CVE-2022-36231

pdfinfo 0.5.3 is vulnerable to Command Execution because the Ruby code uses backticks instead of Open3...

CVE-2022-36231

pdfinfo 0.5.3 is vulnerable to Command Execution because the Ruby code uses backticks instead of Open3...

Command injection

pdfinfo 0.5.3 is vulnerable to Command Execution because the Ruby code uses backticks instead of Open3...

CVE-2022-36231

pdfinfo 0.5.3 is vulnerable to Command Execution because the Ruby code uses backticks instead of Open3...

GitLab: RCE via the DecompressedArchiveSizeValidator and Project BulkImports (behind feature flag)

Summary The DecompressedArchiveSizeValidator is used to check the size of a archive before extracting it: https://gitlab.com/gitlab-org/gitlab/-/blob/v15.1.0-ee/lib/gitlab/importexport/decompressedarchivesizevalidator.rbL82 ruby def command "gzip -dc @archivepath | wc -c" end def validate pgrp =...

Arbitrary Command Execution

smalruby-editor is vulnerable to arbitrary OS command injection attacks. The vulnerability exists due to the improper input sanitization in the usage of Open3.capture3...

Moxa SoftCMS RTSPVIDEO.rtspvideoCtrl.1 Open3 Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Moxa SoftCMS. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the Open3 method of...

Ruby Gem md2pdf Command Injection Vulnerability

Ruby Gem md2pdf suffers from a remote command injection vulnerability. Remote command injection md2pdf ruby gem 4/10/2013 Description: "creates pdf documents from markdown documents" https://rubygems.org/gems/md2pdf In md2pdf/converter.rb we see user supplied input being passed to the command lin...

update for perl (important)

Perl was updated to fix 3 security issues: - fix rehash denial of service compute time bnc804415 CVE-2013-1667 - improve CGI crlf escaping bnc789994 CVE-2012-5526 - sanitize input in Maketext.pm to avoid code injection bnc797060 CVE-2012-6329 In openSUSE 12.1 also the following non-security bug w...