PT-2020-19669

Name of the Vulnerable Software and Affected Versions apiconnect-cli-plugins versions 6.0.1 and earlier Description The issue allows execution of arbitrary commands via the pluginUri argument, enabling command injection. This can be exploited by passing malicious input to the...

The vulnerability of the Pulverizr package in the NPM package manager allows a hacker to execute arbitrary commands.

The vulnerability of the Pulverizr package exists because measures to neutralize special elements have not been taken. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands on the target system by creating a file with malicious content and the name lib/job.js...

CVE-2020-10789

openITCOCKPIT before 3.7.3 has a web-based terminal that allows attackers to execute arbitrary OS commands via shell metacharacters that are mishandled on an su command line in app/Lib/SudoMessageInterface.php...

CVE-2020-10789: Improper Neutralization of Special Elements used in an OS Command

openITCOCKPIT before 3.7.3 has a web-based terminal that allows attackers to execute arbitrary OS commands via shell metacharacters that are mishandled on an su command line in app/Lib/SudoMessageInterface.php...

PT-2020-12323

Name of the Vulnerable Software and Affected Versions openITCOCKPIT versions prior to 3.7.3 Description The issue allows attackers to execute arbitrary OS commands via shell metacharacters that are mishandled on an su command line in app/Lib/SudoMessageInterface.php. This is related to a web-base...

Security update for nghttp2 (moderate)

openSUSE Security Update: Security update for nghttp2 Announcement ID: openSUSE-SU-2020:0379-1 Rating: moderate References: 1159003 1166481 Cross-References: CVE-2019-18802 Affected Products: openSUSE Leap 15.1 An update that solves one vulnerability and has one errata is now available...

CVE-2020-8984: Origin Validation Error

lib/NSSDropbox.php in ZendTo prior to 5.22-2 Beta allowed IP address spoofing via the X-Forwarded-For header...

PT-2020-20407

Name of the Vulnerable Software and Affected Versions ZendTo versions prior to 5.22-2 Beta Description The issue allows IP address spoofing via the X-Forwarded-For header. This is due to a problem in the lib/NSSDropbox.php file. Recommendations For versions prior to 5.22-2 Beta, update to version...

PT-2020-20409

Name of the Vulnerable Software and Affected Versions ZendTo versions prior to 5.22-2 Beta Description The issue is related to the lib/NSSDropbox.php file in ZendTo, where it failed to properly check for equality when validating the session cookie. This allows an attacker to gain administrative...

CVE-2020-8986: Improper Check for Unusual or Exceptional Conditions

lib/NSSDropbox.php in ZendTo prior to 5.22-2 Beta failed to properly check for equality when validating the session cookie, allowing an attacker to gain administrative access with a large number of requests...

CVE-2020-10879

rConfig before 3.9.5 allows command injection by sending a crafted GET request to lib/crud/search.crud.php since the nodeId parameter is passed directly to the exec function without being escaped...

CVE-2020-10879

rConfig before 3.9.5 allows command injection by sending a crafted GET request to lib/crud/search.crud.php since the nodeId parameter is passed directly to the exec function without being escaped...

CVE-2020-10879

rConfig before 3.9.5 allows command injection by sending a crafted GET request to lib/crud/search.crud.php since the nodeId parameter is passed directly to the exec function without being escaped...

CVE-2020-10879: Improper Neutralization of Special Elements used in an OS Command

rConfig before 3.9.5 allows command injection by sending a crafted GET request to lib/crud/search.crud.php since the nodeId parameter is passed directly to the exec function without being escaped...

PT-2020-4763

Name of the Vulnerable Software and Affected Versions: rConfig versions prior to 3.9.5 Description: The issue is related to a lack of proper neutralization of special elements used in operating system commands. This can be exploited by a remote attacker using a specially crafted GET request,...

WS-2020-0355

nDPI in version 3.2 is vulnerable to Use-of-uninitialized-value , related to src/lib/protocols/tls.c...

CVE-2020-7604

pulverizr through 0.7.0 allows execution of arbitrary commands. Within "lib/job.js", the variable "filename" can be controlled by the attacker. This function uses the variable "filename" to construct the argument of the exec call without any sanitization. In order to successfully exploit this...

CVE-2020-7604

pulverizr through 0.7.0 allows execution of arbitrary commands. Within "lib/job.js", the variable "filename" can be controlled by the attacker. This function uses the variable "filename" to construct the argument of the exec call without any sanitization. In order to successfully exploit this...

CVE-2020-7604

pulverizr through 0.7.0 allows execution of arbitrary commands. Within "lib/job.js", the variable "filename" can be controlled by the attacker. This function uses the variable "filename" to construct the argument of the exec call without any sanitization. In order to successfully exploit this...

CVE-2020-7604: Improper Neutralization of Special Elements used in an OS Command

pulverizr through 0.7.0 allows execution of arbitrary commands. Within "lib/job.js", the variable "filename" can be controlled by the attacker. This function uses the variable "filename" to construct the argument of the exec call without any sanitization. In order to successfully exploit this...