PT-2023-22116 · Xcc · Xcc

Name of the Vulnerable Software and Affected Versions: XCC affected versions not specified Description: A valid, authenticated XCC user with read-only permissions can modify custom user roles on other user accounts and the user trespass message through the XCC CLI. There is no exposure if SSH is...

CVE-2023-2273

Rapid7 Insight Agent token handler versions 3.2.6 and below, suffer from a Directory Traversal vulnerability whereby unsanitized input from a CLI argument flows into io.ioutil.WriteFile, where it is used as a path. This can result in a Path Traversal vulnerability and allow an attacker to write...

Vulnerability Spotlight: Vulnerabilities in IBM AIX could lead to command injection with elevated privileges

Tim Brown of Cisco Security Advisory EMEA discovered these vulnerabilities and contributed to this blog post. A Cisco security researcher recently discovered two vulnerabilities in the IBM AIX Unix platforms that could be exploited to inject commands and logs into targeted systems with elevated...

KubeStalk - Discovers Kubernetes And Related Infrastructure Based Attack Surface From A Black-Box Perspective

KubeStalk is a tool to discover Kubernetes and related infrastructure based attack surface from a black-box perspective. This tool is a community version of the tool used to probe for unsecured Kubernetes clusters around the internet during Project Resonance - Wave 9. Usage The GIF below...

Fedora: Security Advisory for doctl (FEDORA-2023-3737bc1c0a)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 37 Update: doctl-1.93.1-2.fc37

The official command line interface for the DigitalOcean API...

[SECURITY] Fedora 38 Update: tcpdump-4.99.4-1.fc38

Tcpdump is a command-line tool for monitoring network traffic. Tcpdump can capture and display the packet headers on a particular network interface or on all interfaces. Tcpdump can display all of the packet headers, or just the ones that match particular criteria. Install tcpdump if you need a...

[SECURITY] Fedora 37 Update: gh-2.27.0-1.fc37

GitHub=EF=BF=BD=EF=BF=BD=EF=BF=BDs official command line tool...

[SECURITY] Fedora 37 Update: golang-github-cli-gh-1.2.1-2.fc37

A Go module for interacting with gh and the GitHub API from the command line...

The vulnerability of the HSTS (HTTP Strict Transport Security) mechanism in the cURL command line utility allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the HSTS HTTP Strict Transport Security mechanism in the CURL command line utility is related to the transmission of critical information in plaintext when IDN symbols in host names are replaced with similar ASCII symbols. Exploiting this vulnerability can allow an unauthoriz...

CVE-2023-28980

A Use After Free vulnerability in the routing protocol daemon of Juniper Networks Junos OS and Junos OS Evolved allows a locally authenticated attacker with low privileges to cause Denial of Service DoS. In a rib sharding scenario the rpd process will crash shortly after specific CLI command is...

LibTIFF 缓冲区错误漏洞

LibTIFF is a library for reading and writing TIFF Tagged Image File Format files. The library contains some command line tools for working with TIFF files. A security vulnerability exists in LibTIFF that stems from the presence of a buffer overflow vulnerability...

LibTIFF 缓冲区错误漏洞

LibTIFF is a library for reading and writing TIFF Tagged Image File Format files. The library contains some command line tools for working with TIFF files. A security vulnerability exists in LibTIFF that stems from the presence of a buffer overflow vulnerability...

Remote code execution

An issue was discovered in GitLab Community and Enterprise Edition before 11.11.8, 12 before 12.0.6, and 12.1 before 12.1.6. Gitaly allows injection of command-line flags. This sometimes leads to privilege escalation or remote code execution...

Fedora: Security Advisory for skopeo (FEDORA-2023-ccaf5538dd)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 38 Update: skopeo-1.11.2-1.fc38

Command line utility to inspect images and repositories directly on Docker registries without the need to pull them...

CVE-2019-14944

CVE-2019-14944 affects GitLab Community and Enterprise Edition before 11.11.8, 12 before 12.0.6, and 12.1 before 12.1.6. The issue in Gitaly allows injection of command-line flags, which can lead to privilege escalation or remote code execution . Affected component is the Gitaly binary used by Gi...

CVE-2023-29193 SpiceDB binding metrics port to untrusted networks and can leak command-line flags

SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical application permissions. The spicedb serve command contains a flag named --grpc-preshared-key which is used to protect the gRPC API from being accessed by unauthorized requests. The...

CVE-2023-29193 SpiceDB binding metrics port to untrusted networks and can leak command-line flags

SpiceDB is an open source, Google Zanzibar-inspired, database system for creating and managing security-critical application permissions. The spicedb serve command contains a flag named --grpc-preshared-key which is used to protect the gRPC API from being accessed by unauthorized requests. The...

CVE-2023-1863

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Eskom Water Metering Software allows Command Line Execution through SQL Injection. This issue affects Water Metering Software: before 23.04.06...