device and execute arbitrary commands...

PT-2018-8654

Name of the Vulnerable Software and Affected Versions: Cisco IOS XE Software affected versions not specified Description: The issue is related to multiple vulnerabilities in the CLI parser of the software. These vulnerabilities could allow an authenticated, local attacker to gain access to the...

OPENSUSE-SU-2017:0737-1 Security update for irssi

This update to irssi 1.0.2 fixes security issues and bugs. The following vulnerabilities were fixed: boo1029020: Use after free while producing list of netjoins The following non-security changes are included: - Fix in command arg parser to detect missing arguments in tail place - Fix regression...