PT-2025-3301 · Fortinet · Fortirecorder +1

Name of the Vulnerable Software and Affected Versions: FortiMail versions 6.4.0 through 6.4.7 FortiMail versions 7.0.0 through 7.0.6 FortiMail versions 7.2.0 through 7.2.4 FortiRecorder versions 6.4.0 through 6.4.4 FortiRecorder version 7.0.0 Description: An improper neutralization of special...

PT-2025-4794 · Hewlett Packard · Hpe Aruba Networking Aos

The network management service is affected by an authenticated command injection issue in its command line interface, which could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system. Unfortunately, the specific versions of the network management...

Fortinet FortiSwitch 操作系统命令注入漏洞

Fortinet FortiSwitch is a network switch management tool from Fortinet. An operating system command injection vulnerability exists in Fortinet FortiSwitch that stems from improper neutralization of a special element, allowing an attacker to execute unauthorized code or commands via the FortiSwitc...

HPESBNW04723 rev.1 - Authenticated Remote Arbitrary Code Execution in the AOS-8 and AOS-10 Command Line Interface

Potential Security Impact: Remote: Arbitrary Code Execution, Arbitrary Command Execution, Arbitrary File Modification, Code Execution, Unauthorized Data Injection SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. ArubaOS SD-WAN Gateways : Please refer to the Description section of...

Fortinet FortiRecorder 路径遍历漏洞

Fortinet FortiRecorder is a Web-based network video recorder management system from Fortinet. A path traversal vulnerability exists in Fortinet FortiRecorder that stems from incorrectly restricting path names to restricted directories, resulting in a path traversal vulnerability. A privileged...

Huawei EulerOS: Security Advisory for vim (EulerOS-SA-2025-1016)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

BIT-NODE-2024-27980

Due to the improper handling of batch files in childprocess.spawn / childprocess.spawnSync, a malicious command line argument can inject arbitrary commands and achieve code execution even if the shell option is not enabled...

CVE-2025-21596

An Improper Handling of Exceptional Conditions vulnerability in the command-line processing of Juniper Networks Junos OS on SRX1500, SRX4100, and SRX4200 devices allows a local, low-privileged authenticated attacker executing the 'show chassis environment pem' command to cause the chassis daemon...

CVE-2025-21596 Junos OS: SRX1500,SRX4100,SRX4200: Execution of low-privileged CLI command results in chassisd crash

An Improper Handling of Exceptional Conditions vulnerability in the command-line processing of Juniper Networks Junos OS on SRX1500, SRX4100, and SRX4200 devices allows a local, low-privileged authenticated attacker executing the 'show chassis environment pem' command to cause the chassis daemon...

[SECURITY] Fedora 41 Update: curl-8.9.1-3.fc41

curl is a command line tool for transferring data with URL syntax, supporting FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, IMA P, SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP uploading, HTTP form based upload, proxies, cookies,...

CVE-2024-27980

Due to the improper handling of batch files in childprocess.spawn / childprocess.spawnSync, a malicious command line argument can inject arbitrary commands and achieve code execution even if the shell option is not enabled...

Juniper Networks Junos OS SRX 信息泄露漏洞

Juniper Networks Junos OS SRX is a Juniper Networks, Inc. network operating system designed for the company's hardware devices. The operating system provides a secure programming interface and the Junos SDK. An information disclosure vulnerability exists in Juniper Networks Junos OS SRX, which...

Apache Airflow 代码问题漏洞

Apache Airflow is a set of open source platforms for creating, managing and monitoring workflows from the US Apache Apache Foundation. The platform is characterized by scalability and dynamic monitoring. A security vulnerability exists in Apache Airflow versions prior to 1.5.2 that stems from a...

The vulnerability of the Command Line Interface (CLI) of the Skupper package, a software management and microservice integration tool for cloud and hybrid environments under Red Hat Service Interconnect, allows an attacker to gain unauthorized access to protected information or cause service failures.

The vulnerability of the Command Line Interface CLI of the Skupper package, a software tool for managing and integrating microservices in cloud and hybrid environments of Red Hat Service Interconnect, relates to the bypassing of authentication by using the default mode. Exploiting this...

GHSA-94P5-R7CC-3RPR path-sanitizer allows bypassing the existing filters to achieve path-traversal vulnerability

Summary This is a POC for a path-sanitizer npm package. The filters can be bypassed and can result in path traversal. Payload: ..=%5c can be used to bypass this on CLI along with other candidates. Something similar would likely work on web apps as well. PoC Here's the code to test for the filter...

path-sanitizer allows bypassing the existing filters to achieve path-traversal vulnerability

Summary This is a POC for a path-sanitizer npm package. The filters can be bypassed and can result in path traversal. Payload: ..=%5c can be used to bypass this on CLI along with other candidates. Something similar would likely work on web apps as well. PoC Here's the code to test for the filter...

SQLite report about CVE-2025-70873

When using the zipfile extension not a part of standard SQLite but usually included in builds of the CLI, a malformed ZIP file input can result in an out-of-bounds read. Reported by forum post 2025-12-06T16:46:32Z and fixed in trunk by check-in 2025-12-06T23:58:09.413Z...

CVE-2021-26115

An OS command injection CWE-78 vulnerability in FortiWAN version 4.5.7 and below Command Line Interface may allow a local, authenticated and unprivileged attacker to escalate their privileges to root via executing a specially-crafted command.An OS command injection CWE-78 vulnerability in FortiWA...

CVE-2021-26115

An OS command injection CWE-78 vulnerability in FortiWAN version 4.5.7 and below Command Line Interface may allow a local, authenticated and unprivileged attacker to escalate their privileges to root via executing a specially-crafted command.An OS command injection CWE-78 vulnerability in FortiWA...

CVE-2021-26115

An OS command injection CWE-78 vulnerability in FortiWAN version 4.5.7 and below Command Line Interface may allow a local, authenticated and unprivileged attacker to escalate their privileges to root via executing a specially-crafted command.An OS command injection CWE-78 vulnerability in FortiWA...