Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via the filename parameter passed to editfiles function via click.edit. This function invokes a subprocess with shell=True that can be injected into by including double-quoted strings in a malicious filename. An attack...

Arbitrary File Upload

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Arbitrary File Upload via the snipeit:restore command. An attacker can execute arbitrary system commands by uploading a specially crafted backup file containing malicious...