Remote Code Execution (RCE)

github.com/michaelmure/git-bug is vulnerable to remote code execution. The vulnerability exists due to an uncontrolled search path element. An attacker may craft a malicious git.bat command, commit it and push it in a repository and it will be executed when it is searched...

Command Injection

wc-cmd is vulnerable to command injection. An attacker is able to inject and execute malicious command via the index.js file...

CVE-2020-29311

Ubilling v1.0.9 allows Remote Command Execution as Root user by executing a malicious command that is injected inside the config file and being triggered by another part of the software...

CVE-2020-7500

A CWE-89:Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability exists in U.motion Servers and Touch Panels affected versions listed in the security notification which could cause arbitrary code to be executed when a malicious command is entered...

Command Injection

chrome-launcher is vulnerable to Command Injection. The vulnerability exists because an attacker can get control of the $HOME environment variable in Linux operating systems, leading to an execution of malicious command...

OS Command Injection

Ansible is vulnerable to OS command injection. The attack is possible because the module nxosfilecopy does not validate the remotefile parameter and directly uses the filenames from the parameter to copy files to a flash or bootflash on NXOS devices, allowing an attacker to inject malicious comma...

CVE-2019-1584: Improper Neutralization of Special Elements used in a Command

A security vulnerability exists in Zingbox Inspector version 1.293 and earlier, that allows for remote code execution if the Inspector were sent a malicious command from the Zingbox cloud, or if the Zingbox Inspector were tampered with to connect to an attacker's cloud endpoint...

Command Injection

ansible is vulnerable to command injection. It is possible due to a lack of the returned facts validation, allowing a remote host running ansible or via escalated permissions to alter connection or interpreter settings by injecting malicious command through it...

CVE-2018-16873

CVE-2018-16873 is a Go go get remote code execution vulnerability (GOPATH mode) where a malicious package import path can cause the parent directory to be treated as a Git repository root, leading to execution of commands from the repository’s config if it contains malicious directives. Connected...

CVE-2018-3786

A command injection vulnerability in egg-scripts v2.8.1 allows arbitrary shell command execution through a maliciously crafted command line argument...

Debian DSA-4010-1 : git-annex - security update

It was discovered that git-annex, a tool to manage files with git without checking their contents in, did not correctly handle maliciously constructed ssh:// URLs. This allowed an attacker to run an arbitrary shell command. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text...

Bitwarden: Export vault feature is vulnerable to CSV injection

Hello guys I don't know if you care about this issue but it seems that the export feature in your https://vault.bitwarden.com//tools is vulnerable to CSV injection. If a CSV contains a malicious command it may have big impact Even though there is a popup notification for users before opening the...

RubyGems Secure Bypass Leakage (CNVD-2017-30738)

RubyGems is a Ruby package manager from the RubyGems organization, which is used to distribute and manage Ruby packages. A security vulnerability exists in RubyGems 2.6.12 and earlier versions. An attacker can exploit the vulnerability to inject malicious commands into a user's terminal and execu...

The vulnerabilities in operating systems such as Mac OS X and iOS allow attackers to replace the specified code.

The vulnerability of the AppleMobileFileIntegrity component in operating systems such as Mac OS X and iOS is related to security configuration errors. Exploiting this vulnerability allows a malicious actor to replace the specified code using a special command identifier...

CVE-2016-7787

A maliciously crafted command line for kdesu can result in the user only seeing part of the commands that will actually get executed as super user...

CVE-2016-9951

An issue was discovered in Apport before 2.20.4. A malicious Apport crash file can contain a restart command in RespawnCommand or ProcCmdline fields. This command will be executed if a user clicks the Relaunch button on the Apport prompt from the malicious crash file. The fix is to only show the...

CVE-2016-9951

An issue was discovered in Apport before 2.20.4. A malicious Apport crash file can contain a restart command in RespawnCommand or ProcCmdline fields. This command will be executed if a user clicks the Relaunch button on the Apport prompt from the malicious crash file. The fix is to only show the...

CVE-2016-9951

An issue was discovered in Apport before 2.20.4. A malicious Apport crash file can contain a restart command in RespawnCommand or ProcCmdline fields. This command will be executed if a user clicks the Relaunch button on the Apport prompt from the malicious crash file. The fix is to only show the...

Denial of Service Vulnerability in Multiple Huawei Products

The Huawei USG9580, 9560 and 9520 are USG9500 series firewall appliances from Huawei, China. A security vulnerability exists in multiple Huawei products that allows remote attackers to exploit the vulnerability to reset the device via a command that sends malicious parameters...

Quantum vmPRO后门未授权访问漏洞

Bugtraq ID:66274 Quantum vmPRO是一款适用于保护虚拟机数据的解决方案。 Quantum vmPRO "/usr/local/pancetera/bin/cmdprocessor.py"存在一个隐藏命令可获得root shell，允许通过验证的远程攻击者利用漏洞提交恶意命令获得root shell。 0 Quantum vmPRO 3.1.2 Quantum vmPRO 2.3.0.1已经修复该漏洞，建议用户下载更新： http://quantum.com/...