CVE-2020-7350

Rapid7 Metasploit Framework versions before 5.0.85 suffers from an instance of CWE-78: OS Command Injection, wherein the libnotify plugin accepts untrusted user-supplied data via a remote computer's hostname or service name. An attacker can create a specially-crafted hostname or service name to b...

PT-2020-2706

Name of the Vulnerable Software and Affected Versions Rapid7 Metasploit Framework versions prior to 5.0.85 Description The issue arises from the libnotify plugin accepting untrusted user-supplied data via a remote computer's hostname or service name, leading to an instance of OS Command Injection...