PT-2021-14404 · Unknown +2 · Carrierwave +2

Name of the Vulnerable Software and Affected Versions: CarrierWave versions prior to 1.3.2 CarrierWave versions prior to 2.1.1 Description: The issue concerns a code injection vulnerability in the manipulate! method, which inappropriately evaluates the content of mutation options :read and :write...

Mshibuya CarrierWave Code Code Injection Vulnerability

Mshibuya CarrierWave is an upload tool from the Mshibuya Personal Organization in the United States. It provides a simple and extremely flexible way to upload files from Ruby applications. A code injection vulnerability exists in Mshibuya CarrierWave versions 1.3.2 and prior to 2.1.1, which stems...

nodejs-y18n: prototype pollution vulnerability

A flaw was found in nodejs-y18n. There is a prototype pollution vulnerability in y18n's locale functionality. If an attacker is able to provide untrusted input via locale, they may be able to cause denial of service or in rare circumstances, impact to data integrity or confidentiality...

OS Command Injection

mechanize is vulnerable to OS command injection. The Kernel.open method could be used to inject and execute arbitrary OS commands invoked through several class methods. Exploitation is possible when untrusted input is used as a local filename and is passed to the affected functions...

CVE-2021-21289

Mechanize is an open-source ruby library that makes automated web interaction easy. In Mechanize from version 2.0.0 and before version 2.7.7 there is a command injection vulnerability. Affected versions of mechanize allow for OS commands to be injected using several classes' methods which...

DEBIAN-CVE-2021-21289

Mechanize is an open-source ruby library that makes automated web interaction easy. In Mechanize from version 2.0.0 and before version 2.7.7 there is a command injection vulnerability. Affected versions of mechanize allow for OS commands to be injected using several classes' methods which...

Command injection

Mechanize is an open-source ruby library that makes automated web interaction easy. In Mechanize from version 2.0.0 and before version 2.7.7 there is a command injection vulnerability. Affected versions of mechanize allow for OS commands to be injected using several classes' methods which...

CVE-2021-21289

Mechanize is an open-source ruby library that makes automated web interaction easy. In Mechanize from version 2.0.0 and before version 2.7.7 there is a command injection vulnerability. Affected versions of mechanize allow for OS commands to be injected using several classes' methods which...

GHSA-QRQM-FPV6-6R8G Command Injection Vulnerability in Mechanize

This security advisory has been created for public disclosure of a Command Injection vulnerability that was responsibly reported by @kyoshidajp Katsuhiko YOSHIDA. Impact Mechanize = v2.0, v2.7.7 allows for OS commands to be injected using several classes' methods which implicitly use Ruby's...

CVE-2021-21289 Command Injection Vulnerability in Mechanize

Mechanize is an open-source ruby library that makes automated web interaction easy. In Mechanize from version 2.0.0 and before version 2.7.7 there is a command injection vulnerability. Affected versions of mechanize allow for OS commands to be injected using several classes' methods which...

CVE-2021-21289

Mechanize is an open-source ruby library that makes automated web interaction easy. In Mechanize from version 2.0.0 and before version 2.7.7 there is a command injection vulnerability. Affected versions of mechanize allow for OS commands to be injected using several classes' methods which...

Apple IO Model Input Validation Error Vulnerability

Apple IO Model is a module for handling IO operations from Apple USA. Apple IO Model suffers from an input validation error vulnerability that originates when handling untrusted input in the Model I / O component of macOS. An attacker could use a specially crafted USD file to crash the system or...

CVE-2020-15836

An issue was discovered on Mofi Network MOFI4500-4GXeLTE 4.1.5-std devices. The authentication function passes untrusted data to the operating system without proper sanitization. A crafted request can be sent to execute arbitrary commands as root...

Fedora 32 : PyYAML (2021-eed7193502)

The remote Fedora 32 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-eed7193502 advisory. - A vulnerability was discovered in the PyYAML library in versions before 5.3.1, where it is susceptible to arbitrary code execution when it process...

CentOS 8 : .NET Core on Red Hat Enterprise Linux 8 (CESA-2020:2471)

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2020:2471 advisory. - dotnet: Denial of service via untrusted input CVE-2020-1108 Note that Nessus has not tested for this issue but has instead relied only on the application's...

OS Command Injection in async-git

The async-git package before 1.13.2 for Node.js allows OS Command Injection via shell metacharacters, as demonstrated by git.reset and git.tag. This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. Ensure to sanitize untrusted us...

GHSA-6C3F-P5WP-34MH OS Command Injection in async-git

The async-git package before 1.13.2 for Node.js allows OS Command Injection via shell metacharacters, as demonstrated by git.reset and git.tag. This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. Ensure to sanitize untrusted us...

Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely.

...

Fedora 33 : PyYAML (2021-3342569a0f)

The remote Fedora 33 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-3342569a0f advisory. - A vulnerability was discovered in the PyYAML library in versions before 5.3.1, where it is susceptible to arbitrary code execution when it process...

VulnCheck KEV: CVE-2020-11023

JQuery contains a persistent cross-site scripting XSS vulnerability. When passing maliciously formed, untrusted input enclosed in HTML tags, JQuery's DOM manipulators can execute untrusted code in the context of the user's browser...