Caldera Arbitrary Code Execution Vulnerability

Caldera is a suite of software from the French company Caldera that provides color management, imaging and processing solutions for printer devices. An arbitrary code execution vulnerability exists in Caldera version 2.8.1. The vulnerability stems from the Human plugin passing an unfiltered name...

CVE-2022-21386: Undefined Security Weakness

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Web Container. Supported versions that are affected are 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to...

Oracle Construction and Engineering Suite 安全漏洞

Oracle Construction and Engineering Suite is a portfolio management solution suite product for construction projects from Oracle Corporation. A security vulnerability in Oracle Construction and Engineering Suite's Primavera Portfolio Management product could allow an unauthenticated attacker to...

PT-2022-2001 · Oracle +1 · Mysql Cluster +1

Name of the Vulnerable Software and Affected Versions: MySQL Cluster versions 7.4.34 and prior MySQL Cluster versions 7.5.24 and prior MySQL Cluster versions 7.6.20 and prior MySQL Cluster versions 8.0.27 and prior Description: The issue is related to insufficient input validation in the MySQL...

PT-2022-2024 · Oracle +1 · Mysql Cluster +1

Name of the Vulnerable Software and Affected Versions: MySQL Cluster versions 7.4.34 and prior MySQL Cluster versions 7.5.24 and prior MySQL Cluster versions 7.6.20 and prior MySQL Cluster versions 8.0.27 and prior Description: The issue is related to insufficient input validation in the MySQL...

PT-2022-2000 · Oracle +1 · Mysql Cluster +1

Name of the Vulnerable Software and Affected Versions: MySQL Cluster versions 7.5.24 and prior MySQL Cluster versions 7.6.20 and prior MySQL Cluster versions 8.0.27 and prior Description: The issue exists due to insufficient input validation in the MySQL Cluster component. Exploitation of this...

PT-2022-2010 · Oracle +1 · Mysql Cluster +1

Name of the Vulnerable Software and Affected Versions: MySQL Cluster versions 7.4.34 and prior MySQL Cluster versions 7.5.24 and prior MySQL Cluster versions 7.6.20 and prior MySQL Cluster versions 8.0.27 and prior Description: The issue allows a high-privileged attacker with access to the physic...

PT-2022-2105

Name of the Vulnerable Software and Affected Versions Primavera Portfolio Management versions 18.0.0.0 through 18.0.3.0 Primavera Portfolio Management versions 19.0.0.0 through 19.0.1.2 Primavera Portfolio Management versions 20.0.0.0 through 20.0.0.1 Description The issue is related to...

PT-2022-2094

Name of the Vulnerable Software and Affected Versions Primavera Portfolio Management versions 18.0.0.0 through 18.0.3.0 Primavera Portfolio Management versions 19.0.0.0 through 19.0.1.2 Primavera Portfolio Management version 20.0.0.0 Description The issue is related to insufficient input validati...

PT-2022-2093

Name of the Vulnerable Software and Affected Versions Primavera Portfolio Management versions 18.0.0.0 through 18.0.3.0 Primavera Portfolio Management versions 19.0.0.0 through 19.0.1.2 Primavera Portfolio Management versions 20.0.0.0 through 20.0.0.1 Description The issue is related to...

CVE-2021-42561

An issue was discovered in CALDERA 2.8.1. When activated, the Human plugin passes the unsanitized name parameter to a python "os.system" function. This allows attackers to use shell metacharacters e.g., backticks "" or dollar parenthesis "$" in order to escape the current command and execute...

CVE-2021-42561

An issue was discovered in CALDERA 2.8.1. When activated, the Human plugin passes the unsanitized name parameter to a python "os.system" function. This allows attackers to use shell metacharacters e.g., backticks "" or dollar parenthesis "$" in order to escape the current command and execute...

Design/Logic Flaw

An issue was discovered in CALDERA 2.8.1. When activated, the Human plugin passes the unsanitized name parameter to a python "os.system" function. This allows attackers to use shell metacharacters e.g., backticks "" or dollar parenthesis "$" in order to escape the current command and execute...

CVE-2021-42561

CVE-2021-42561 affects CALDERA 2.8.1 where the Human plugin passes an unsanitized name parameter to Python os.system, enabling shell metacharacters to escape commands and execute arbitrary code. Multiple vendors and advisories (Red Hat, CNVD, OSV, CVE lists) corroborate a command-injection vulner...

EUVD-2021-29529

An issue was discovered in CALDERA 2.8.1. When activated, the Human plugin passes the unsanitized name parameter to a python "os.system" function. This allows attackers to use shell metacharacters e.g., backticks "" or dollar parenthesis "$" in order to escape the current command and execute...

CVE-2021-42561

An issue was discovered in CALDERA 2.8.1. When activated, the Human plugin passes the unsanitized name parameter to a python "os.system" function. This allows attackers to use shell metacharacters e.g., backticks "" or dollar parenthesis "$" in order to escape the current command and execute...

CVE-2021-42561

An issue was discovered in CALDERA 2.8.1. When activated, the Human plugin passes the unsanitized name parameter to a python "os.system" function. This allows attackers to use shell metacharacters e.g., backticks "" or dollar parenthesis "$" in order to escape the current command and execute...

Demystifying XDR: How Humans and Machines Join Forces in Threat Response

In our first post on demystifying the concepts and practices behind extended detection and response XDR technology, Forrester analyst Allie Mellen joined Sam Adams, Rapid7's VP for Detection and Response, to outline the basic framework for XDR and highlight the key outcomes it can help security...

CVE-2021-42561: Improper Neutralization of Special Elements in Output Used by a Downstream Component

An issue was discovered in CALDERA 2.8.1. When activated, the Human plugin passes the unsanitized name parameter to a python "os.system" function. This allows attackers to use shell metacharacters e.g., backticks "" or dollar parenthesis "$" in order to escape the current command and execute...

Caldera 注入漏洞

Caldera is a suite of software from the French company Caldera that provides color management, imaging and processing solutions for printer devices. An arbitrary code execution vulnerability exists in Caldera version 2.8.1. The vulnerability stems from the Human plugin passing an unfiltered name...