760 matches found
Command Injection
Overview Affected versions of this package are vulnerable to Command Injection via the Resize-VHD PowerShell command construction process. An attacker can execute arbitrary PowerShell commands with the privileges of the affected process by supplying a crafted VM image path containing malicious...
EUVD-2026-22800
PowerShell Command Injection in Podman HyperV Machine...
PowerShell Command Injection in Podman HyperV Machine
Summary A command injection vulnerability exists in Podman's HyperV machine backend. The VM image path is inserted into a PowerShell double-quoted string without sanitization, allowing $ subexpression injection. Affected Code File: pkg/machine/hyperv/stubber.go:647 go resize :=...
Command Injection
Overview Affected versions of this package are vulnerable to Command Injection via the Resize-VHD PowerShell command construction process. An attacker can execute arbitrary PowerShell commands with the privileges of the affected process by supplying a crafted VM image path containing malicious...
GHSA-HC8W-H2MF-HP59 PowerShell Command Injection in Podman HyperV Machine
Summary A command injection vulnerability exists in Podman's HyperV machine backend. The VM image path is inserted into a PowerShell double-quoted string without sanitization, allowing $ subexpression injection. Affected Code File: pkg/machine/hyperv/stubber.go:647 go resize :=...
EUVD-2026-22534
Improper input validation in Windows Hyper-V allows an authorized attacker to execute code locally...
CVE-2026-32149
Improper input validation in Windows Hyper-V allows an authorized attacker to execute code locally...
CVE-2026-33414: Improper Neutralization of Special Elements used in an OS Command
Podman is a tool for managing OCI containers and pods. Versions 4.8.0 through 5.8.1 contain a command injection vulnerability in the HyperV machine backend in pkg/machine/hyperv/stubber.go, where the VM image path is inserted into a PowerShell double-quoted string without sanitization, allowing $...
PT-2026-32953
Name of the Vulnerable Software and Affected Versions Podman versions 4.8.0 through 5.8.1 Description A command injection issue exists in the HyperV machine backend within the file pkg/machine/hyperv/stubber.go. The VM image path is inserted into a PowerShell double-quoted string without...
Ubuntu 22.04 LTS / 24.04 LTS / 25.10 : QEMU vulnerabilities (USN-8161-1)
The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8161-1 advisory. It was discovered that the LSI53C895A SCSI Host Bus Adapter implementation of QEMU incorrectly handled memory. An attacker inside the...
The vulnerability of the hvfb_putmem() function in the drivers/video/fbdev/hyperv_fb.c driver module allows a hacker to cause a service failure.
The vulnerability of the hvfbputmem function in the drivers/video/fbdev/hypervfb.c driver for supporting kernel frame buffer devices in the Linux operating system is related to the copying of buffers without checking the size of the input data a classic buffer overflow attack. Exploiting this...
The vulnerability of the mousevsc_on_receive() function in the drivers/hid/hid-hyperv.c file of the Linux kernel subsystem for user interface devices’ drivers allows a hacker to cause a service failure.
The vulnerability of the mousevsconreceive function in the drivers/hid/hid-hyperv.c file of the Linux kernel’s input device subsystem driver is related to the copying of buffers without checking the size of the input data a classic buffer overflow attack. Exploiting this vulnerability could allow...
The vulnerability of the vmbus_device_register() function in the drivers/hv/vmbus_drv.c module of the support driver for Microsoft HyperV Linux kernel allows a malicious actor to cause a service failure.
The vulnerability of the vmbusdeviceregister function in the drivers/hv/vmbusdrv.c module of the Microsoft HyperV Linux kernel support driver is related to improper initialization. Exploiting this vulnerability could allow an attacker to cause service failures...
The vulnerability of the vmbus_acpi_add() function in the drivers/hv/vmbus_drv.c module of the Microsoft HyperV Linux operating system kernel allows a attacker to cause a service failure.
The vulnerability of the vmbusacpiadd function in the drivers/hv/vmbusdrv.c module of the Microsoft HyperV Linux operating system’s guest mode driver is related to pointer manipulation. Exploiting this vulnerability could allow an attacker to cause a service failure...
Unity Linux 20.1070a Security Update: kernel (UTSA-2026-005644)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005644 advisory. In the Linux kernel, the following vulnerability has been resolved: scsi: storvsc: Fix handling of virtual Fibre Channel timeouts Hyper-V provides the ability to...
AZL-79353 CVE-2026-0032 affecting package hyperv-daemons 5.15.200.1-1
In multiple functions of memprotect.c, there is a possible out-of-bounds write due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
AZL-79382 CVE-2026-0031 affecting package hyperv-daemons 6.6.126.1-1
In multiple functions of memprotect.c, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
AZL-79385 CVE-2026-0032 affecting package hyperv-daemons 6.6.126.1-1
In multiple functions of memprotect.c, there is a possible out-of-bounds write due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
AZL-79356 CVE-2026-0031 affecting package hyperv-daemons 5.15.200.1-1
In multiple functions of memprotect.c, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
