Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,928 results · page 15 of 39
Apr 15, 2022PowerShell Elevation of Privilege VulnerabilityCVE-2022-26788 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
PowerShell Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.commsrc.microsoft.com
Apr 13, 2022Hard-coded credentials allow administrators to access the shell via the SD-WAN CLICVE-2022-27506 · Other software · Citirx · reported by secure@citrix.comLow 2.7
Hard-coded credentials allow administrators to access the shell via the SD-WAN CLI
- Product
- Citrix SD-WAN
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsupport.citrix.comsupport.citrix.com
Apr 12, 2022In broadcastPortInfo of AdbService.java, there is a possible way for apps to run code as the shell user, if wireless debugging is enabled, due to a missing permCVE-2021-39794 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In broadcastPortInfo of AdbService.java, there is a possible way for apps to run code as the shell user, if wireless debugging is enabled, due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12LAndroid ID: A-205836329
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Apr 4, 2022Use after free in Chrome OS Shell in Google Chrome on Chrome OS prior to 99.0.4844.51 allowed a remote attacker who convinced a user to engage in a series of usCVE-2022-0808 · Computers, phones & browsers · Google · reported by chrome-cve-admin@google.comHigh 8.8
Use after free in Chrome OS Shell in Google Chrome on Chrome OS prior to 99.0.4844.51 allowed a remote attacker who convinced a user to engage in a series of user interaction to potentially exploit heap corruption via user interactions.
- Product
- Chrome
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchromereleases.googleblog.comcrbug.com
Apr 4, 2022Car Rental System v1.0 contains an arbitrary file upload vulnerability via the Add Car component which allows attackers to upload a webshell and execute arbitraCVE-2022-28062 · Other software · Online CAR Rental System Project · reported by MITREHigh 8.8
Car Rental System v1.0 contains an arbitrary file upload vulnerability via the Add Car component which allows attackers to upload a webshell and execute arbitrary code.
- Product
- Online CAR Rental System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 4, 2022An unrestricted file upload at /public/admin/index.php?add_product of Ecommerce-Website v1.1.0 allows attackers to upload a webshell via the Product Image compoCVE-2022-27435 · Websites & servers · Ecommerce-website Project · reported by MITREHigh 8.8
An unrestricted file upload at /public/admin/index.php?add_product of Ecommerce-Website v1.1.0 allows attackers to upload a webshell via the Product Image component.
- Product
- Ecommerce-website
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Mar 31, 2022Xshell v7.0.0099 and below contains a binary hijack vulnerability which allows attackers to execute arbitrary code via a crafted .exe file.CVE-2022-27966 · Other software · Netsarang · reported by MITREMedium 6.5
Xshell v7.0.0099 and below contains a binary hijack vulnerability which allows attackers to execute arbitrary code via a crafted .exe file.
- Product
- Xshell
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comnetsarang.com
Mar 26, 2022NETGEAR R8500 1.0.2.158 devices allow remote authenticated users to execute arbitrary commands (such as telnetd) via shell metacharacters in the ipv6_fix.cgi ipCVE-2022-27947 · Network & remote access · Netgear · reported by MITREHigh 8.8
NETGEAR R8500 1.0.2.158 devices allow remote authenticated users to execute arbitrary commands (such as telnetd) via shell metacharacters in the ipv6_fix.cgi ipv6_wan_ipaddr, ipv6_lan_ipaddr, ipv6_wan_length, or ipv6_lan_length parameter.
- Product
- R8500 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2022NETGEAR R8500 1.0.2.158 devices allow remote authenticated users to execute arbitrary commands (such as telnetd) via shell metacharacters in the sysNewPasswd anCVE-2022-27946 · Network & remote access · Netgear · reported by MITREHigh 8.8
NETGEAR R8500 1.0.2.158 devices allow remote authenticated users to execute arbitrary commands (such as telnetd) via shell metacharacters in the sysNewPasswd and sysConfirmPasswd parameters to admin_account.cgi.
- Product
- R8500 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 26, 2022NETGEAR R8500 1.0.2.158 devices allow remote authenticated users to execute arbitrary commands (such as telnetd) via shell metacharacters in the sysNewPasswd anCVE-2022-27945 · Network & remote access · Netgear · reported by MITREHigh 8.8
NETGEAR R8500 1.0.2.158 devices allow remote authenticated users to execute arbitrary commands (such as telnetd) via shell metacharacters in the sysNewPasswd and sysConfirmPasswd parameters to password.cgi.
- Product
- R8500 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 23, 2022GNOME OCRFeeder before 0.8.4 allows OS command injection via shell metacharacters in a PDF or image filename.CVE-2022-27811 · Other software · Gnome · reported by MITRECritical 9.8
GNOME OCRFeeder before 0.8.4 allows OS command injection via shell metacharacters in a PDF or image filename.
- Product
- Ocrfeeder
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.gnome.orggitlab.gnome.org
Mar 14, 2022fish is a command line shell.CVE-2022-20001 · Other software · fish-shell · reported by GitHubHigh 7.8
fish is a command line shell. fish version 3.1.0 through version 3.3.1 is vulnerable to arbitrary code execution. git repositories can contain per-repository configuration that change the behavior of git, including running arbitrary commands. When using the default configuration of fish, changing to a directory automatically runs `git` commands in order to display information about the current repository in the prompt. If an attacker can convince a user to change their current directory into one controlled by the attacker, such as on a shared file system or extracted archive, fish will run arbitrary commands under the attacker's control. This problem has been fixed in fish 3.4.0. Note that running git in these directories, including using the git tab completion, remains a potential trigger for this issue. As a workaround, remove the `fish_git_prompt` function from the prompt.
- Product
- fish-shell
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2022A Remote Code Execution (RCE) vulnerability exists in Croogo 3.0.2via admin/file-manager/attachments, which lets a malicoius user upload a web shell script.CVE-2021-44673 · Other software · Croogo · reported by MITREHigh 8.8
A Remote Code Execution (RCE) vulnerability exists in Croogo 3.0.2via admin/file-manager/attachments, which lets a malicoius user upload a web shell script.
- Product
- Croogo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 10, 2022Use of a hard-coded cryptographic key pair by the telnetd_startup service allows an attacker on the local area network to obtain a root shell on the device overCVE-2022-25217 · Other software · Phicomm · reported by vulnreport@tenable.comHigh 7.8
Use of a hard-coded cryptographic key pair by the telnetd_startup service allows an attacker on the local area network to obtain a root shell on the device over telnet. The builds of telnetd_startup included in the version 22.5.9.163 of the K2 firmware, and version 32.1.15.93 of the K3C firmware (possibly amongst many other releases) included both the private and public RSA keys. The remaining versions cited here redacted the private key, but left the public key unchanged. An attacker in possession of the leaked private key may, through a scripted exchange of UDP packets, instruct telnetd_startup to spawn an unauthenticated telnet shell as root, by means of which they can then obtain complete control of the device. A consequence of the limited availablility of firmware images for testing is that models and versions not listed here may share this vulnerability.
- Product
- K2 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Mar 10, 2022Improper physical access control and use of hard-coded credentials in /etc/passwd permits an attacker with physical access to obtain a root shell via an unproteCVE-2022-25213 · Other software · Phicomm · reported by vulnreport@tenable.comMedium 6.8
Improper physical access control and use of hard-coded credentials in /etc/passwd permits an attacker with physical access to obtain a root shell via an unprotected UART port on the device. The same port exposes an unauthenticated Das U-Boot BIOS shell.
- Product
- K2 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Mar 4, 2022When the device is in factory state, it can be access the shell without adb authentication process.CVE-2022-23729 · Computers, phones & browsers · Google · reported by product.security@lge.comHigh 7.8
When the device is in factory state, it can be access the shell without adb authentication process. The LG ID is LVE-SMP-210010.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlgsecurity.lge.comlgsecurity.lge.com
Mar 3, 2022Shescape is a shell escape package for JavaScript.CVE-2022-24725 · Other software · ericcornelissen · reported by GitHubMedium 6.2
Shescape is a shell escape package for JavaScript. An issue in versions 1.4.0 to 1.5.1 allows for exposure of the home directory on Unix systems when using Bash with the `escape` or `escapeAll` functions from the _shescape_ API with the `interpolation` option set to `true`. Other tested shells, Dash and Zsh, are not affected. Depending on how the output of _shescape_ is used, directory traversal may be possible in the application using _shescape_. The issue was patched in version 1.5.1. As a workaround, manually escape all instances of the tilde character (`~`) using `arg.replace(/~/g, "\\~")`.
- Product
- shescape
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2022Cross-site scripting (XSS) vulnerability in the Gogo Shell module in Liferay Portal 7.1.0 through 7.3.6 and 7.4.0, and Liferay DXP 7.1 before fix pack 23, 7.2 bCVE-2021-38269 · Other software · Liferay · reported by MITREMedium 5.4
Cross-site scripting (XSS) vulnerability in the Gogo Shell module in Liferay Portal 7.1.0 through 7.3.6 and 7.4.0, and Liferay DXP 7.1 before fix pack 23, 7.2 before fix pack 13, and 7.3 before fix pack 2 allows remote attackers to inject arbitrary web script or HTML via the output of a Gogo Shell command.
- Product
- Liferay Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.liferay.devportal.liferay.dev
Feb 25, 2022A command injection vulnerability in the function formImportOMCIShell of C-DATA ONU4FERW V2.1.13_X139 allows attackers to execute arbitrary commands via a craftCVE-2021-44132 · Other software · C-data Onu4ferw Project · reported by MITREHigh 7.8
A command injection vulnerability in the function formImportOMCIShell of C-DATA ONU4FERW V2.1.13_X139 allows attackers to execute arbitrary commands via a crafted file.
- Product
- C-data Onu4ferw Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploitwriter.wordpress.comexploitwriter.io
Feb 21, 2022A vulnerability in Brocade Fabric OS versions before Brocade Fabric OS v8.0.1b, v7.4.1d could allow an authenticated attacker within the restricted shell enviroCVE-2021-27796 · Other software · Broadcom · reported by sirt@brocade.comMedium 6.5
A vulnerability in Brocade Fabric OS versions before Brocade Fabric OS v8.0.1b, v7.4.1d could allow an authenticated attacker within the restricted shell environment (rbash) as either the “user” or “factory” account, to read the contents of any file on the filesystem utilizing one of a few available binaries.
- Product
- Fabric Operating System
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbroadcom.combroadcom.com
Feb 18, 2022A locking protection bypass flaw was found in some versions of gnome-shell as shipped within CentOS Stream 8, when the "Application menu" or "Window list" GNOMECVE-2021-20315 · Other software · Gnome · reported by Red HatMedium 6.1
A locking protection bypass flaw was found in some versions of gnome-shell as shipped within CentOS Stream 8, when the "Application menu" or "Window list" GNOME extensions are enabled. This flaw allows a physical attacker who has access to a locked system to kill existing applications and start new ones as the locked user, even if the session is still locked.
- Product
- Gnome-shell
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.combugzilla.redhat.com
Feb 16, 2022VMware NSX Edge contains a CLI shell injection vulnerability.CVE-2022-22945 · Other software · VMware · reported by security@vmware.comHigh 7.8
VMware NSX Edge contains a CLI shell injection vulnerability. A malicious actor with SSH access to an NSX-Edge appliance can execute arbitrary commands on the operating system as root.
- Product
- Cloud Foundation
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2022A vulnerability was discovered in Tenda AC9 v3.0 V15.03.06.42_multi and Tenda AC9 V1.0 V15.03.05.19(6318)_CN which allows for remote code execution via shell meCVE-2020-26728 · Network & remote access · Tenda · reported by MITRECritical 9.8
A vulnerability was discovered in Tenda AC9 v3.0 V15.03.06.42_multi and Tenda AC9 V1.0 V15.03.05.19(6318)_CN which allows for remote code execution via shell metacharacters in the guestuser field to the __fastcall function with a POST request.
- Product
- Ac9 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2022Authenticated remote code execution (RCE) in Composr-CMS 10.0.39 and earlier allows remote attackers to execute arbitrary code via uploading a PHP shell throughCVE-2021-46360 · Other software · Ocproducts · reported by MITREHigh 8.8
Authenticated remote code execution (RCE) in Composr-CMS 10.0.39 and earlier allows remote attackers to execute arbitrary code via uploading a PHP shell through /adminzone/index.php?page=admin-commandr.
- Product
- Composr
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comgithub.com
Feb 4, 2022The affected product is vulnerable to an authenticated OS command injection, which may allow an attacker to inject and execute arbitrary shell commands as the ACVE-2022-0365 · Other software · Ricon · reported by ics-cert@hq.dhs.govCritical 9.1
The affected product is vulnerable to an authenticated OS command injection, which may allow an attacker to inject and execute arbitrary shell commands as the Admin (root) user.
- Product
- Industrial Cellular Router
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2022File upload vulnerability in mingSoft MCMS through 5.2.5, allows remote attackers to execute arbitrary code via a crafted jspx webshell to net.mingsoft.basic.acCVE-2021-46386 · Other software · Mingsoft · reported by MITRECritical 9.8
File upload vulnerability in mingSoft MCMS through 5.2.5, allows remote attackers to execute arbitrary code via a crafted jspx webshell to net.mingsoft.basic.action.web.FileAction#upload.
- Product
- Mcms
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 24, 2022In QuickBox Pro v2.5.8 and below, the config.php file has a variable which takes a GET parameter value and parses it into a shell_exec(''); function without proCVE-2021-44981 · Other software · Quickbox · reported by MITREHigh 8.8
In QuickBox Pro v2.5.8 and below, the config.php file has a variable which takes a GET parameter value and parses it into a shell_exec(''); function without properly sanitizing any shell arguments, therefore remote code execution is possible. Additionally, as the media server is running as root by default attackers can use the sudo command within this shell_exec(''); function, which allows for privilege escalation by means of RCE.
- Product
- Quickbox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2022IPython (Interactive Python) is a command shell for interactive computing in multiple programming languages, originally developed for the Python programming lanCVE-2022-21699 · Other software · ipython · reported by GitHubHigh 8.2
IPython (Interactive Python) is a command shell for interactive computing in multiple programming languages, originally developed for the Python programming language. Affected versions are subject to an arbitrary code execution vulnerability achieved by not properly managing cross user temporary files. This vulnerability allows one user to run code as another on the same machine. All users are advised to upgrade.
- Product
- ipython
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2022A command Injection Vulnerability in McAfee Agent (MA) for Windows prior to 5.7.5 allows local users to inject arbitrary shell code into the file cleanup.exe.CVE-2021-31854 · Other software · McAfee,LLC · reported by trellixpsirt@trellix.comHigh 7.7
A command Injection Vulnerability in McAfee Agent (MA) for Windows prior to 5.7.5 allows local users to inject arbitrary shell code into the file cleanup.exe. The malicious clean.exe file is placed into the relevant folder and executed by running the McAfee Agent deployment feature located in the System Tree. An attacker may exploit the vulnerability to obtain a reverse shell which can lead to privilege escalation to obtain root privileges.
- Product
- McAfee Agent for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordkc.mcafee.comkc.mcafee.com
Jan 14, 2022In executeRequest of OverlayManagerService.java, there is a possible way to control fabricated overlays from adb shell due to a permissions bypass.CVE-2021-39630 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In executeRequest of OverlayManagerService.java, there is a possible way to control fabricated overlays from adb shell due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-202768292
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Jan 11, 2022shelljs is vulnerable to Improper Privilege ManagementCVE-2022-0144 · Other software · shelljs · reported by security@huntr.devHigh 7.1
shelljs is vulnerable to Improper Privilege Management
- Product
- shelljs/shelljs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 3, 2022Possible use after free when process shell memory is freed using IOCTL call and process initialization is in progress in Snapdragon Auto, Snapdragon Compute, SnCVE-2021-30337 · Computers, phones & browsers · Qualcomm, Inc. · reported by product-security@qualcomm.comHigh 8.4
Possible use after free when process shell memory is freed using IOCTL call and process initialization is in progress in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
- Product
- Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, S
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordqualcomm.comqualcomm.com
Dec 23, 2021A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs-fetch and cache-expire subcommands.CVE-2021-3621 · Other software · Fedoraproject · reported by Red HatHigh 8.8
A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs-fetch and cache-expire subcommands. This flaw allows an attacker to trick the root user into running a specially crafted sssctl command, such as via sudo, to gain root access. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
- Product
- Sssd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.redhat.comlists.debian.org
Dec 23, 2021load_cache in GEGL before 0.4.34 allows shell expansion when a pathname in a constructed command line is not escaped or filtered.CVE-2021-45463 · Other software · Gegl · reported by MITREHigh 7.8
load_cache in GEGL before 0.4.34 allows shell expansion when a pathname in a constructed command line is not escaped or filtered. This is caused by use of the system library function for execution of the ImageMagick convert fallback in magick-load. NOTE: GEGL releases before 0.4.34 are used in GIMP releases before 2.10.30; however, this does not imply that GIMP builds enable the vulnerable feature.
- Product
- Gegl
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgitlab.gnome.orggitlab.gnome.org
Dec 21, 2021Directorist: Was vulnerable to Cross-Site Request Forgery to Remote File Upload leading to arbitrary PHP shell uploads in the wp-content/plugins directoryCVE-2021-24981 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Directorist WordPress plugin before 7.0.6.2 was vulnerable to Cross-Site Request Forgery to Remote File Upload leading to arbitrary PHP shell uploads in the wp-content/plugins directory.
- Product
- Directorist
- Fixed in
- 7.0.6.2
- What to do
- Update Directorist to 7.0.6.2 or newer.
Full record and what to do →NVD recordblog.sucuri.netwpscan.com
Dec 17, 2021A buffer overflow vulnerability in the Virtual Path Mapping component of FTPShell v6.83 allows attackers to cause a denial of service (DoS).CVE-2020-18077 · Other software · Ftpshell · reported by MITREHigh 7.5
A buffer overflow vulnerability in the Virtual Path Mapping component of FTPShell v6.83 allows attackers to cause a denial of service (DoS).
- Product
- Ftpshell Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2021Microsoft PowerShell Spoofing VulnerabilityCVE-2021-43896 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Microsoft PowerShell Spoofing Vulnerability
- Product
- CBL Mariner 2.0 x64
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordportal.msrc.microsoft.comportal.msrc.microsoft.com
Dec 13, 2021fastadmin v1.2.1 is affected by a file upload vulnerability which allows arbitrary code execution through shell access.CVE-2021-43117 · Other software · Fastadmin · reported by MITRECritical 9.8
fastadmin v1.2.1 is affected by a file upload vulnerability which allows arbitrary code execution through shell access.
- Product
- Fastadmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2021The Yubico YubiHSM YubiHSM2 library 2021.08, included in the yubihsm-shell project, does not properly validate the length of some operations including SSH signiCVE-2021-43399 · Other software · Yubico · reported by MITREHigh 7.5
The Yubico YubiHSM YubiHSM2 library 2021.08, included in the yubihsm-shell project, does not properly validate the length of some operations including SSH signing requests, and some data operations received from a YubiHSM 2 device.
- Product
- Yubihsm 2 Software Development KIT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.inhq.netyubico.com
Nov 15, 2021An attacker-controlled pointer free in Busybox's hush applet leads to denial of service and possible code execution when processing a crafted shell command, dueCVE-2021-42377 · Other software · busybox · reported by reefs@jfrog.comCritical 9.8
An attacker-controlled pointer free in Busybox's hush applet leads to denial of service and possible code execution when processing a crafted shell command, due to the shell mishandling the &&& string. This may be used for remote code execution under rare conditions of filtered command input.
- Product
- busybox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2021A NULL pointer dereference in Busybox's hush applet leads to denial of service when processing a crafted shell command, due to missing validation after a \x03 dCVE-2021-42376 · Other software · busybox · reported by reefs@jfrog.comMedium 5.5
A NULL pointer dereference in Busybox's hush applet leads to denial of service when processing a crafted shell command, due to missing validation after a \x03 delimiter character. This may be used for DoS under very rare conditions of filtered command input.
- Product
- busybox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2021An incorrect handling of a special element in Busybox's ash applet leads to denial of service when processing a crafted shell command, due to the shell mistakinCVE-2021-42375 · Other software · busybox · reported by reefs@jfrog.comMedium 5.5
An incorrect handling of a special element in Busybox's ash applet leads to denial of service when processing a crafted shell command, due to the shell mistaking specific characters for reserved characters. This may be used for DoS under rare conditions of filtered command input.
- Product
- busybox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 10, 2021The website builder module in Dolibarr 13.0.2 allows remote PHP code execution because of an incomplete protection mechanism in which system, exec, and shell_exCVE-2021-33816 · Other software · Dolibarr · reported by MITRECritical 9.8
The website builder module in Dolibarr 13.0.2 allows remote PHP code execution because of an incomplete protection mechanism in which system, exec, and shell_exec are blocked but backticks are not blocked.
- Product
- Dolibarr Erp/crm
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordseclists.orgtrovent.github.io
Nov 9, 2021Windows Core Shell SI Host Extension Framework for Composable Shell Elevation of Privilege VulnerabilityCVE-2021-42286 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Windows Core Shell SI Host Extension Framework for Composable Shell Elevation of Privilege Vulnerability
- Product
- Windows 10 Version 2004
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordmsrc.microsoft.comportal.msrc.microsoft.com
Nov 8, 2021A shell command injection in the HW Events SNMP community in XoruX LPAR2RRD and STOR2RRD before 7.30 allows authenticated remote attackers to execute arbitrary CVE-2021-42372 · Other software · Xorux · reported by MITREHigh 8.8
A shell command injection in the HW Events SNMP community in XoruX LPAR2RRD and STOR2RRD before 7.30 allows authenticated remote attackers to execute arbitrary shell commands as the user running the service.
- Product
- Lpar2rrd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlpar2rrd.com
Nov 7, 2021Cradlepoint IBR900-600 devices running versions < 7.21.10 are vulnerable to a restricted shell escape sequence that provides an attacker the capability to simulCVE-2021-37471 · Other software · Cradlepoint · reported by MITREHigh 7.5
Cradlepoint IBR900-600 devices running versions < 7.21.10 are vulnerable to a restricted shell escape sequence that provides an attacker the capability to simultaneously deny availability to the device's NetCloud Manager console, local console and SSH command-line.
- Product
- Ibr600c Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcradlepoint.comsecuritybytes.me
Nov 2, 2021In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, exporting collections via PDF export could lead to code execution via shell metacharacters in a collectCVE-2021-43266 · Other software · Mahara · reported by MITREHigh 7.3
In Mahara before 20.04.5, 20.10.3, 21.04.2, and 21.10.0, exporting collections via PDF export could lead to code execution via shell metacharacters in a collection name. Additional, in Mahara before 20.10.4, 21.04.3, and 21.10.1, exporting collections via PDF export could cause code execution
- Product
- Mahara
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.launchpad.netbugs.launchpad.net
Oct 28, 2021Multiple buffer overflows in the limited configuration shell (/sbin/gs_config) on Grandstream HT801 devices before 1.0.29 allow remote authenticated users to exCVE-2021-37748 · Other software · Grandstream · reported by MITREHigh 8.8
Multiple buffer overflows in the limited configuration shell (/sbin/gs_config) on Grandstream HT801 devices before 1.0.29 allow remote authenticated users to execute arbitrary code as root via a crafted manage_if setting, thus bypassing the intended restrictions of this shell and taking full control of the device. There are default weak credentials that can be used to authenticate.
- Product
- Ht801 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgrandstream.comgithub.com
Oct 22, 2021In runDumpHeap of ActivityManagerShellCommand.java, there is a possible deletion of system files due to a confused deputy.CVE-2021-0708 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In runDumpHeap of ActivityManagerShellCommand.java, there is a possible deletion of system files due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-9 Android-10 Android-11 Android-8.1Android ID: A-183262161
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comsource.android.com
Oct 21, 2021IBM Flash System 900 could allow an authenticated attacker to obtain sensitive information and cause a denial of service due to a restricted shell escape vulnerCVE-2021-29873 · Other software · IBM · reported by psirt@us.ibm.comHigh 8.1
IBM Flash System 900 could allow an authenticated attacker to obtain sensitive information and cause a denial of service due to a restricted shell escape vulnerability. IBM X-Force ID: 206229.
- Product
- FlashSystem 900
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexchange.xforce.ibmcloud.comibm.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.