CVE-2025-61304

CVE-2025-61304 「Dynatrace ActiveGate pingエクステンション（バージョン1.016まで）における、細工されたIPアドレスを介したOSコマンドインジェクションの脆弱性」 内部的に、pingエクステンションはWindowsのコマンドプロンプトを使用してpingを実行しています。テスト対象ホストの入力フィールドは1024文字の長さです。IPアドレスの後に'&'を使用するだけで、ActiveGateに実行させる追加コマンドを記述できます。 この脆弱性はDynatraceに報告され、以下のコミットで修正されました：...

CVE-2026-30302

The command auto-approval module in CodeRider-Kilo contains an OS Command Injection vulnerability, rendering its whitelist security mechanism ineffective. The vulnerability stems from the incorrect use of an incompatible command parser the Unix-based shell-quote library to analyze commands on the...

CVE-2026-28391 OpenClaw < 2026.2.2 - Command Injection via cmd.exe Parsing Bypass in Allowlist Enforcement

OpenClaw versions prior to 2026.2.2 fail to properly validate Windows cmd.exe metacharacters in allowlist-gated exec requests non-default configuration, allowing attackers to bypass command approval restrictions. Remote attackers can craft command strings with shell metacharacters like & or %...%...

PT-2023-25389 · Shescape · Shescape

Name of the Vulnerable Software and Affected Versions: Shescape versions prior to 1.7.1 Description: An attacker may be able to get read-only access to environment variables. This issue affects users of Shescape on Windows using the Windows Command Prompt, and when using quote/quoteAll or...

China-Linked APT15 Used Myriad of New Tools To Hack UK Government Contractor

CANCUN, Mexico – Researchers at NCC Group have discovered multiple backdoors on a UK government contractor’s computer systems designed to steal sensitive government and military data. The hack is tied to China-linked cyber espionage group APT15, which researchers said is utilizing many new tools ...