command injection vulnerabilities and exploits

(subscribe to this query)

Apache Hadoop's FileUtil.unTar(File, File) API does not escape the input file name before being passed to the shell. An attacker can inject arbitrary commands. This is only used in Hadoop 3.3 InMemoryAliasMap.completeBootstrapTransfer, which is only ever run by a local...

Insufficient validation of untrusted input in Blink's mailto: handling in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac allowed a remote attacker to perform command injection via a crafted HTML page, a similar issue to CVE-2004-0121. For example,...

Google Chrome Redhat Enterprise Linux Desktop 6.0 Redhat Enterprise Linux Server 6.0 Redhat Enterprise Linux Workstation 6.0

Command injection in evince via filename when printing to PDF. This affects versions earlier than 3.25.91....

Cobbler version up to 2.8.2 is vulnerable to a command injection vulnerability in the "add repo" component resulting in arbitrary code execution as root user....

Cobbler Project Cobbler

Plexus-utils before 3.0.16 is vulnerable to command injection because it does not correctly process the contents of double quoted strings....

Plexus-utils Project Plexus-utils Debian Debian Linux 7.0 Debian Debian Linux 8.0 Debian Debian Linux 9.01 Github repository available

CGI implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to OS command injection....

An OS command injection was found in SecuwaySSL, when special characters injection on execute command with runCommand arguments....

Secuwiz Secuwayssl U

** DISPUTED ** The QMP guest_exec command in QEMU 4.0.0 and earlier is prone to OS command injection, which allows the attacker to achieve code execution, denial of service, or information disclosure by sending a crafted QMP command to the listening server. Note: This has been...

In Docker before 18.09.4, an attacker who is capable of supplying or manipulating the build path for the "docker build" command would be able to gain command execution. An issue exists in the way "docker build" processes remote git URLs, and results in...

Docker Docker9 Github repositories available

An issue was discovered in mgetty before 1.2.1. In fax/faxq-helper.c, the function do_activate() does not properly sanitize shell metacharacters to prevent command injection. It is possible to use the ||, &&, or > characters within a file created by the...

Mgetty Project Mgetty Debian Debian Linux 9.0 Debian Debian Linux 8.0

« PREV 1 2 3 4 5 6 7 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook