483280 matches found
CVE-2026-12540
A flaw was found in Foreman. A command injection vulnerability exists in the foreman-rake errors:fetchlog task. The requestid parameter is passed to an underlying system command typically grep without adequate shell neutralization. While the task is intended to fetch specific log entries, an...
CVE-2026-12541
A flaw was found in Foreman. OS command injection vulnerabilities exist in the foreman-rake db:dump and db:importdump tasks. The application fails to properly sanitize user-supplied input in the destination parameter during backups and the file parameter during imports before passing them to a Ru...
CVE-2026-12405
A flaw was found in rubygem-foremanremoteexecution. A command injection vulnerability exists in the Red Hat Satellite API /api/v2/jobinvocations. When a job template has the effectiveuser property marked as overridable: true, the application fails to properly sanitize the effectiveuser input...
CVE-2026-12545
A flaw was found in rubygem-hammercli. A command injection vulnerability exists in Hammer CLI and the Railties Ruby on Rails component distributed with Satellite due to the insecure interpolation of the $EDITOR environment variable into the Ruby system method. By passing a single interpolated...
CVE-2026-12542
A flaw was found in Foreman. The foreman-tail utility is vulnerable to OS command injection due to the unsafe use of the eval command. The script takes user-supplied arguments and incorporates them directly into a string that is then executed by eval to expand file paths. Because the input is not...
metasploitable-exploitation-lab
Exploitation Lab — Attacking Metasploitable 2 with Kali & Meta...
CVE-2026-84372
A flaw was found in Predis, where pipeline handling on aggregate cluster and replication connections improperly parses serialized command buffers. A remote attacker can exploit this vulnerability by submitting input containing Carriage Return Line Feed CRLF sequences in keys or values handled...
CVE-2026-12541 Foreman: command injection in foreman-rake database tasks
A flaw in Foreman allows for OS command injection within the foreman-rake db:dump and db:import_dump tasks. The application fails to properly sanitize the destination parameter during backups and the file parameter during imports before passing them to a Ruby system() call . An attacker with suff...
CVE-2026-12541 Foreman: command injection in foreman-rake database tasks
A flaw was found in Foreman. OS command injection vulnerabilities exist in the foreman-rake db:dump and db:importdump tasks. The application fails to properly sanitize user-supplied input in the destination parameter during backups and the file parameter during imports before passing them to a Ru...
EUVD-2026-90918
A flaw was found in Foreman. OS command injection vulnerabilities exist in the foreman-rake db:dump and db:importdump tasks. The application fails to properly sanitize user-supplied input in the destination parameter during backups and the file parameter during imports before passing them to a Ru...
CVE-2026-12541
A flaw was found in Foreman. OS command injection vulnerabilities exist in the foreman-rake db:dump and db:importdump tasks. The application fails to properly sanitize user-supplied input in the destination parameter during backups and the file parameter during imports before passing them to a Ru...
CVE-2026-12540 Foreman: command injection in foreman-rake errors:fetch_log via request_id parameter
A flaw was found in Foreman. A command injection vulnerability exists in the foreman-rake errors:fetchlog task. The requestid parameter is passed to an underlying system command typically grep without adequate shell neutralization. While the task is intended to fetch specific log entries, an...
EUVD-2026-90916
A flaw was found in Foreman. A command injection vulnerability exists in the foreman-rake errors:fetchlog task. The requestid parameter is passed to an underlying system command typically grep without adequate shell neutralization. While the task is intended to fetch specific log entries, an...
CVE-2026-12540 Foreman: command injection in foreman-rake errors:fetch_log via request_id parameter
A command injection vulnerability exists in the Foreman software within the foreman-rake errors:fetch_log task. The flaw is caused by the request_id parameter being passed to an underlying system command (typically grep ) without sufficient shell neutralization. An attacker with sudo permissions ...
CVE-2026-12540
A flaw was found in Foreman. A command injection vulnerability exists in the foreman-rake errors:fetchlog task. The requestid parameter is passed to an underlying system command typically grep without adequate shell neutralization. While the task is intended to fetch specific log entries, an...
CVE-2026-12405 Rubygem-foreman_remote_execution: command injection in job invocations via effective_user parameter
A flaw was found in rubygem-foremanremoteexecution. A command injection vulnerability exists in the Red Hat Satellite API /api/v2/jobinvocations. When a job template has the effectiveuser property marked as overridable: true, the application fails to properly sanitize the effectiveuser input...
EUVD-2026-90914
A flaw was found in rubygem-foremanremoteexecution. A command injection vulnerability exists in the Red Hat Satellite API /api/v2/jobinvocations. When a job template has the effectiveuser property marked as overridable: true, the application fails to properly sanitize the effectiveuser input...
CVE-2026-12405 Rubygem-foreman_remote_execution: command injection in job invocations via effective_user parameter
A command injection vulnerability exists in the Red Hat Satellite API (/api/v2/job_invocations) due to improper sanitization of the effective_user input. When a job template has the effective_user property marked as overridable: true, an attacker with permissions to execute job templates can inje...
CVE-2026-12405
A flaw was found in rubygem-foremanremoteexecution. A command injection vulnerability exists in the Red Hat Satellite API /api/v2/jobinvocations. When a job template has the effectiveuser property marked as overridable: true, the application fails to properly sanitize the effectiveuser input...
vm2 CLI provides no sandbox isolation - host-realm require() is reachable from sandboxed scripts
Summary The vm2 command-line tool installed by npm install -g vm2 and documented in the README's "CLI" section runs the supplied script under NodeVM with require:external:true and no root / context / builtin configured. With these defaults the resolver loads every relative or absolute require...