Design/Logic Flaw

Jenkins Pipeline: Groovy Plugin 2648.va9433432b33c and earlier uses the same checkout directories for distinct SCMs when reading the script file typically Jenkinsfile for Pipelines, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted...

CVE-2022-25174

Jenkins Pipeline: Shared Groovy Libraries Plugin 552.vd9cc05b8a2e1 and earlier uses the same checkout directories for distinct SCMs for Pipeline libraries, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents...

CVE-2022-25174

CVE-2022-25174 affects Jenkins Pipeline: Shared Groovy Libraries Plugin (and related Pipeline plugins) where distinct SCMs shared checkout directories, enabling an attacker with Item/Configure permission to invoke arbitrary OS commands on the controller via crafted SCM contents. Public sources wi...

OS Command Injection in part-db/part-db

Description OS command injection also known as shell injection is a web security vulnerability that allows an attacker to execute arbitrary operating system OS commands on the server that is running an application, and typically fully compromise the application and all its data. Very often, an...

Jenkins Pipeline 操作系统命令注入漏洞

Jenkins Pipeline is a set of plug-ins that support the implementation and integration of continuous delivery pipelines into Jenkins. Jenkins Pipeline has a security vulnerability that can be exploited by an attacker to invoke arbitrary OS commands on the controller by crafting SCM content...

Jenkins Pipeline 操作系统命令注入漏洞

Jenkins Pipeline is a set of plug-ins that support the implementation and integration of continuous delivery pipelines into Jenkins. Jenkins Pipeline has a security vulnerability that can be exploited by an attacker to invoke arbitrary OS commands on the controller by crafting SCM content...

CVE-2022-25175

CVE-2022-25175 affects Jenkins Pipeline: Multibranch Plugin (up to 706.vd43c65dec013 and older) where readTrusted uses the same checkout directories for distinct SCMs. This enables attackers with Item/Configure permission to invoke arbitrary OS commands on the controller via crafted SCM contents....

PT-2022-17112 · Jenkins · Jenkins Pipeline: Groovy Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Pipeline: Groovy Plugin versions 2648.va9433432b33c and earlier Jenkins Pipeline: Groovy Plugin prior to 2656.vf7a e7b 75a 457 Jenkins Pipeline: Groovy Plugin version 2.94.1 Jenkins Pipeline: Groovy Plugin version 2.92.1 Description:...

CVE-2022-25175

Jenkins Pipeline: Multibranch Plugin 706.vd43c65dec013 and earlier uses the same checkout directories for distinct SCMs for the readTrusted step, allowing attackers with Item/Configure permission to invoke arbitrary OS commands on the controller through crafted SCM contents...

CVE-2022-0557

OS Command Injection in Packagist microweber/microweber prior to 1.2.11...

CVE-2022-0557

OS Command Injection in Packagist microweber/microweber prior to 1.2.11...

CVE-2022-0557 OS Command Injection in microweber/microweber

OS Command Injection in Packagist microweber/microweber prior to 1.2.11...

CVE-2022-0557

CVE-2022-0557 describes an OS Command Injection in the Packagist Microweber/Microweber package prior to version 1.2.11. Public advisories and exploits indicate an authenticated remote code execution path via uploaded content or crafted inputs that bypass input validation, enabling an attacker to ...

CVE-2022-0557 OS Command Injection in microweber/microweber

OS Command Injection in Packagist microweber/microweber prior to 1.2.11...

OS Command Injection in install-package

install-package through 0.4.0 is vulnerable to Command Injection. It allows execution of arbitrary commands via the options argument...

GHSA-H9V8-RM3M-5H5F OS Command Injection in git-add-remote

git-add-remote through 1.0.0 is vulnerable to Command Injection. It allows execution of arbitrary commands via the name argument...

Withdrawn Advisory: OS Command Injection in effect

Withdrawn Advisory This advisory has been withdrawn because the npm package effect, for which alerts were issued, does not correspond with https://github.com/Javascipt/effect, the repository with the vulnerable code. https://github.com/Javascipt/effect is not in any supported ecosystem...

GHSA-PF8J-VHG8-XMC3 karma-mojo enables OS Command Injection

karma-mojo through 1.0.1 is vulnerable to Command Injection. It allows execution of arbitrary commands via the config argument...

GHSA-C5HM-XC74-PQRG OS Command Injection in jscover

jscover through 1.0.0 is vulnerable to Command Injection. It allows execution of arbitrary command via the source argument...

OS Command Injection and Command Injection in kill-port-process

The kill-port-process package prior to version 2.2.0 is vulnerable to a Command Injection...