CVE-2023-20260

A vulnerability in the application CLI of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager could allow an authenticated, local attacker to gain escalated privileges. This vulnerability is due to improper processing of command line arguments to application scripts. An...

Hex Workshop Buffer Error Vulnerability

Hex Workshop is a suite of hexadecimal development tools for Microsoft Windows that combines advanced binary editing with the ease of use and flexibility of a word processor. A buffer error vulnerability exists in Hex Workshop version 6.7, which stems from the presence of a denial of service DOS...

PT-2024-15552 · Unknown · Hex Workshop

Name of the Vulnerable Software and Affected Versions: Hex Workshop version 6.7 Description: A denial of service issue has been identified, where an attacker can send command line file arguments to control the Structured Exception Handler SEH records, resulting in a service shutdown...

USN-6478-1 traceroute vulnerability

It was discovered that Traceroute did not properly parse command line arguments. An attacker could possibly use this issue to execute arbitrary commands...

The vulnerability lies in the cropImage function of the software tool for creating and distributing content with LG Simple Editor. This function allows a malicious user to delete any files they desire.

The vulnerability of the cropImage function in the software for creating and distributing content with LG Simple Editor arises due to a typing error during the processing of command-line arguments that handle directory traversal. Exploiting this vulnerability allows an attacker to send specially...

PT-2023-4613 · Cisco · Cisco Thousandeyes Enterprise Agent

Name of the Vulnerable Software and Affected Versions: Cisco ThousandEyes Enterprise Agent, Virtual Appliance installation type affected versions not specified Description: A vulnerability in the CLI of Cisco ThousandEyes Enterprise Agent could allow an authenticated, local attacker to elevate...

OESA-2023-1399 librabbitmq security update

This is a C-language AMQP client library for use with AMQP servers speaking protocol versions 0-9-1. Security Fixes: An issue was discovered in the C AMQP client library aka rabbitmq-c through 0.13.0 for RabbitMQ. Credentials can only be entered on the command line e.g., for amqp-publish or...

Vulnerability Spotlight: Vulnerabilities in IBM AIX could lead to command injection with elevated privileges

Tim Brown of Cisco Security Advisory EMEA discovered these vulnerabilities and contributed to this blog post. A Cisco security researcher recently discovered two vulnerabilities in the IBM AIX Unix platforms that could be exploited to inject commands and logs into targeted systems with elevated...

K11922628: NGINX Controller sensitive command-line arguments vulnerability CVE-2020-5866

Security Advisory Description The helper.sh script, which is used optionally in NGINX Controller to change settings, uses sensitive items as command-line arguments. CVE-2020-5866 Impact The affected script causes sensitive items to display in the system process listing ps , top while the helper.s...

SUSE CVE-2012-3419

Performance Co-Pilot PCP before 3.6.5 exports some of the /proc file system, which allows attackers to obtain sensitive information such as proc/pid/maps and command line arguments...

SUSE CVE-2017-1000369

Exim supports the use of multiple "-p" command line arguments which are malloc'ed and never free'ed, used in conjunction with other issues allows attackers to cause arbitrary code execution. This affects exim version 4.89 and earlier. Please note that at this time upstream has released a patch...

SUSE CVE-2020-6799

Command line arguments could have been injected during Firefox invocation as a shell handler for certain unsupported file types. This required Firefox to be configured as the default handler for a given file type and for a file downloaded to be opened in a third party application that...

SSTImap - Automatic SSTI Detection Tool With Interactive Interface

SSTImap is a penetration testing software that can check websites for Code Injection and Server-Side Template Injection vulnerabilities and exploit them, giving access to the operating system itself. This tool was developed to be used as an interactive penetration testing tool for SSTI detection...

PT-2023-1332 · Node.Js · Node.Js

Name of the Vulnerable Software and Affected Versions: Node.js affected versions not specified Description: The issue is related to incorrect exception handling in the src/node options-inl.h file when an invalid command-line argument is provided. This can allow a remote attacker to cause the...

CVE-2022-22984 Command Injection

The package snyk before 1.1064.0; the package snyk-mvn-plugin before 2.31.3; the package snyk-gradle-plugin before 3.24.5; the package @snyk/snyk-cocoapods-plugin before 2.5.3; the package snyk-sbt-plugin before 2.16.2; the package snyk-python-plugin before 1.24.2; the package snyk-docker-plugin...

Dumpscan - Tool To Extract And Dump Secrets From Kernel And Windows Minidump Formats

Dumpscan is a command-line tool designed to extract and dump secrets from kernel and Windows Minidump formats. Kernel-dump parsing is provided by volatility3. Features x509 Public and Private key PKCS 8/PKCS 1 parsing SymCrypt parsing Supported structures SYMCRYPTRSAKEY - Determines if the key...

gps-sdr-sim 安全漏洞

gps-sdr-sim is a software-defined GPS signal simulator from the individual developers of OSQZSS in Japan. A security vulnerability exists in gps-sdr-sim v1.0, which stems from a buffer overflow when parsing long command line arguments, resulting in a denial of service or code execution...

CodeIgniter arbitrary code execution

system/libraries/Email.php in CodeIgniter before 3.1.3 allows remote attackers to execute arbitrary code by leveraging control over the email-from field to insert sendmail command-line arguments...

golang: Command-line arguments may overwrite global data

A flaw was found in golang. This vulnerability can only be triggered when invoking functions from vulnerable WASM WebAssembly Modules. Go can be compiled to WASM. If the product or service doesn't use WASM functions, it is not affected, although it uses golang...

Vulnerability fixed in Zoho ManageEngine ADSelfService Plus

Zoho has fixed a vulnerability in ManageEngine ADSelfService Plus. An authenticated malicious person could potentially potentially exploit it to execute arbitrary code. The vulnerability is located in the password reset functionality. Systems are vulnerable only when custom scripts are enabled fo...