CVE-2019-20500

A vulnerability exists in a component of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated adjacent attacker to execute arbitrary code on the affected system.

An authentication bypass vulnerability exists in the underlying operating system of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated adjacent attacker to execute arbitrary code on the affected system.

Hardcoded password vulnerabilities in the command-line interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to access the affected system using hardcoded credentials. Successful exploitation could grant unauthorized administrative access with elevated privileges.

Prior to 0.8.1, fastapi-code-generator inserts an OpenAPI path into a generated @app.get(...) route decorator as a single-quoted string without escaping embedded quotes. An attacker-influenced OpenAPI path can close the string and inject a valid Python expression into the decorator argument. Syntactically valid generated code executes with the application's or CI process's privileges when the module is imported.

Prior to 0.8.1, fastapi-code-generator inserts Operation.summary into a generated route-handler docstring as a triple-double-quoted string without escaping embedded triple quotes. An attacker-influenced operation summary can close the docstring and inject a valid Python expression statement into the handler body. Syntactically valid generated code executes with the server process's privileges when the affected route handler is called.

Prior to 0.8.1, fastapi-code-generator inserts an additional response status-code key into the generated responses={...} route-decorator dictionary as a single-quoted Python string without escaping embedded quotes. An attacker-influenced second non-primary response key can close the dictionary-key literal and inject a valid Python expression. Syntactically valid generated code executes with the application's or CI process's privileges when the module is imported.

In Docker Desktop for Windows with the WSL2 backend, an unprivileged Linux container can use 32-bit socketcall to bypass the default seccomp restriction on AF_VSOCK. This can expose host-facing services and Windows files accessible to the logged-in user. The issue affects x86-64 WSL2; LinuxKit-based backends are unaffected.

Elo prior to 1.0.1 allows plain strings passed to the parser to use the .constructor.constructor property to reach the JavaScript Function object. The resulting generated JavaScript executes attacker-selected code in the host runtime, enabling browser script execution and arbitrary Node.js code execution.

Elo prior to 1.0.1 has a Ruby backend that embeds attacker-controlled text in double-quoted Ruby strings without escaping #. Ruby interpolation forms in the string-literal emitter or labelled subtype-constraint branch become executable Ruby, allowing Ruby code and shell command execution.

SolarWinds Dameware is affected by a command injection vulnerability that could lead to compromise of the remotely controlled host. Authentication is required.