Base de CVEs

Gradle is a build tool with a focus on build automation. In versions prior to 7.2, start scripts generated by the `application` plugin and the `gradlew` script are both vulnerable to arbitrary code execution when an attacker is able to change environment variables for the user running the script. This may impact those who use `gradlew` on Unix-like systems or use the scripts generated by Gradle in thieir application on Unix-like systems. For this vulnerability to be exploitable, an attacker needs to be able to set the value of particular environment variables and have those environment variables be seen by the vulnerable scripts. This issue has been patched in Gradle 7.2 by removing the use of `eval` and requiring the use of the `bash` shell. There are a few workarounds available. For CI/CD systems using the Gradle build tool, one may ensure that untrusted users are unable to change environment variables for the user that executes `gradlew`. If one is unable to upgrade to Gradle 7.2, one may generate a new `gradlew` script with Gradle 7.2 and use it for older versions of Gradle. Fpplications using start scripts generated by Gradle, one may ensure that untrusted users are unable to change environment variables for the user that executes the start script. A vulnerable start script could be manually patched to remove the use of `eval` or the use of environment variables that affect the application's command-line. If the application is simple enough, one may be able to avoid the use of the start scripts by running the application directly with Java command.

Accellion FTA 9_12_411 and earlier is affected by OS command execution via a local web service call. The fixed version is FTA_9_12_416 and later.

A System Information Library para Node.JS (pacote npm "systeminformation") é uma coleção de código aberto de funções para obter informações detalhadas sobre hardware, sistema e SO. No systeminformation anterior à versão 5.3.1 há uma vulnerabilidade de injeção de comando. O problema foi corrigido na versão 5.3.1. Como alternativa à atualização, verifique ou sanitize os parâmetros de serviço passados para si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() ... permita apenas strings e rejeite quaisquer arrays. A sanitização de strings funciona como esperado.

Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/cloud-vm/cloud-vm.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injection on the Nagios XI server.

Nagios XI version xi-5.7.5 is affected by OS command injection. The vulnerability exists in the file /usr/local/nagiosxi/html/includes/configwizards/switch/switch.inc.php due to improper sanitization of authenticated user-controlled input by a single HTTP request, which can lead to OS command injection on the Nagios XI server.

XStream before version 1.4.14 is vulnerable to Remote Code Execution.The vulnerability may allow a remote attacker to run arbitrary shell commands only by manipulating the processed input stream. Only users who rely on blocklists are affected. Anyone using XStream's Security Framework allowlist is not affected. The linked advisory provides code workarounds for users who cannot upgrade. The issue is fixed in version 1.4.14.

This affects the package json before 10.0.0. It is possible to inject arbritary commands using the parseLookup function.

scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of "anomalous argument transfers" because that could "stand a great chance of breaking existing workflows."

Foi identificado um problema no Apache Airflow nas versões 1.10.10 e anteriores. Foi descoberta uma vulnerabilidade de injeção remota de código/comando em um dos DAGs de exemplo distribuídos com o Airflow, que permitiria a qualquer usuário autenticado executar comandos arbitrários como o usuário que executa o worker ou o scheduler do airflow (dependendo do executor em uso). Se você já desativou os exemplos definindo load_examples=False na configuração, então não está vulnerável.

D-Link DIR-610 devices allow Remote Command Execution via the cmd parameter to command.php. NOTE: This vulnerability only affects products that are no longer supported by the maintainer

Pi-hole Web v4.3.2 (aka AdminLTE) allows Remote Code Execution by privileged dashboard users via a crafted DHCP static lease.

Apache Kylin 2.3.0, e versões até 2.6.5 e 3.0.1, possuem algumas APIs restful que concatenam comandos do sistema operacional com a string de entrada do usuário, e um usuário provavelmente consegue executar qualquer comando do sistema operacional sem nenhuma proteção ou validação.