4650 matches found
CVE-2026-11120-Command-Injection-via-Git-URL-in-CI-CD-Pipeline
CVE-2026-11120 – CI/CD 파이프라인의 Git URL을 통한 명령 삽입 프로그램 코드 Python root@kitploit: cicdbuild.py - Clones repository without sanitizing URL import subprocess, sys def cloneandbuildrepourl: Vulnerability: repourl can contain shell metacharacters cmd = f"git clone repourl /tmp/repo"...
Scalar-Venom-Attack
В этой статье анализируются криптографические уязвимости, обнаруженные в современной инфраструктуре управления криптографическими ключами, с особым акцентом на критические недостатки в архитектуре аппаратных модулей безопасности HSM при обработке закрытых ключей на эллиптических кривых...
PT-2026-90512
A file-transfer interface that requires valid credentials accepts attacker-controlled filenames without restricting shell metacharacters. An automated process later constructs and runs a system command using the uploaded file's name, allowing an authenticated attacker to embed and execute arbitra...
CVE-2020-8958
Доказательство концепции для CVE-2020-8958, написанное на Python. Сценарий вернет содержимое /etc/passwd в случае успеха. CVE-2020-8958 Устройства Guangzhou 1GE ONU V2801RW с версиями 1.9.1-181203 по 2.9.0-181024 и V2804RGW с версиями 1.9.1-181203 по 2.9.0-181024 позволяют удаленным злоумышленник...
CVE-2026-26830
CVE-2026-26830: pdf-image의 OS 명령 삽입 요약 pdf-image 버전 2.0.0까지는 pdfFilePath 인자를 통해 OS 명령 삽입이 가능합니다. 이 패키지는 util.format으로 셸 명령 문자열을 구성한 다음 childprocess.exec로 실행합니다. 애플리케이션이 공격자가 제어하는 파일 경로를 PDFImage에 전달하면 해당 경로의 셸 메타문자로 인해 임의의 명령 실행으로 이어질 수 있습니다. 영향받는 제품...
axios: Axios: Client-side Denial of Service via unescaped regex metacharacters in XSRF cookie name
A flaw was found in Axios. A remote attacker, by influencing the XSRF cookie name in a browser environment, could cause the application to construct a regular expression that leads to excessive processing. This can result in a client-side Denial of Service DoS, where the affected browser tab may...
CVE-2026-73693
FileRun before 2026.3.0 contains an OS command injection vulnerability in the PhotoProofSheet handler that allows authenticated users with upload permission to execute arbitrary commands by uploading files with shell metacharacters in their names. Attackers can upload a file containing command...
axios: Axios: Client-side Denial of Service via unescaped regex metacharacters in XSRF cookie name
A flaw was found in Axios. A remote attacker, by influencing the XSRF cookie name in a browser environment, could cause the application to construct a regular expression that leads to excessive processing. This can result in a client-side Denial of Service DoS, where the affected browser tab may...
CVE-2026-73693
FileRun before 2026.3.0 is vulnerable to OS command injection in the PhotoProofSheet handler. The root cause is a missing escapeshellarg() call when constructing the ImageMagick montage command, allowing authenticated users with upload permission to execute arbitrary commands by uploading files w...
CVE-2026-88888
Renovate before 44.14.7 contains a command injection vulnerability in the Mix manager when processing private dependencies with unescaped organization parameters. Attackers can inject shell metacharacters through malicious package names to execute arbitrary commands as the Renovate user in...
CVE-2026-64837
ICEcoder through 8.1 passes an unescaped filesystem path into a shell command in lib/properties.php, allowing authenticated users to inject OS commands through directory names. Attackers can create directories with shell metacharacters in their names and access the Properties function to execute...
CVE-2026-64837
ICEcoder through 8.1 is vulnerable to OS command injection in lib/properties.php . The root cause is an unescaped filesystem path passed to a shell command via popen() . An authenticated attacker can create directories containing shell metacharacters in their names and then invoke the Properties ...
CVE-2026-88888
A flaw was found in Renovate. Attackers can exploit a command injection vulnerability in the Mix manager by injecting shell metacharacters through malicious package names when processing private dependencies with unescaped organization parameters. This allows for the execution of arbitrary comman...
vim: Vim: Arbitrary Code Execution via Insecure Shell Command Handling
A vulnerability in Vim's shell script plugins sh.vim, zsh.vim, ps1.vim allows arbitrary code execution if a user selects maliciously crafted text in Visual mode and triggers a keyword lookup, due to improperly escaped shell metacharacters...
CVE-2026-88888
Renovate before 44.14.7 is affected by a command injection vulnerability in the Mix manager . The root cause is unescaped organization parameters when processing private dependencies, allowing attackers to inject shell metacharacters through malicious package names. Successful exploitation enable...
CVE-2007-2447
CVE-2007-2447 Samba 익스플로잇 Samba smbd 3.0.20-Debian을 대상으로 하는 CVE-2007-2447 익스플로잇의 독립 실행형 Rust 구현체입니다. 취약점 설명 CVE-2007-2447은 Samba 3.0.0부터 3.0.25rc3까지의 버전에 존재하는 명령 삽입command injection 취약점입니다. 이 취약점은 SamrChangePassword 함수에서 발생하며, 사용자 입력을 제대로 검증하지 못해 공격자가 SMB 인증 중 사용자 이름 필드의 셸 메타문자를 통해 임의의 명령을 실행할 수 ...
CVE-2026-88282
GeoVision GV-LPC2211 V1.13 allows an administrator-controlled FTP username containing shell metacharacters to be executed as arbitrary root commands during a subsequent FTP-account update...
CVE-2026-88272
GeoVision GV-LPC2211 V1.13 allows an administrator-controlled username containing shell metacharacters to be executed as arbitrary root commands when the stored username is later deleted...
CVE-2026-88282 GV-LPCLPC2011/2211 - Stored FTP-Username Command Injection
GeoVision GV-LPC2211 V1.13 allows an administrator-controlled FTP username containing shell metacharacters to be executed as arbitrary root commands during a subsequent FTP-account update...
