Privilege Escalation

The kernel contains privilege escalation. A flaw in devload could allow a local user who has the CAPNETADMIN capability to load arbitrary modules from "/lib/modules/", instead of only netdev modules...

CVE-2020-7615

fsa through 0.5.1 is vulnerable to Command Injection. The first argument of 'execGitCommand', located within 'lib/rep.js63' can be controlled by users without any sanitization to inject arbitrary commands...

Command injection

fsa through 0.5.1 is vulnerable to Command Injection. The first argument of 'execGitCommand', located within 'lib/rep.js63' can be controlled by users without any sanitization to inject arbitrary commands...

CVE-2020-7615

The CVE-2020-7615 entry concerns fsa (File system auditor) up to version 0.5.1. Connected sources provide concrete details: the vulnerability is an OS command injection in the first argument to execGitCommand() located in lib/rep.js (line 63). An attacker can supply unsanitized input to inject ar...

The vulnerability of the Pulverizr package in the NPM package manager allows a hacker to execute arbitrary commands.

The vulnerability of the Pulverizr package exists because measures to neutralize special elements have not been taken. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands on the target system by creating a file with malicious content and the name lib/job.js...

Security update for nghttp2 (moderate)

openSUSE Security Update: Security update for nghttp2 Announcement ID: openSUSE-SU-2020:0379-1 Rating: moderate References: 1159003 1166481 Cross-References: CVE-2019-18802 Affected Products: openSUSE Leap 15.1 An update that solves one vulnerability and has one errata is now available...

CVE-2020-10879

rConfig before 3.9.5 allows command injection by sending a crafted GET request to lib/crud/search.crud.php since the nodeId parameter is passed directly to the exec function without being escaped...

CVE-2020-10879

rConfig before 3.9.5 allows command injection by sending a crafted GET request to lib/crud/search.crud.php since the nodeId parameter is passed directly to the exec function without being escaped...

CVE-2020-7604

pulverizr through 0.7.0 allows execution of arbitrary commands. Within "lib/job.js", the variable "filename" can be controlled by the attacker. This function uses the variable "filename" to construct the argument of the exec call without any sanitization. In order to successfully exploit this...

Directory traversal

An issue was discovered in the File Upload plugin before 4.13.0 for WordPress. A directory traversal can lead to remote code execution by uploading a crafted txt file into the lib directory, because of a wfuincludelib call...

Command Injection

Overview pulverizr is a to smash your images down to size. Affected versions of this package are vulnerable to Command Injection. Within lib/job.js, the variable filename can be controlled by the attacker. This function uses the variable filename to construct the argument of the exec call without...

SUSE SLES12 Security Update : mariadb (SUSE-SU-2020:0505-1)

This update for mariadb fixes the following issues : MariaDB was updated to version 10.2.31 GA bsc1162388. Security issues fixed : CVE-2020-2574: Fixed a difficult to exploit vulnerability that allowed an attacker to crash the client bsc1162388. CVE-2019-18901: Fixed an unsafe path handling...

EulerOS 2.0 SP8 : python3 (EulerOS-SA-2020-1175)

According to the versions of the python3 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Lib/zipfile.py in Python through 3.7.2 allows remote attackers to cause a denial of service resource consumption via a ZIP bomb.CVE-2019-9674 -...

Authentication flaw

rpi through 0.0.3 allows execution of arbritary commands. The variable pinNumbver in function GPIO within src/lib/gpio.js is used as part of the arguement of exec function without any sanitization...

CVE-2020-7597

codecov-node npm module before 3.6.5 allows remote attackers to execute arbitrary commands.The value provided as part of the gcov-root argument is executed by the exec function within lib/codecov.js. This vulnerability exists due to an incomplete fix of CVE-2020-7596...

CVE-2020-7597

codecov-node npm module before 3.6.5 allows remote attackers to execute arbitrary commands.The value provided as part of the gcov-root argument is executed by the exec function within lib/codecov.js. This vulnerability exists due to an incomplete fix of CVE-2020-7596...

CVE-2020-7597

codecov-node npm module before 3.6.5 allows remote attackers to execute arbitrary commands.The value provided as part of the gcov-root argument is executed by the exec function within lib/codecov.js. This vulnerability exists due to an incomplete fix of CVE-2020-7596...

CVE-2020-7046

lib-smtp in submission-login and lmtp in Dovecot 2.3.9 before 2.3.9.3 mishandles truncated UTF-8 data in command parameters, as demonstrated by the unauthenticated triggering of a submission-login infinite loop...

Dovecot 2.3.9 < 2.3.9.3 Multiple Vulnerabilities

Dovecot is prone to multiple vulnerabilities. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

CVE-2020-7046

lib-smtp in submission-login and lmtp in Dovecot 2.3.9 before 2.3.9.3 mishandles truncated UTF-8 data in command parameters, as demonstrated by the unauthenticated triggering of a submission-login infinite loop...