193526 matches found
CVE-2026-19571 Race condition in ITE IT8xxx2 SHI host-command backend lets a second SPI request write an unvalidated length into the in-flight request buffer
The ITE IT8xxx2 SHI host-command backend subsys/mgmt/echostcmd/backends/echostcmdbackendshiite.c copied the 8-byte host-command request header from the SPI Rx FIFO directly into the shared receive buffer data-inmsg and only afterwards checked the protocol version and the derived packet length. Th...
CVE-2026-19571
A race condition exists in the ITE IT8xxx2 SHI host-command backend (specifically in ec_host_cmd_backend_shi_ite.c) within the Zephyr RTOS. The vulnerability occurs because the driver copies the 8-byte host-command request header from the SPI Rx FIFO into the shared receive buffer (data->in_ms...
CVE-2026-19571 Race condition in ITE IT8xxx2 SHI host-command backend lets a second SPI request write an unvalidated length into the in-flight request buffer
The ITE IT8xxx2 SHI host-command backend subsys/mgmt/echostcmd/backends/echostcmdbackendshiite.c copied the 8-byte host-command request header from the SPI Rx FIFO directly into the shared receive buffer data-inmsg and only afterwards checked the protocol version and the derived packet length. Th...
EUVD-2026-95527
The ITE IT8xxx2 SHI host-command backend subsys/mgmt/echostcmd/backends/echostcmdbackendshiite.c copied the 8-byte host-command request header from the SPI Rx FIFO directly into the shared receive buffer data-inmsg and only afterwards checked the protocol version and the derived packet length. Th...
CVE-2026-19571
The ITE IT8xxx2 SHI host-command backend subsys/mgmt/echostcmd/backends/echostcmdbackendshiite.c copied the 8-byte host-command request header from the SPI Rx FIFO directly into the shared receive buffer data-inmsg and only afterwards checked the protocol version and the derived packet length. Th...
CVE-2026-19571 Race condition in ITE IT8xxx2 SHI host-command backend lets a second SPI request write an unvalidated length into the in-flight request buffer
The ITE IT8xxx2 SHI host-command backend subsys/mgmt/echostcmd/backends/echostcmdbackendshiite.c copied the 8-byte host-command request header from the SPI Rx FIFO directly into the shared receive buffer data-inmsg and only afterwards checked the protocol version and the derived packet length. Th...
dlink
Iniezione di comandi e account backdoor nei dispositivi NAS D-Link Riepilogo della vulnerabilità: La vulnerabilità descritta interessa diversi dispositivi NAS D-Link, inclusi i modelli DNS-340L, DNS-320L, DNS-327L e DNS-325, tra gli altri. La vulnerabilità risiede nell'URI nassharing.cgi , che è...
CLSA-2026-1791456473 ruby: Fix of CVE-2026-42257
CVE-2026-42257: net-imap: fix CRLF/command injection by validating RawData text and embedded literals, sending the STORE attr as an atom, sending the setquota storage limit as a number, and refusing LITERAL+ writes to servers not known to support them...
Hikvision IP camera/NVR - Remote Command Execution
Certain Hikvision products contain a command injection vulnerability in the web server due to the insufficient input validation. An attacker can exploit the vulnerability to launch a command injection attack by sending some messages with malicious commands. id: CVE-2021-36260 info: name: Hikvisio...
CLEANSTART-2026-WU57451 When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as fo...
CVE-2026-39828 affects multiple packages. When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. See reference...
EUVD-2026-95328
IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command...
EUVD-2026-95331
IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command...
Cacti 1.2.22 Pre-Authentication Command Injection
Cacti versions 1.2.17 through 1.2.22 contain an unauthenticated command injection in remoteagent.php. A proof of concept demonstrates spoofing the client address and injecting a command through the pollerid parameter. https://packetstorm.news/download/235025...
GitLab Community Edition 13.10.1 Remote Command Execution
GitLab Community Edition version 13.10.1 allows unauthenticated remote command execution when a crafted image is processed by ExifTool's DjVu parser. https://packetstorm.news/download/235014...
Apache APISIX 2.11.0 Default Admin Token Remote Command Execution
Apache APISIX version 2.11.0 uses a default administrative API token that permits route creation. A route script can execute commands, resulting in remote command execution. https://packetstorm.news/download/235028...
AlmaLinux 9.2 [TuxCare] Security Update: gdb / gdb-doc / gdb-gdbserver / gdb-headless / gdb-minimal (ALMALINUX9.2:CLSA-2026:1791547259)
The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1791547259 advisory. - A flaw was found in GDB's STABS debug format parser. The readmemberfunctions function in gdb/stabsread.c contains a linked list removal bug...
Webmin 1.920 Pre-Authentication Remote Command Execution
Webmin versions through 1.920 contain a pre-authentication command injection vulnerability in passwordchange.cgi. The supplied proof of concept details a request that executes commands through the old parameter. https://packetstorm.news/download/234964...
AlmaLinux 9.6 [TuxCare] Security Update: python-unversioned-command / python3 / python3-debug / etc (ALMALINUX9.6:CLSA-2026:1791559300)
The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1791559300 advisory. - A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its snicallback assigns a different context...
CVE-2026-19571: Concurrent Execution using Shared Resource with Improper Synchronization
The ITE IT8xxx2 SHI host-command backend subsys/mgmt/echostcmd/backends/echostcmdbackendshiite.c copied the 8-byte host-command request header from the SPI Rx FIFO directly into the shared receive buffer data-inmsg and only afterwards checked the protocol version and the derived packet length. Th...
Apache Solr 7.0.1 RunExecutableListener Remote Command Execution
Apache Solr version 7.0.1 contains a flaw where an unauthenticated Config API request can add a RunExecutableListener that executes a command when a core update is committed. The supplied proof of concept provides a containerized vulnerable lab and HTTP request sequence...