Mozilla: Malicious command could be hidden in devtools output

The Mozilla Foundation Security Advisory describes this flaw as: When copying a network request from the developer tools panel as a curl command the output was not being properly sanitized and could allow arbitrary commands to be hidden within...

CVE-2023-0052

SAUTER Controls Nova 200–220 Series with firmware version 3.3-006 and prior and BACnetstac version 4.2.1 and prior allows the execution of commands without credentials. As Telnet and file transfer protocol FTP are the only protocols available for device management, an unauthorized user could acce...

CVE-2023-0052 SAUTER Controls Nova 200–220 Series Missing Authentication for Critical Function

SAUTER Controls Nova 200–220 Series with firmware version 3.3-006 and prior and BACnetstac version 4.2.1 and prior allows the execution of commands without credentials. As Telnet and file transfer protocol FTP are the only protocols available for device management, an unauthorized user could acce...

CVE-2023-0052 SAUTER Controls Nova 200–220 Series Missing Authentication for Critical Function

SAUTER Controls Nova 200–220 Series with firmware version 3.3-006 and prior and BACnetstac version 4.2.1 and prior allows the execution of commands without credentials. As Telnet and file transfer protocol FTP are the only protocols available for device management, an unauthorized user could acce...

Command Injection

window-control is vulnerable to command injection. The vulnerability exists due to the lack of validation of user input in the sendKeys function of index.js, which allows an attacker to inject and execute malicious commands...

Command Injection

gry is vulnerable to Command Injection. The vulnerability exists due to improper input sanitization of multiple functions in index.js, which allows an attacker to inject maliciously crafted commands into the system...

SOUND4 IMPACT/FIRST/PULSE/Eco 2.x traceroute.php Conditional Command Injection

SOUND4 IMPACT/FIRST/PULSE/Eco =2.x traceroute.php Conditional Command Injection Vendor: SOUND4 Ltd. Product web page: https://www.sound4.com | https://www.sound4.biz Affected version: FM/HD Radio Processing: Impact/Pulse/First Version 2: 1.1/2.15 Impact/Pulse/First Version 1: 2.1/1.69 Impact/Puls...

CVE-2022-24441

The package snyk before 1.1064.0 are vulnerable to Code Injection when analyzing a project. An attacker who can convince a user to scan a malicious project can include commands in a build file such as build.gradle or gradle-wrapper.jar, which will be executed with the privileges of the applicatio...

Arbitrary Code Execution

badaso/core is vulnerable to arbitrary code executions. The vulnerability exists because the construct function of BadasoAuthController.php does not properly validate the data uploaded by the users, allowing an attacker to inject and execute malicious commands...

CVE-2022-41157

A specific file on the sERP server if KyungrinaraERP solution has a fixed password with the SYSTEM authority. This vulnerability could allow attackers to leak or steal sensitive information or execute malicious commands...

Design/Logic Flaw

A specific file on the sERP server if KyungrinaraERP solution has a fixed password with the SYSTEM authority. This vulnerability could allow attackers to leak or steal sensitive information or execute malicious commands...

CVE-2022-41157

CVE-2022-41157 affects the sERP Server (Kyungrinara ERP solution) where a fixed password with SYSTEM authority creates a risk allowing leakage of sensitive data or execution of malicious commands. The connected documents confirm the vulnerability exists in the sERP server and describe the impact ...

CVE-2022-41157 ERP solution Remote Code Execution Vulnerability

A specific file on the sERP server if KyungrinaraERP solution has a fixed password with the SYSTEM authority. This vulnerability could allow attackers to leak or steal sensitive information or execute malicious commands...

Command injection

Four OS command injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A XCMD can lead to arbitrary command execution. An attacker can send a sequence of malicious commands to trigger these vulnerabilities.This...

CVE-2022-20818

Multiple vulnerabilities in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges. These vulnerabilities are due to improper access controls on commands within the application CLI. An attacker could exploit these vulnerabilities by running a...

GO-2022-0177 Remote command execution via "go get" in cmd/go

The "go get" command allows remote command execution. Using custom domains, it is possible to arrange things so that example.com/pkg1 points to a Subversion repository but example.com/pkg1/pkg2 points to a Git repository. If the Subversion repository includes a Git checkout in its pkg2 directory...

Command Injection

node-latex-pdf is vulnerable to command injection. Insecure handling of compilation and execution of source file in selflatex function in node-latex-pdf.js allows an attacker to inject and execute malicious commands...

Command Injection

ntesseract is vulnerable to command injection. A remote attacker is able to inject and execute malicious commands through the command function of tesseract.js...

Microsoft uncovers a macOS App Sandbox escape vulnerability

Threat Level Vulnerability Report For a detailed advisory, download the pdf file here Summary Microsoft has recently discovered a vulnerability in macOS that allows third parties to bypass sandbox restrictions and execute malicious commands...

Command Injection

codecov is vulnerable to command injection. The vulnerability exists due to the lack of sanitization in the gcov arguments in the main function of init.py, allowing an attacker to inject and execute malicious commands before being provided to the Popen functionality...